# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
#
# WHAT THIS IS: the credentials JSON of the locally-managed Cloudflare Tunnel that
# platform/cloudflared runs. `cloudflared tunnel create` writes it; it holds the account tag, the
# tunnel UUID and the tunnel SECRET. Anyone holding it can run a connector for this tunnel and
# receive its traffic, so it is a real credential: SOPS-encrypted in git, never printed.
#
# *** THE REAL FILE IS COMMITTED WITH REPLACE-ME PLACEHOLDERS, ALREADY ENCRYPTED. ***
# So the wiring is complete before the tunnel exists: the resource is listed in kustomization.yaml
# and both overlays already carry the `cloudflared` decryption patch. Until you fill it, the
# Deployment CrashLoops inside its own NON-GATING Flux Kustomization (clusters/base/cloudflared.yaml,
# wait:false) and CloudflaredTunnelDown fires. Nothing else in the cluster is affected.
#
# HAND-OFF (operator — an agent must not mint a long-lived credential, CLAUDE.md §6).
# The full procedure, with verification and rollback, is runbooks/cloudflare-tunnel.md. In short:
#   1. `cloudflared tunnel login` + `cloudflared tunnel create --credentials-file ... home-k3s`
#      (pinned cloudflared image under podman; the toolbox does not ship cloudflared).
#   2. Write the JSON STRAIGHT INTO the encrypted file with `sops set`, inside the toolbox — the
#      plaintext never reaches a terminal or the repo tree.
#   3. Put the tunnel UUID (not secret) into platform/cloudflared/config.yaml `tunnel:`.
#   4. Verify without printing (`sops -d --extract ... | jq -e ...`), then PR it.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: cloudflared-credentials
  namespace: cloudflared
type: Opaque
stringData:
  # One line of JSON, exactly as `cloudflared tunnel create` wrote it (compacted with `jq -c`):
  #   {"AccountTag":"<account>","TunnelSecret":"<base64>","TunnelID":"<uuid>"}
  # TunnelID MUST equal the `tunnel:` UUID in config.yaml.
  credentials.json: REPLACE-ME