# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
# and never auto-encrypted by SOPS). Reference scaffold only.
#
# (a) Copy to:      platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml
# (b) kustomization: add this line under `resources:` in
#                    platform/oauth2-proxy/kustomization.yaml
#                       - oauth2-proxy-credentials.sops.yaml
# (c) Encrypt:       sops -e -i platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml
# (d) Consumed by:   oauth2-proxy Helm chart -> existingSecret. [Phase 6]
#
# VALUE NOTES:
#  - client-id / client-secret: come from the Keycloak OIDC client created for
#    oauth2-proxy (Phase 6, after Keycloak is up).
#  - cookie-secret: must be a 16, 24, or 32-byte value, base64-encoded.
#    Generate with:  openssl rand -base64 32
#
# !! VERIFY KEY NAMES BEFORE ENCRYPTING !!
# Confirm the exact stringData key names against the pinned oauth2-proxy chart's
# existingSecret contract (common keys: client-id, client-secret, cookie-secret,
# but chart versions vary). Adjust below to match before running `sops -e -i`.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: oauth2-proxy-credentials
  namespace: oauth2-proxy
type: Opaque
stringData:
  client-id: REPLACE-ME
  client-secret: REPLACE-ME
  cookie-secret: REPLACE-ME