infra: split foxhunt-secrets into per-concern secrets

db-credentials, jwt-secret, redis-credentials, s3-credentials.
Each service only references the secrets it needs.
Values are REPLACE_IN_DEPLOY markers — real values
injected by scripts/deploy-secrets.sh.

Also updated references in postgres.yaml, migrate.yaml,
and postgres-init.yaml to use db-credentials.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/databases/postgres.yaml

@@ -52,8 +52,8 @@ spec:
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
           volumeMounts:
             - name: postgres-data
               mountPath: /var/lib/postgresql/data

infra/k8s/gitlab/postgres-init.yaml

@@ -54,8 +54,8 @@ spec:
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: GITLAB_DB_PASSWORD
               valueFrom:
                 secretKeyRef:

infra/k8s/jobs/migrate.yaml

@@ -21,8 +21,8 @@ spec:
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DB_PASSWORD)@postgres:5432/foxhunt"
           resources:

infra/k8s/secrets/foxhunt-secrets.yaml

@@ -1,19 +1,53 @@
+# Database credentials — used by services that connect to PostgreSQL.
+# Real values injected by scripts/deploy-secrets.sh from Scaleway Secrets Manager.
 apiVersion: v1
 kind: Secret
 metadata:
-  name: foxhunt-secrets
+  name: db-credentials
   namespace: foxhunt
   labels:
     app.kubernetes.io/part-of: foxhunt
 type: Opaque
 stringData:
-  # IMPORTANT: Replace these placeholder values before applying!
-  # Generate with: openssl rand -base64 32
-  db-password: "REPLACE_ME_WITH_REAL_PASSWORD"
-  jwt-secret: "REPLACE_ME_WITH_32_CHAR_MIN_SECRET_KEY"
-  redis-password: "REPLACE_ME_WITH_REAL_PASSWORD"
-  s3-access-key: "REPLACE_ME_WITH_S3_ACCESS_KEY"
-  s3-secret-key: "REPLACE_ME_WITH_S3_SECRET_KEY"
+  password: "REPLACE_IN_DEPLOY"
+---
+# JWT signing secret — used by services that validate/issue JWTs.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: jwt-secret
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/part-of: foxhunt
+type: Opaque
+stringData:
+  secret: "REPLACE_IN_DEPLOY"
+---
+# Redis credentials — used by services with Redis connections.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: redis-credentials
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/part-of: foxhunt
+type: Opaque
+stringData:
+  password: "REPLACE_IN_DEPLOY"
+---
+# S3/Minio credentials for application-level access (model storage, data).
+# NOT the same as minio-credentials (used by initContainers for binary fetch).
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-credentials
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/part-of: foxhunt
+type: Opaque
+stringData:
+  access-key: "REPLACE_IN_DEPLOY"
+  secret-key: "REPLACE_IN_DEPLOY"
 ---
 # Registry pull secret for Scaleway Container Registry
 # Create with:
@@ -22,9 +56,3 @@ stringData:
 #     --docker-server=rg.fr-par.scw.cloud \
 #     --docker-username=foxhunt \
 #     --docker-password=<SCW_SECRET_KEY>
-#
-# This file documents the requirement but cannot contain the actual credentials.
-#
-# IBKR credentials are stored in a separate secret: ibkr-credentials
-# See infra/k8s/secrets/ibkr-credentials.yaml
-# Values are populated from Scaleway Secret Manager (foxhunt-ibkr-*) via CI/CD.

infra/k8s/services/api-gateway.yaml

@@ -110,8 +110,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -119,8 +119,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE

infra/k8s/services/backtesting-service.yaml

@@ -110,8 +110,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -119,8 +119,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE

infra/k8s/services/broker-gateway.yaml

@@ -110,8 +110,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -119,8 +119,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE

infra/k8s/services/data-acquisition-service.yaml

@@ -112,8 +112,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL

infra/k8s/services/ml-training-service-gpu.yaml

@@ -118,8 +118,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -127,8 +127,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE

infra/k8s/services/ml-training-service.yaml

@@ -153,8 +153,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -162,8 +162,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE

infra/k8s/services/trading-agent-service.yaml

@@ -110,8 +110,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -119,8 +119,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE

infra/k8s/services/trading-service-gpu.yaml

@@ -117,8 +117,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -126,8 +126,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE

infra/k8s/services/trading-service.yaml

@@ -110,8 +110,8 @@ spec:
             - name: DATABASE_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: db-password
+                  name: db-credentials
+                  key: password
             - name: DATABASE_URL
               value: "postgresql://foxhunt:$(DATABASE_PASSWORD)@postgres:5432/foxhunt"
             - name: REDIS_URL
@@ -119,8 +119,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: JWT_ISSUER
               value: foxhunt-api-gateway
             - name: JWT_AUDIENCE

infra/k8s/services/web-gateway.yaml

@@ -113,8 +113,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: foxhunt-secrets
-                  key: jwt-secret
+                  name: jwt-secret
+                  key: secret
             - name: TRADING_SERVICE_URL
               value: "http://api-gateway:50051"
             - name: BACKTESTING_SERVICE_URL