# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
# and never auto-encrypted by SOPS). Reference scaffold only.
#
# (a) Copy to:      platform/monitoring/alertmanager-smtp.sops.yaml
# (b) kustomization: add this line under `resources:` in
#                    platform/monitoring/kustomization.yaml
#                       - alertmanager-smtp.sops.yaml
# (c) Encrypt:       sops -e -i platform/monitoring/alertmanager-smtp.sops.yaml
# (d) Consumed by:   Alertmanager (kube-prometheus-stack). Only the SMTP
#                    PASSWORD lives here. It is mounted at
#                    /etc/alertmanager/secrets/alertmanager-smtp/smtp-password. [Phase 4]
#
# NOTE: The non-secret SMTP endpoint fields — smtp_smarthost, smtp_from,
# smtp_auth_username, and the receiver `to:` addresses — are configured in
# platform/monitoring/kube-prometheus-stack.yaml (currently REPLACE-ME
# placeholders there). Only the password is this secret.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: alertmanager-smtp
  namespace: monitoring
type: Opaque
stringData:
  smtp-password: REPLACE-ME