# Semaphore PostgreSQL owner credentials (WS-APPS, Phase 6). SOPS-encrypted (age).
# type basic-auth (keys username/password) so the CNPG semaphore-db Cluster consumes it as the
# semaphore role via spec.bootstrap.initdb.secret. The SAME password is mirrored (out of band) into
# semaphore-bootstrap/db-password in ns semaphore for the app env (cross-ns Secret reads are not
# possible). Recover: infra/devcontainer/dev.sh run sops -d apps/semaphore-db-app.sops.yaml
apiVersion: v1
kind: Secret
metadata:
    name: semaphore-db-app
    namespace: semaphore-db
    labels:
        app.kubernetes.io/name: semaphore-db
type: kubernetes.io/basic-auth
stringData:
    username: ENC[AES256_GCM,data:HHZSssc3EUBI,iv:rSQDLlUB7jJmNt/aWK192Dai02DLnUR8gUBvTjPOR2w=,tag:536QJ0eni7ywFNcGsahRGg==,type:str]
    password: ENC[AES256_GCM,data:U08COmf1X+JXjdEiKLQbYLcwU9/dAY/tnr4ErJxYY1CfVT1g6O9EfPCAGr4Bcb7w,iv:FNX8fCYuiXzG4SPwqwsVQwGOCxrz7WIsoZgD7QFeF14=,tag:tzEF58j4iLF9GLW6spo8Ww==,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByMk1DQXI4T1NycFRaTnpw
            eXprNTRpQUlmWkMrVkJBand5UUtQYmxZT0E0CkNZMU9Ic0FuS0dLMzJQUWVBdmhU
            ZmQvYjRhNWs4SVFLYzhLV1lRdDNQc1UKLS0tIEtEQmFOOWdlRkUwczB1RzRPSU5R
            Y1ZFVWZnS2dZUlV1cDJTRHNSWjFrZzgKT3O1iKP40UDdecai9wygeqe1W+wWqiL/
            jxZAK0Nwk/AMCgxuNKruDsjBTJ7SLoCVn+uyp6CUdPt/Xbax/XOnIw==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-08-26T06:45:19Z"
    mac: ENC[AES256_GCM,data:gpPdGR59gDiMlKtpaIaYUDArOH0ItuJ9egGC8/QNV3JHkvPgKbA0Czwy4qrVOOOi1/9FVD2i0an5O1OPHy5B9R8I1xanXjCzlz1x7+Q76xIGZHwAHPsjPJyqOefuwWFoE114dStHhNGdLN2nNnDJX2bjJHyMtKHi8CK7BNkpJxY=,iv:jV3dwb0f7c+RrqkufxOYBwh4yNlsfK2KfMh2nn9+9WI=,tag:Yg9B/q6fxz4MobsF/1agHg==,type:str]
    pgp: []
    encrypted_regex: ^(data|stringData)$
    version: 3.9.4