# Template. Copy to secret.yaml, fill in the real token, and apply.
# secret.yaml is gitignored — same convention as ../../platform/cert-manager, ../../apps/netbox
# and ../../apps/smtp-relay.
#
# The token IS the tunnel credential: it embeds the account tag, tunnel ID and
# tunnel secret, so anything holding it can serve traffic for the tunnel. It is
# also all cloudflared needs — the ingress rules come from the Cloudflare API,
# managed by ./terraform.
#
# Where to get it:
#   Cloudflare dashboard -> Zero Trust -> Networks -> Tunnels -> <tunnel> ->
#   Configure -> the `cloudflared service install <TOKEN>` command contains it.
# Rotating it there requires re-applying this Secret and restarting the
# Deployment; the tunnel UUID does not change.
---
apiVersion: v1
kind: Secret
metadata:
  name: cloudflared-tunnel
  namespace: cloudflared
type: Opaque
stringData:
  token: REPLACE_WITH_CLOUDFLARE_TUNNEL_TOKEN