pikasTech-unidesk/config/secrets-distribution.yaml

version: 1
kind: unidesk-secret-distribution

metadata:
  id: platform-infra-runtime-secrets
  owner: unidesk
  relatedIssues:
    - 297
    - 300
    - 313
    - 2256
    - 1964

sources:
  root: /root/.unidesk/.state/secrets
  files:
    - sourceRef: platform-db/langbot-db.env
      type: env
      requiredKeys:
        - LANGBOT_DB_USER
        - LANGBOT_DB_PASSWORD
        - LANGBOT_DB_NAME
      createIfMissing:
        enabled: false
    - sourceRef: platform-db/n8n-db.env
      type: env
      requiredKeys:
        - N8N_DB_USER
        - N8N_DB_PASSWORD
        - N8N_DB_NAME
      createIfMissing:
        enabled: false
    - sourceRef: platform-infra/langbot.env
      type: env
      requiredKeys:
        - DATABASE_URL
        - LANGBOT_JWT_SECRET
        - LANGBOT_API_KEY
      createIfMissing:
        enabled: true
        randomHex:
          LANGBOT_JWT_SECRET: 32
        randomBase64Url:
          LANGBOT_API_KEY:
            bytes: 32
            prefix: lbk_
    - sourceRef: platform-infra/n8n.env
      type: env
      requiredKeys:
        - DATABASE_URL
        - N8N_ENCRYPTION_KEY
      createIfMissing:
        enabled: true
        randomBase64Url:
          N8N_ENCRYPTION_KEY:
            bytes: 32
            prefix: ""
    - sourceRef: platform-infra/wechat-archive.env
      type: env
      requiredKeys:
        - UNIDESK_WECHAT_ARCHIVE_TOKEN
      createIfMissing:
        enabled: true
        randomBase64Url:
          UNIDESK_WECHAT_ARCHIVE_TOKEN:
            bytes: 32
            prefix: uwa_
    - sourceRef: platform-infra/sub2api.env
      type: env
      requiredKeys:
        - ADMIN_EMAIL
        - ADMIN_PASSWORD
      createIfMissing:
        enabled: false
    - sourceRef: platform-infra/pk01-frp.env
      type: env
      requiredKeys:
        - FRP_TOKEN
      createIfMissing:
        enabled: false
    - sourceRef: platform-infra/sub2rank.env
      type: env
      requiredKeys:
        - SUB2RANK_ADMIN_TOKEN
      createIfMissing:
        enabled: true
        randomBase64Url:
          SUB2RANK_ADMIN_TOKEN:
            bytes: 32
            prefix: srk_
    - sourceRef: platform-infra/pikaoa.env
      type: env
      requiredKeys:
        - DATABASE_URL
        - PIKAOA_SESSION_SECRET
      createIfMissing:
        enabled: true
        randomBase64Url:
          PIKAOA_SESSION_SECRET:
            bytes: 32
            prefix: poa_
    - sourceRef: platform-infra/pikaoa-test.env
      type: env
      requiredKeys:
        - DATABASE_URL
        - PIKAOA_SESSION_SECRET
      createIfMissing:
        enabled: true
        randomBase64Url:
          PIKAOA_SESSION_SECRET:
            bytes: 32
            prefix: poa_
    - sourceRef: hwlab/jd01-v03-opencode.env
      type: env
      requiredKeys:
        - OPENCODE_SERVER_USERNAME
        - OPENCODE_SERVER_PASSWORD
      createIfMissing:
        enabled: true
        values:
          OPENCODE_SERVER_USERNAME: opencode
        randomBase64Url:
          OPENCODE_SERVER_PASSWORD:
            bytes: 32
            prefix: oc_
    - sourceRef: hwlab/nc01-v03-opencode.env
      type: env
      requiredKeys:
        - OPENCODE_SERVER_USERNAME
        - OPENCODE_SERVER_PASSWORD
      createIfMissing:
        enabled: true
        values:
          OPENCODE_SERVER_USERNAME: opencode
        randomBase64Url:
          OPENCODE_SERVER_PASSWORD:
            bytes: 32
            prefix: oc_
    - sourceRef: hwlab/web-probe-monitor-db.env
      type: env
      requiredKeys:
        - DATABASE_URL
      createIfMissing:
        enabled: false
  externalFiles:
    - sourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt
      type: raw-file
      required: true
      createIfMissing:
        enabled: true
        randomBase64Url:
          bytes: 24
          prefix: poa_
    - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
      type: raw-file
      required: true
      createIfMissing:
        enabled: true
        randomBase64Url:
          bytes: 24
          prefix: poa_
    - sourceRef: /root/.unidesk/.env/selfmedia-access.env
      type: env
      requiredKeys:
        - SELFMEDIA_ADMIN_USERNAME
        - SELFMEDIA_ADMIN_PASSWORD
        - SELFMEDIA_API_KEY
        - SELFMEDIA_SESSION_SECRET
      createIfMissing:
        enabled: true
        values:
          SELFMEDIA_ADMIN_USERNAME: admin
        randomBase64Url:
          SELFMEDIA_ADMIN_PASSWORD:
            bytes: 32
            prefix: smp_
          SELFMEDIA_API_KEY:
            bytes: 32
            prefix: smk_
          SELFMEDIA_SESSION_SECRET:
            bytes: 32
            prefix: sms_
    - sourceRef: ~/.env/TOKEN
      type: raw-file
      required: true
      createIfMissing:
        enabled: true
        randomBase64Url:
          bytes: 32
          prefix: smt_
    - sourceRef: ~/.codex/config.toml.pika
      type: raw-file
      required: true
      createIfMissing:
        enabled: false
    - sourceRef: ~/.codex/auth.json.pika
      type: raw-file
      required: true
      createIfMissing:
        enabled: false

targets:
  - id: platform-infra-g14
    route: G14:k3s
    namespace: platform-infra
    scope: platform-infra
    enabled: true
  - id: sub2rank-nc01
    route: NC01:k3s
    namespace: platform-infra
    scope: sub2rank
    enabled: true
  - id: hwlab-jd01-v03
    route: JD01:k3s
    namespace: hwlab-v03
    scope: hwlab
    enabled: true
  - id: hwlab-nc01-v03
    route: NC01:k3s
    namespace: hwlab-v03
    scope: hwlab
    enabled: true
  - id: selfmedia-nc01
    route: NC01:k3s
    namespace: selfmedia
    scope: selfmedia
    enabled: true
    consumerRollout:
      deployments:
        - selfmedia
      timeoutSeconds: 180
      pollIntervalSeconds: 5
  - id: selfmedia-production-nc01
    route: NC01:k3s
    namespace: selfmedia-production
    scope: selfmedia-production
    enabled: true
    consumerRollout:
      deployments:
        - selfmedia-production
      timeoutSeconds: 180
      pollIntervalSeconds: 5
  - id: pikaoa-nc01
    route: NC01:k3s
    namespace: pikaoa
    scope: pikaoa
    enabled: true
  - id: pikaoa-test-nc01
    route: NC01:k3s
    namespace: pikaoa-test
    scope: pikaoa-test
    enabled: true

kubernetesSecrets:
  - name: pikaoa-runtime
    targetId: pikaoa-nc01
    secretName: pikaoa-runtime
    type: Opaque
    data:
      - sourceRef: platform-infra/pikaoa.env
        sourceKey: DATABASE_URL
        targetKey: DATABASE_URL
      - sourceRef: platform-infra/pikaoa.env
        sourceKey: PIKAOA_SESSION_SECRET
        targetKey: PIKAOA_SESSION_SECRET
      - sourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt
        sourceKey: contents
        targetKey: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD
      - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
        sourceKey: contents
        targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD
      - sourceRef: platform-infra/pk01-frp.env
        sourceKey: FRP_TOKEN
        targetKey: FRP_TOKEN
  - name: pikaoa-test-runtime
    targetId: pikaoa-test-nc01
    secretName: pikaoa-test-runtime
    type: Opaque
    data:
      - sourceRef: platform-infra/pikaoa-test.env
        sourceKey: DATABASE_URL
        targetKey: DATABASE_URL
      - sourceRef: platform-infra/pikaoa-test.env
        sourceKey: PIKAOA_SESSION_SECRET
        targetKey: PIKAOA_SESSION_SECRET
      - sourceRef: ~/.unidesk/.env/pikaoa-admin-password.txt
        sourceKey: contents
        targetKey: PIKAOA_BOOTSTRAP_ADMIN_PASSWORD
      - sourceRef: ~/.unidesk/.env/pikaoa-employee-password.txt
        sourceKey: contents
        targetKey: PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD
  - name: selfmedia-access
    targetId: selfmedia-nc01
    secretName: selfmedia-access
    type: Opaque
    data:
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_ADMIN_USERNAME
        targetKey: admin-username
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_ADMIN_PASSWORD
        targetKey: admin-password
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_API_KEY
        targetKey: api-key
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_SESSION_SECRET
        targetKey: session-secret
  - name: selfmedia-runtime
    targetId: selfmedia-nc01
    secretName: selfmedia-runtime
    type: Opaque
    data:
      - sourceRef: ~/.env/TOKEN
        sourceKey: contents
        targetKey: TOKEN
  - name: selfmedia-codex
    targetId: selfmedia-nc01
    secretName: selfmedia-codex
    type: Opaque
    data:
      - sourceRef: ~/.codex/config.toml.pika
        sourceKey: contents
        targetKey: config.toml
      - sourceRef: ~/.codex/auth.json.pika
        sourceKey: contents
        targetKey: auth.json
  - name: selfmedia-production-access
    targetId: selfmedia-production-nc01
    secretName: selfmedia-production-access
    type: Opaque
    data:
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_ADMIN_USERNAME
        targetKey: admin-username
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_ADMIN_PASSWORD
        targetKey: admin-password
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_API_KEY
        targetKey: api-key
      - sourceRef: /root/.unidesk/.env/selfmedia-access.env
        sourceKey: SELFMEDIA_SESSION_SECRET
        targetKey: session-secret
  - name: selfmedia-production-runtime
    targetId: selfmedia-production-nc01
    secretName: selfmedia-production-runtime
    type: Opaque
    data:
      - sourceRef: ~/.env/TOKEN
        sourceKey: contents
        targetKey: TOKEN
  - name: selfmedia-production-codex
    targetId: selfmedia-production-nc01
    secretName: selfmedia-production-codex
    type: Opaque
    data:
      - sourceRef: ~/.codex/config.toml.pika
        sourceKey: contents
        targetKey: config.toml
      - sourceRef: ~/.codex/auth.json.pika
        sourceKey: contents
        targetKey: auth.json
  - name: sub2rank-runtime
    targetId: sub2rank-nc01
    secretName: sub2rank-secrets
    type: Opaque
    data:
      - sourceRef: platform-infra/sub2rank.env
        sourceKey: SUB2RANK_ADMIN_TOKEN
        targetKey: SUB2RANK_ADMIN_TOKEN
      - sourceRef: platform-infra/sub2api.env
        sourceKey: ADMIN_EMAIL
        targetKey: SUB2API_ADMIN_EMAIL
      - sourceRef: platform-infra/sub2api.env
        sourceKey: ADMIN_PASSWORD
        targetKey: SUB2API_ADMIN_PASSWORD
      - sourceRef: platform-infra/pk01-frp.env
        sourceKey: FRP_TOKEN
        targetKey: FRP_TOKEN
  - name: hwlab-web-probe-monitor-db
    targetId: hwlab-nc01-v03
    secretName: hwlab-web-probe-monitor-db
    type: Opaque
    data:
      - sourceRef: hwlab/web-probe-monitor-db.env
        sourceKey: DATABASE_URL
        targetKey: DATABASE_URL
  - name: hwlab-nc01-v03-opencode-server-auth
    targetId: hwlab-nc01-v03
    secretName: hwlab-v03-opencode-server-auth
    type: Opaque
    data:
      - sourceRef: hwlab/nc01-v03-opencode.env
        sourceKey: OPENCODE_SERVER_USERNAME
        targetKey: username
      - sourceRef: hwlab/nc01-v03-opencode.env
        sourceKey: OPENCODE_SERVER_PASSWORD
        targetKey: password
  - name: hwlab-jd01-v03-opencode-server-auth
    targetId: hwlab-jd01-v03
    secretName: hwlab-v03-opencode-server-auth
    type: Opaque
    data:
      - sourceRef: hwlab/jd01-v03-opencode.env
        sourceKey: OPENCODE_SERVER_USERNAME
        targetKey: username
      - sourceRef: hwlab/jd01-v03-opencode.env
        sourceKey: OPENCODE_SERVER_PASSWORD
        targetKey: password
  - name: langbot-runtime
    targetId: platform-infra-g14
    secretName: langbot-secrets
    type: Opaque
    data:
      - sourceRef: platform-db/langbot-db.env
        sourceKey: LANGBOT_DB_PASSWORD
        targetKey: DATABASE_PASSWORD
      - sourceRef: platform-infra/langbot.env
        sourceKey: LANGBOT_JWT_SECRET
        targetKey: SYSTEM_JWT_SECRET
      - sourceRef: platform-infra/langbot.env
        sourceKey: LANGBOT_API_KEY
        targetKey: LANGBOT_API_KEY
      - sourceRef: platform-infra/langbot.env
        sourceKey: DATABASE_URL
        targetKey: DATABASE_URL
  - name: n8n-runtime
    targetId: platform-infra-g14
    secretName: n8n-secrets
    type: Opaque
    data:
      - sourceRef: platform-db/n8n-db.env
        sourceKey: N8N_DB_PASSWORD
        targetKey: DB_POSTGRESDB_PASSWORD
      - sourceRef: platform-infra/n8n.env
        sourceKey: N8N_ENCRYPTION_KEY
        targetKey: N8N_ENCRYPTION_KEY
      - sourceRef: platform-infra/n8n.env
        sourceKey: DATABASE_URL
        targetKey: DATABASE_URL