# Template. Copy to secret.yaml, fill in the real password, apply, then
# `helm upgrade`. secret.yaml is gitignored — same convention as ../../platform/cert-manager,
# ../netbox, ../smtp-relay and ../../infrastructure/cloudflared.
#
# Consumed by gitea.additionalConfigFromEnvs in gitea-values.yaml as
# GITEA__DATABASE__PASSWD, which Gitea's env-to-ini step renders into
# `[database] PASSWD`.
#
# This is the `gitea` role's password on the shared CloudNativePG cluster
# (shared-postgresql.shared-db.svc.cluster.local). Rotating it means updating
# both this Secret and the role in Postgres, then restarting Gitea — Gitea reads
# app.ini once at startup and does not re-read it.
---
apiVersion: v1
kind: Secret
metadata:
  name: gitea-db
  namespace: gitea
type: Opaque
stringData:
  password: REPLACE_WITH_GITEA_DB_PASSWORD