# Example SealedSecret for Vigil.
#
# Flow: start from a plain Secret (see the commented example below), then
# seal it with `kubeseal -o yaml < plain.yaml > sealed.yaml`. The sealed
# output is safe to commit to git — only the SealedSecrets controller in
# the target cluster can decrypt it.
#
# After applying this to the cluster, the controller creates a regular
# Secret named "vigil-secrets" in the "vigil" namespace. Install the chart
# with:
#   helm install vigil ./infra/helm/vigil -n vigil --create-namespace \
#     --set secrets.existingSecret=vigil-secrets
#
# Do NOT commit the plain Secret. This file is an illustration only — it
# won't decrypt against any real cluster because the values below are
# placeholders, not real ciphertext.
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: vigil-secrets
  namespace: vigil
spec:
  template:
    metadata:
      name: vigil-secrets
      namespace: vigil
    type: Opaque
  encryptedData:
    # All values are base64-encoded ciphertext produced by `kubeseal`.
    # The keys below are the minimum set; add others (SPLUNK_PASSWORD,
    # SLACK_BOT_TOKEN, etc.) as your integrations require.
    ANTHROPIC_API_KEY: AgB...replace-with-kubeseal-output...
    POSTGRES_PASSWORD: AgB...replace-with-kubeseal-output...
    JWT_SECRET_KEY:    AgB...replace-with-kubeseal-output...

# ─── Corresponding plain Secret (before `kubeseal`) ─────────────────────────
# apiVersion: v1
# kind: Secret
# metadata:
#   name: vigil-secrets
#   namespace: vigil
# type: Opaque
# stringData:
#   ANTHROPIC_API_KEY: sk-ant-api03-...
#   POSTGRES_PASSWORD: "use-a-strong-password"
#   JWT_SECRET_KEY: "$(python -c 'import secrets; print(secrets.token_urlsafe(64))')"