# SOPS Secret Templates

This directory holds **reference templates** for the SOPS-encrypted secrets that
platform components consume. They are **not applied and not encrypted**.

## Why `.yaml.example`?

Every file here uses a `.yaml.example` extension so that:

- **kustomize never loads them** (they are not `.yaml` / not listed in any
  `kustomization.yaml`), and
- **SOPS never auto-encrypts them** (the repo's `.sops.yaml` creation rules match
  `*.sops.yaml`, not `*.yaml.example`).

They exist purely so the operator can see the exact Kubernetes Secret shape
(name, namespace, keys) each component expects. **They contain only placeholder
values** (`REPLACE-ME`, `<fill me>`) — never real secrets.

## Operator flow (per secret)

For each `<name>.yaml.example`:

1. **Copy** it to the target path shown in the file's top comment, renaming to
   `<name>.sops.yaml`. Example:

   ```bash
   cp bootstrap/sops/secret-templates/grafana-admin-credentials.yaml.example \
      platform/monitoring/grafana-admin-credentials.sops.yaml
   ```

2. **Fill** in the real values (replace every `REPLACE-ME` / `<fill me>`).

3. **Encrypt in place** with SOPS + age:

   ```bash
   sops -e -i platform/monitoring/grafana-admin-credentials.sops.yaml
   ```

4. **Wire it** into the component by adding the resource line (shown in the
   file's top comment) under `resources:` in that component's
   `kustomization.yaml`:

   ```yaml
   resources:
     - grafana-admin-credentials.sops.yaml
   ```

5. **Commit** the encrypted `.sops.yaml` (ciphertext is safe to commit) and the
   `kustomization.yaml` change. Flux decrypts it at reconcile via the cluster
   age key.

## Files in this directory

| Template | Secret / namespace | Phase |
|---|---|---|
| `cloudflare-api-token.cert-manager.yaml.example` | `cloudflare-api-token` / `cert-manager` | 2 |
| `cloudflare-api-token.external-dns.yaml.example` | `cloudflare-api-token` / `external-dns` (same token) | 2 |
| `grafana-admin-credentials.yaml.example` | `grafana-admin-credentials` / `monitoring` | 4 |
| `alertmanager-smtp.yaml.example` | `alertmanager-smtp` / `monitoring` | 4 |
| `keycloak-admin-credentials.yaml.example` | `keycloak-admin-credentials` / `keycloak` | 6 |
| `oauth2-proxy-credentials.yaml.example` | `oauth2-proxy-credentials` / `oauth2-proxy` | 6 |
| `pia-credentials.yaml.example` | `pia-credentials` / TBD (Phase-3 VPN) | 3 |

## Master checklist

See [`bootstrap/sops/CREDENTIALS.md`](../CREDENTIALS.md) for the full,
end-to-end credential provisioning flow and checklist.