# TEMPLATE ONLY — not part of kustomization.yaml. Copy it to k8s/secrets/secrets.yaml
# (gitignored), fill in real values there, and apply that file yourself. Never put real values
# in here. This folder is outside `kubectl apply -f k8s/`, which does not recurse.
#
#   openssl rand -hex 32     for every token and password below
apiVersion: v1
kind: Secret
metadata:
  name: influxdb-auth
  namespace: mg4
type: Opaque
stringData:
  admin-password: CHANGE-ME-at-least-8-characters
  admin-token: CHANGE-ME-openssl-rand-hex-32
---
apiVersion: v1
kind: Secret
metadata:
  name: mg4-server
  namespace: mg4
type: Opaque
stringData:
  # The car's write token, entered in the app. At least 24 characters, or the server
  # refuses to start.
  INGEST_TOKEN: CHANGE-ME-openssl-rand-hex-32
  # Approves a car on your phone when it pairs by QR code (at least 12 characters). Leave it
  # empty to switch pairing off; then only the INGEST_TOKEN above works.
  APPROVAL_PASSWORD: CHANGE-ME-at-least-12-characters
  # Your ABRP credentials. Leave either empty to switch forwarding off. Keep them set even
  # when the app sends to ABRP itself: the server then forwards only what the car could not.
  ABRP_API_KEY: CHANGE-ME
  ABRP_USER_TOKEN: CHANGE-ME
  ABRP_MIN_INTERVAL_SECONDS: "5"
---
apiVersion: v1
kind: Secret
metadata:
  name: grafana-admin
  namespace: mg4
type: Opaque
stringData:
  # Grafana's admin login (user "admin"). Only read on first start: change it in Grafana
  # afterwards, or reset it with grafana cli.
  admin-password: CHANGE-ME
---
apiVersion: v1
kind: Secret
metadata:
  name: grafana-influx
  namespace: mg4
type: Opaque
stringData:
  # A read-only InfluxDB token for the mg4 bucket, not the admin token. InfluxDB makes it;
  # the command is in k8s/README.md ("Grafana's InfluxDB token").
  token: CHANGE-ME-read-only-token-from-influx-auth-create