# Database credentials — used by services that connect to PostgreSQL.
# Real values injected by scripts/deploy-secrets.sh from Scaleway Secrets Manager.
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
type: Opaque
stringData:
  password: "REPLACE_IN_DEPLOY"
---
# JWT signing secret — used by services that validate/issue JWTs.
apiVersion: v1
kind: Secret
metadata:
  name: jwt-secret
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
type: Opaque
stringData:
  secret: "REPLACE_IN_DEPLOY"
---
# Redis credentials — used by services with Redis connections.
apiVersion: v1
kind: Secret
metadata:
  name: redis-credentials
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
type: Opaque
stringData:
  password: "REPLACE_IN_DEPLOY"
---
# S3/Minio credentials for application-level access (model storage, data).
# NOT the same as minio-credentials (used by initContainers for binary fetch).
apiVersion: v1
kind: Secret
metadata:
  name: s3-credentials
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
type: Opaque
stringData:
  access-key: "REPLACE_IN_DEPLOY"
  secret-key: "REPLACE_IN_DEPLOY"
---
# Registry pull secret for Scaleway Container Registry
# Create with:
#   kubectl create secret docker-registry scw-registry \
#     --namespace foxhunt \
#     --docker-server=rg.fr-par.scw.cloud \
#     --docker-username=foxhunt \
#     --docker-password=<SCW_SECRET_KEY>