# Secret for Anubis ED25519 signing key.
# Create with:
#   kubectl create secret generic anubis-key \
#     --namespace gitea \
#     --from-literal=ED25519_PRIVATE_KEY_HEX=$(openssl rand -hex 32)
# This file is a placeholder so kustomization knows the secret must exist.
# The secret is NOT managed here to avoid storing the key in git.
#
# If using external-secrets or agenix, replace this comment block with
# the appropriate ExternalSecret / SealedSecret manifest.
apiVersion: v1
kind: Secret
metadata:
  name: anubis-key
  namespace: gitea
  annotations:
    # Managed manually — do not overwrite with kustomize apply
    kustomize.toolkit.fluxcd.io/prune: disabled
type: Opaque
# data is intentionally empty; populate via:
#   kubectl create secret generic anubis-key --namespace gitea \
#     --from-literal=ED25519_PRIVATE_KEY_HEX=$(openssl rand -hex 32) \
#     --dry-run=client -o yaml | kubectl apply -f -