# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
#
# WHAT THIS IS: the OIDC client + cookie secrets for the per-app oauth2-proxy SIDECAR that gates the
# Crafty web UI (deployment.yaml, container `oauth2-proxy`). The sidecar reads these three keys as
# OAUTH2_PROXY_CLIENT_ID / OAUTH2_PROXY_CLIENT_SECRET / OAUTH2_PROXY_COOKIE_SECRET (env, by name only;
# R-IDP-04). SOPS-encrypted; keys stay cleartext for reviewable diffs.
#
# The `client-secret` value MUST equal the `crafty-client-secret` placed in
# platform/keycloak/keycloak-realm-clients.sops.yaml (which the realm import injects into the Keycloak
# `crafty` client) — same cross-namespace mirror pattern as grafana/gitea/headlamp (a Secret cannot be
# shared across namespaces, so the one value is stored in two encrypted files).
#
# HAND-OFF STEPS (operator):
#  (a) client-id is fixed: `crafty` (matches the Keycloak client).
#  (b) client-secret: use the SAME value generated for keycloak-realm-clients crafty-client-secret
#         openssl rand -hex 32
#  (c) cookie-secret: a fresh random 32-byte value, url-safe base64:
#         openssl rand -base64 32 | tr -- '+/' '-_'
#  (d) Copy to:      platform/crafty/crafty-oauth2-proxy-credentials.sops.yaml
#  (e) Fill values; encrypt:
#         sops -e -i platform/crafty/crafty-oauth2-proxy-credentials.sops.yaml
#  (f) It is already listed under `resources:` in platform/crafty/kustomization.yaml.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: crafty-oauth2-proxy
  namespace: crafty
type: Opaque
stringData:
  client-id: crafty
  # MUST match keycloak-realm-clients crafty-client-secret.
  client-secret: REPLACE-ME
  # Random 32-byte url-safe-base64 cookie signing secret (oauth2-proxy).
  cookie-secret: REPLACE-ME