# NOTE: This app's Secret is now managed via SealedSecrets (notesnook-sealedsecret.yaml),
# which IS committed (encrypted). You should not need to hand-apply a plain Secret.
#
# This file remains only as documentation of the required keys.
#
# To change a secret value:
#   1. Build a plain Secret locally (NEVER commit it):
#        kubectl -n notesnook create secret generic notesnook-secret \
#          --from-literal=KEY=value ... --dry-run=client -o yaml > /tmp/s.yaml
#   2. Seal it:
#        kubeseal --format yaml --scope strict < /tmp/s.yaml \
#          > apps/notesnook/notesnook-sealedsecret.yaml
#   3. Commit the SealedSecret; ArgoCD applies it, controller unseals it.
#
# DISASTER RECOVERY: the controller's private key is backed up GPG-encrypted at
#   /mnt/bulk/backups/sealed-secrets/master-key-YYYYMMDD.gpg  (passphrase in password manager)
# Restore it BEFORE applying SealedSecrets to a rebuilt cluster:
#   gpg -d master-key-YYYYMMDD.gpg | kubectl apply -f -
#   kubectl -n kube-system rollout restart deploy/sealed-secrets-controller
#
# Required keys:
#   NOTESNOOK_API_SECRET   (reuse existing — do NOT regenerate)
#   SMTP_USERNAME, SMTP_PASSWORD, SMTP_HOST, SMTP_PORT
#   MINIO_ROOT_USER, MINIO_ROOT_PASSWORD
#   S3_ACCESS_KEY_ID (= MINIO_ROOT_USER), S3_ACCESS_KEY (= MINIO_ROOT_PASSWORD)