# AWOOOI 正式環境 Secrets 模板
# 負責人: CIO / CISO
# 版本: v1.0
# 日期: 2026-03-20
#
# ⚠️ 注意: 此檔案為模板，實際值由 CI/CD 或手動注入
# 實際 Secret 值不應提交到 Git

apiVersion: v1
kind: Secret
metadata:
  name: awoooi-secrets
  namespace: awoooi-prod
type: Opaque
stringData:
  # 資料庫連線 (實際值請替換)
  # 重要: 必須使用 +asyncpg 驅動 (2026-03-28 K-HA 遷移確認)
  DATABASE_URL: "postgresql+asyncpg://awoooi:CHANGE_ME@192.168.0.188:5432/awoooi_prod"

  # Redis 連線
  REDIS_URL: "redis://192.168.0.188:6380/10"

  # JWT 認證
  JWT_SECRET: "CHANGE_ME_TO_RANDOM_STRING"
  JWT_ALGORITHM: "HS256"

  # AI 服務 (雲端備援) - ADR-006 v1.3 + ADR-036
  GEMINI_API_KEY: "CHANGE_ME"
  CLAUDE_API_KEY: "CHANGE_ME"
  # 2026-03-29 ogt: ADR-036 Nemotron Tool Calling (83% 精準度)
  NVIDIA_API_KEY: "CHANGE_ME"

  # 通知服務
  SMTP_HOST: "smtp.example.com"
  SMTP_USER: "CHANGE_ME"
  SMTP_PASSWORD: "CHANGE_ME"

  # Phase 5.5: Telegram Gateway (OpenClaw)
  OPENCLAW_TG_BOT_TOKEN: "CHANGE_ME"
  OPENCLAW_TG_CHAT_ID: "CHANGE_ME"
  OPENCLAW_TG_USER_WHITELIST: "CHANGE_ME"

  # 2026-04-03 ogt: SRE 戰情室群組三頭政治 (Triumvirate ADR-053)
  # 實際值由 CD 注入 (kubectl patch secret)，此處為佔位
  OPENCLAW_BOT_TOKEN: "CHANGE_ME"
  NEMOTRON_BOT_TOKEN: "CHANGE_ME"

  # Webhook 安全 (CISO 要求)
  WEBHOOK_HMAC_SECRET: "CHANGE_ME_TO_RANDOM_64_CHARS"
  # ADR-059: Gitea Webhook → AWOOOI API 簽章驗證 (X-Gitea-Signature)
  # 2026-04-05 Claude Code: GitHub → Gitea 遷移，新增此 Secret
  # 實際值由 CD 注入 (kubectl patch secret)，此處為佔位
  GITEA_WEBHOOK_SECRET: "CHANGE_ME"

  # ============================================================================
  # Phase 10: Sentry Self-Hosted (192.168.0.110:9000)
  # 2026-03-27: 首席架構師審查 - 補齊遺漏配置
  # DSN 格式: http://{public_key}@{host}:{port}/{project_id}
  # ============================================================================
  SENTRY_DSN: "CHANGE_ME"
  # 2026-03-29 ogt: ADR-037 - Comment 回寫需要 Auth Token
  # 取得方式: Sentry UI → Settings → Auth Tokens → Create New Token
  # 權限: event:admin, project:read, project:write
  SENTRY_AUTH_TOKEN: "CHANGE_ME"
