# ADR-090-B: awoooi-secrets 新增 MIGRATION_DATABASE_URL
# 建立時間: 2026-04-18 台北時區
# 建立者: ogt + Claude Opus 4.7 (1M)
#
# 目的: 把 migration 憑證 (awoooi_migrator, 限 DDL) 從應用憑證拆開
#
# 套用方式 (兩選一):
#   (A) 手動 patch K8s secret (推薦,不改 manifest):
#       kubectl patch secret awoooi-secrets -n awoooi-prod \
#         -p "$(cat <<EOF
#       {
#         \"stringData\": {
#           \"MIGRATION_DATABASE_URL\": \"postgresql+asyncpg://awoooi_migrator:<NEW_PWD>@192.168.0.188:5432/awoooi_prod\"
#         }
#       }
#       EOF
#       )"
#
#   (B) 用 sealed-secrets (若有 GitOps 路徑):
#       1. 先用 kubeseal 把 stringData 加密
#       2. commit 加密後的 SealedSecret manifest 進 k8s/awoooi-prod/
#       3. argocd sync
#
# 驗收:
#   kubectl get secret awoooi-secrets -n awoooi-prod -o jsonpath='{.data.MIGRATION_DATABASE_URL}' | base64 -d
#   → 應顯示 postgresql+asyncpg://awoooi_migrator:...

---
# 本範本為 patch-style,只列新增欄位,其他欄位保持原樣
apiVersion: v1
kind: Secret
metadata:
  name: awoooi-secrets
  namespace: awoooi-prod
type: Opaque
stringData:
  # 既有 24 個 key 不列,避免意外覆蓋
  # ... (既有 DATABASE_URL / TELEGRAM_TOKEN / ... 皆維持原值)

  # 新增:
  MIGRATION_DATABASE_URL: "postgresql+asyncpg://awoooi_migrator:<FILLED_BY_STATESMAN>@192.168.0.188:5432/awoooi_prod"
