# Template for netbox/secret.yaml (which is gitignored). Copy, fill in, apply.
#
# Only the database password lives here. NetBox holds no OIDC client secret: it
# authenticates via Authelia forward-auth at the gateway (securitypolicy.yaml), so
# there is no client credential for this app to keep.
apiVersion: v1
kind: Secret
metadata:
  name: netbox-secrets
  namespace: netbox
type: Opaque
stringData:
  # Password for the dedicated `netbox` role on the shared CNPG cluster.
  # Must match what was granted in shared-db (see README "Prerequisites").
  # Consumed via externalDatabase.existingSecretName/Key in values.yaml.
  postgresql-password: "REPLACE_WITH_DB_PASSWORD"