# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
#
# WHAT THIS IS: the two values that (a) let the UniFi VM install UniFi OS Server by itself, with
# nobody typing commands inside the guest, and (b) give the operator a way INTO that guest at all.
# KubeVirt mounts this Secret into the VM as a tiny read-only iso9660 disk labelled `UOSDATA` (see
# the `uosdata` volume in 30-virtualmachine.yaml); each key below becomes a file of the same name on
# that disk, and the in-guest `uos-install.service` reads them on EVERY boot.
#
# READ THIS FIRST — UOS IS ALREADY INSTALLED ON THE LIVE PROD GUEST (verified 2026-09-14, see the
# README "What is actually wrong"). `installer-url` is therefore NOT the fix for today's outage; it
# is the rebuild path and the "the install never happened" path. `install-uos` refuses to run the
# installer at all while systemd knows a `uosserver.service`, so filling this in cannot clobber a
# working controller. `console-password` IS useful today: it is the only way to get a shell.
#
# WHY THE URL IS BEHIND SOPS: it is obtained through the operator's own (free) Ubiquiti account
# session at ui.com/download/software/unifi-os-server, it identifies a specific build, and it is not
# ours to redistribute. Treat it as account-derived material, not as public configuration.
# HONEST CAVEAT, checked 2026-09-14: the resulting `https://fw-download.ubnt.com/data/
# unifi-os-server/<hash>-linux-x64-<version>-<uuid>.<n>-x64` URL carries NO signature query string,
# and public community install scripts hard-code these URLs — so it does not behave like a
# short-lived signed link. It does change every release. Encrypting it costs nothing and keeps the
# repo's "account-derived material is not config" line clean, but do NOT design around "it expires".
#
# HAND-OFF STEPS (operator) — this is the whole job:
#  (a) Sign in at https://ui.com/download/software/unifi-os-server, pick the Linux (x64) build, and
#      copy the download link (right-click -> Copy link address). Do NOT download it here; the guest
#      fetches it itself.
#  (b) Open the encrypted sibling in your editor:
#         sops apps/vms/unifi/unifi-uos-installer.sops.yaml
#  (c) Replace the two REPLACE-ME values. Either may be left as the placeholder — the guest skips a
#      placeholder rather than failing.
#  (d) Save/quit (sops re-encrypts in place), commit, push, merge to the branch prod tracks.
#  (e) Restart the VM once so the new cloud-init instance and the new disk are picked up:
#         kubectl -n unifi delete vmi unifi        # `running: true` recreates it; no virtctl needed
#      Watch it come up WITHOUT virtctl:
#         kubectl -n unifi logs -f $(kubectl -n unifi get pod -l kubevirt.io=virt-launcher \
#           -o name | head -1) -c guest-console-log
#  (f) UI: https://192.168.2.21:11443 (prod) or https://unifi.home.keithjackson.dev:11443.
#
# IF YOU LATER NEED A NEW URL (new release, dead link): repeat (b)-(e). No firmware-UUID bump is
# needed for that — the disk is rebuilt from this Secret on every VMI start and the systemd unit
# re-reads it every boot. The UUID bump in 30-virtualmachine.yaml is only needed when the cloud-init
# payload ITSELF changes.
#
# The file is already listed under `resources:` in apps/vms/unifi/kustomization.yaml, and `apps-vms`
# is patched with the SOPS `decryption` stanza in clusters/dev + clusters/prod.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: unifi-uos-installer
  namespace: unifi
type: Opaque
stringData:
  # KEY NAMES ARE LOAD-BEARING: each key becomes a FILE of that exact name on the UOSDATA disk, and
  # /usr/local/sbin/install-uos reads them by path. Renaming a key breaks the install silently.
  #
  # The signed-in download link for UniFi OS Server, Linux x64. Anything that is not an https URL
  # (this placeholder included) is treated by the guest as "not provided yet": the unit logs
  # "UOS installer-url not set yet" and exits 0, so the VM stays healthy and simply does not install.
  installer-url: REPLACE-ME
  # Password set on the guest's `ubuntu` account on every boot, for `virtctl -n unifi console unifi`.
  # THIS IS THE ONLY DOOR INTO THE GUEST. The stock Ubuntu 24.04 cloud image ships `ubuntu` locked,
  # no key was ever installed, and an SSH key would not help: the VM's masquerade interface forwards
  # only the ports declared in 30-virtualmachine.yaml and 22 is not among them (probed from inside
  # virt-launcher, 2026-09-14 — the guest RSTs on 22 just as it does on 11443). Generate one with
  #     openssl rand -base64 24
  # Leave it as REPLACE-ME to keep the account locked; the script skips the placeholder by name.
  console-password: REPLACE-ME