From a180d3320ceb754fee25a7cc7049b8dd072aab73 Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Mon, 29 Jun 2026 16:32:14 +0000
Subject: [PATCH] feat: add hwlab opencode auth secret source

---
 config/secrets-distribution.yaml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/config/secrets-distribution.yaml b/config/secrets-distribution.yaml
index bdd4527f..a22ad805 100644
--- a/config/secrets-distribution.yaml
+++ b/config/secrets-distribution.yaml
@@ -8,6 +8,7 @@ metadata:
     - 297
     - 300
     - 313
+    - 2256
 
 sources:
   root: /root/unidesk/.state/secrets
@@ -63,6 +64,19 @@ sources:
           UNIDESK_WECHAT_ARCHIVE_TOKEN:
             bytes: 32
             prefix: uwa_
+    - sourceRef: hwlab/jd01-v03-opencode.env
+      type: env
+      requiredKeys:
+        - OPENCODE_SERVER_USERNAME
+        - OPENCODE_SERVER_PASSWORD
+      createIfMissing:
+        enabled: true
+        values:
+          OPENCODE_SERVER_USERNAME: opencode
+        randomBase64Url:
+          OPENCODE_SERVER_PASSWORD:
+            bytes: 32
+            prefix: oc_
 
 targets:
   - id: platform-infra-g14
@@ -70,8 +84,24 @@ targets:
     namespace: platform-infra
     scope: platform-infra
     enabled: true
+  - id: hwlab-jd01-v03
+    route: JD01:k3s
+    namespace: hwlab-v03
+    scope: hwlab
+    enabled: true
 
 kubernetesSecrets:
+  - name: hwlab-jd01-v03-opencode-server-auth
+    targetId: hwlab-jd01-v03
+    secretName: hwlab-v03-opencode-server-auth
+    type: Opaque
+    data:
+      - sourceRef: hwlab/jd01-v03-opencode.env
+        sourceKey: OPENCODE_SERVER_USERNAME
+        targetKey: username
+      - sourceRef: hwlab/jd01-v03-opencode.env
+        sourceKey: OPENCODE_SERVER_PASSWORD
+        targetKey: password
   - name: langbot-runtime
     targetId: platform-infra-g14
     secretName: langbot-secrets