# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
# and never auto-encrypted by SOPS). Reference scaffold only.
#
# (a) Copy to:      (TO BE DECIDED AT PHASE 3 — VPN component not authored yet)
# (b) kustomization: DO NOT WIRE YET.
# (c) Encrypt:       sops -e -i <target>.sops.yaml   (once the target path exists)
# (d) Consumed by:   Phase-3 Gluetun VPN egress gateway. The consuming
#                    component AND its namespace DO NOT EXIST yet — this template
#                    is provisioned upfront. [Phase 3]
#
# !! NAMESPACE UNKNOWN — the metadata.namespace below is a placeholder. Set it to
#    the VPN gateway's namespace when that component is authored at Phase 3. !!
#
# VALUE NOTES:
#  - username: PIA (Private Internet Access) user, form pNNNNNNN.
#  - password: PIA password.
#  - Gluetun typically reads OPENVPN_USER / OPENVPN_PASSWORD (OpenVPN) or
#    WireGuard credentials. Confirm the chosen protocol when wiring — the
#    requirement says NOT TCP. The env var names / key names the Gluetun
#    deployment expects may differ from username/password below; adjust to match
#    the chosen protocol before encrypting.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: pia-credentials
  namespace: REPLACE-ME-PHASE-3-VPN-NAMESPACE
type: Opaque
stringData:
  username: REPLACE-ME
  password: REPLACE-ME