mirror of
https://github.com/block/buzz.git
synced 2026-10-29 05:21:31 +00:00
29c48883d3
Signed-off-by: Tyler Longwell <tlongwell@block.xyz> Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co> Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
28 lines
1.2 KiB
YAML
28 lines
1.2 KiB
YAML
# Sample Secret matching `secrets.existingSecret: buzz-secrets`.
|
|
#
|
|
# Manage this via SealedSecrets / SOPS / External Secrets / Vault — anything
|
|
# that keeps the unencrypted form out of git. The chart reads keys it finds
|
|
# and leaves the rest as Pod env vars marked `optional: true`.
|
|
#
|
|
# Keys consumed by the relay (all optional unless required by relay config):
|
|
# BUZZ_RELAY_PRIVATE_KEY — 64-char hex; relay identity (do NOT rotate)
|
|
# BUZZ_GIT_HOOK_HMAC_SECRET — 32+ chars; required when replicaCount > 1
|
|
# DATABASE_URL — postgres://...
|
|
# READ_DATABASE_URL — postgres://... (optional read-replica; omit to disable read routing)
|
|
# REDIS_URL — redis://... (required when replicaCount > 1)
|
|
# BUZZ_S3_ACCESS_KEY
|
|
# BUZZ_S3_SECRET_KEY
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: buzz-secrets
|
|
namespace: buzz
|
|
type: Opaque
|
|
stringData:
|
|
BUZZ_RELAY_PRIVATE_KEY: "REPLACE_WITH_64_HEX"
|
|
BUZZ_GIT_HOOK_HMAC_SECRET: "REPLACE_WITH_RANDOM_64_CHARS"
|
|
DATABASE_URL: "postgres://buzz:REPLACE@postgres.buzz.svc.cluster.local:5432/buzz?sslmode=require"
|
|
REDIS_URL: "redis://:REPLACE@redis.buzz.svc.cluster.local:6379"
|
|
BUZZ_S3_ACCESS_KEY: "REPLACE"
|
|
BUZZ_S3_SECRET_KEY: "REPLACE"
|