# Template for cert-manager/secret.yaml (gitignored). Copy, fill in, apply.
#
# Same token as cloudflared/terraform/terraform.tfvars — extract it with:
#   sed -nE 's/^[[:space:]]*cloudflare_api_token[[:space:]]*=[[:space:]]*"([^"]*)".*/\1/p' \
#     cloudflared/terraform/terraform.tfvars
# (a naive `cut -d= -f2` also swallows the trailing comment on that line)
#
# Must live in the cert-manager namespace: a ClusterIssuer resolves solver Secret
# refs in the namespace where cert-manager runs, not where the Certificate is.
#
# ⚠ This token also carries Account·Cloudflare Tunnel:Edit. Replacing it with one
# scoped to Zone·DNS:Edit on ddupan.top would shrink the blast radius to DNS.
apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-token
  namespace: cert-manager
type: Opaque
stringData:
  api-token: "REPLACE_WITH_CLOUDFLARE_API_TOKEN"