# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
# and never auto-encrypted by SOPS). Reference scaffold only.
#
# (a) Copy to:      platform/monitoring/alertmanager-smtp.sops.yaml
# (b) kustomization: add this line under `resources:` in
#                    platform/monitoring/kustomization.yaml
#                       - alertmanager-smtp.sops.yaml
# (c) Encrypt:       sops -e -i platform/monitoring/alertmanager-smtp.sops.yaml
# (d) Consumed by:   Alertmanager (kube-prometheus-stack). Only the SMTP
#                    PASSWORD lives here. It is mounted at
#                    /etc/alertmanager/secrets/alertmanager-smtp/smtp-password. [Phase 4]
#
# NOTE: The non-secret SMTP endpoint fields — smtp_smarthost, smtp_from,
# smtp_auth_username, and the receiver `to:` addresses — are configured in
# platform/monitoring/kube-prometheus-stack.yaml (currently REPLACE-ME
# placeholders there). Only the password is this secret.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
    name: alertmanager-smtp
    namespace: monitoring
type: Opaque
stringData:
    smtp-password: ENC[AES256_GCM,data:MDBdjOjZXSoieAwO0GJVN7RhTQ==,iv:40Kwqv4fO5QjehYXf0fNGPA+asInXfzUDChuQv7HYrM=,tag:HgMu9y2+gqufSAQ9MqKiOA==,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiamFxdXVUR0VxMlNkeUFL
            OXZqc3d5V1RGQVhHMW15dmllakNZeDVUQzJVCnVtRHBCOWJOSmsxVVRFSEZBTkFi
            V3FkSzVDMkU5aWNxR0lVMGpheEk1OUkKLS0tIE5hQ3A4eDV4eklWVFB6NjZkaUFT
            UHhPc0FDbDNuT2ZERHJwYllCY1U2NmsKF2Ct1RzFMHYW5JNy8v0kS8oV96eecH9b
            nkG3ve8Ku1Ttw4O8htQcJ0qs6rE4+rXXNrhszmFOWDHZEKBd5CaWiw==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-08-22T02:35:27Z"
    mac: ENC[AES256_GCM,data:3/KTeIFvRZKDQFH7WvkJLPH2eyTl8g5LPLKBvV7Dg0u+ZfSkNU1zql3LzLbApiqTXcP2393pZyO+11AO5TK4ObqfFVYxqyTFega1CCnkgrHygFGmt70jwlgCXbWqkC+AGG8XOUb96M0tCrRbJjz/C3eoFjEmqTZLNfqn+smNO3U=,iv:KgC0NsxHWCbeidHa8Yt+F9Qh1YslHvKtdYr+4tM/IB8=,tag:GtDE/7fuTbPZMVE6C/oiLQ==,type:str]
    pgp: []
    encrypted_regex: ^(data|stringData)$
    version: 3.9.4