# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
#
# WHAT THIS IS: the scoped (non-root) MinIO S3 access key for the off-cluster backup target that
# roles/minio_backup_target stands up on the Proxmox host (playbooks/backup-minio.yml). It is the
# credential Velero (R-STATE-03) and CloudNativePG / Barman (R-IDP-05) use to write backups. The
# SAME key/secret live (ansible-vault) in infra/ansible/inventory/group_vars/proxmox_hosts/vault.yml
# as minio_backup_target_access_key/_secret_key — the two MUST stay in sync.
#
# ENDPOINT (not secret):  http://192.168.1.9:9000   (path-style; region us-east-1 is a placeholder,
#                         MinIO ignores it but S3 clients require one). Buckets: velero, cnpg.
#
# HAND-OFF STEPS (operator):
#  (a) Copy to:      platform/backup/minio-credentials.sops.yaml
#  (b) Fill the access key + secret (== the vaulted scoped key on the Proxmox host).
#  (c) Encrypt:      sops -e -i platform/backup/minio-credentials.sops.yaml
#  (d) Wire per consumer (WS-STORAGE / WS-SEC):
#        - Velero  → credentials.existingSecret pointing at a Secret with the `cloud` INI key,
#                    backupStorageLocation.config.s3Url=S3_ENDPOINT, s3ForcePathStyle="true",
#                    bucket=velero (namespace: velero).
#        - CNPG    → Barman objectStore endpointURL=S3_ENDPOINT, destinationPath=s3://cnpg,
#                    s3Credentials.accessKeyId/secretAccessKey from ACCESS_KEY_ID/ACCESS_SECRET_KEY
#                    (namespace: cnpg-system).
#      A Secret is namespace-scoped — replicate/rename this one into each consumer namespace as
#      that wiring requires.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
    name: minio-backup-credentials
    namespace: backup
type: Opaque
stringData:
    # ── endpoint + buckets (not secret; single source of truth) ──
    S3_ENDPOINT: "http://192.168.1.9:9000"
    S3_REGION: "us-east-1"
    S3_FORCE_PATH_STYLE: "true"
    VELERO_BUCKET: "velero"
    CNPG_BUCKET: "cnpg"
    # ── scoped access key (velero + cnpg buckets only) ──
    AWS_ACCESS_KEY_ID: "REPLACE-ME"
    AWS_SECRET_ACCESS_KEY: "REPLACE-ME"
    # CNPG Barman object store consumes these discrete key names.
    ACCESS_KEY_ID: "REPLACE-ME"
    ACCESS_SECRET_KEY: "REPLACE-ME"
    # Velero's aws plugin reads an INI credentials file from the `cloud` key of its existingSecret.
    cloud: |
        [default]
        aws_access_key_id=REPLACE-ME
        aws_secret_access_key=REPLACE-ME