buzz/deploy/charts/buzz/examples/secret-sample.yaml

# Sample Secret matching `secrets.existingSecret: buzz-secrets`.
#
# Manage this via SealedSecrets / SOPS / External Secrets / Vault — anything
# that keeps the unencrypted form out of git. The chart reads keys it finds
# and leaves the rest as Pod env vars marked `optional: true`.
#
# Keys consumed by the relay (all optional unless required by relay config):
#   BUZZ_RELAY_PRIVATE_KEY        — 64-char hex; relay identity (do NOT rotate)
#   BUZZ_GIT_HOOK_HMAC_SECRET     — 32+ chars; required when replicaCount > 1
#   DATABASE_URL                  — postgres://...
#   READ_DATABASE_URL             — postgres://... (optional read-replica; omit to disable read routing)
#   REDIS_URL                     — redis://...  (required when replicaCount > 1)
#   BUZZ_S3_ACCESS_KEY
#   BUZZ_S3_SECRET_KEY
apiVersion: v1
kind: Secret
metadata:
  name: buzz-secrets
  namespace: buzz
type: Opaque
stringData:
  BUZZ_RELAY_PRIVATE_KEY: "REPLACE_WITH_64_HEX"
  BUZZ_GIT_HOOK_HMAC_SECRET: "REPLACE_WITH_RANDOM_64_CHARS"
  DATABASE_URL: "postgres://buzz:REPLACE@postgres.buzz.svc.cluster.local:5432/buzz?sslmode=require"
  REDIS_URL: "redis://:REPLACE@redis.buzz.svc.cluster.local:6379"
  BUZZ_S3_ACCESS_KEY: "REPLACE"
  BUZZ_S3_SECRET_KEY: "REPLACE"