# Copy to secret.yaml (gitignored) and fill in — or let the Terraform in ./terraform/
# emit these values (it creates the Entra app registration + client secret).
#
#   CLIENT_ID     = Application (client) ID of the Entra app registration
#   CLIENT_SECRET = a client secret VALUE for that app (used by sasl-xoauth2 to refresh)
#   TENANT_ID     = your Entra tenant (directory) ID
#
# NOTE: these three are NOT the whole story — the relay also needs a device-code
# refresh token minted once into the PVC (see README "Bootstrap the token").
apiVersion: v1
kind: Secret
metadata:
  name: smtp-relay-secret
  namespace: smtp-relay
type: Opaque
stringData:
  CLIENT_ID: 'CHANGE-ME'
  CLIENT_SECRET: 'CHANGE-ME'
  TENANT_ID: 'CHANGE-ME'