geo/deploy/k3s/secrets.yaml

apiVersion: v1
kind: Secret
metadata:
  name: geo-rankly-app-secret
type: Opaque
stringData:
  POSTGRES_PASSWORD: geo_dev
  RABBITMQ_DEFAULT_PASS: geo_dev
  MINIO_ROOT_USER: minioadmin
  MINIO_ROOT_PASSWORD: minioadmin
  JWT_SECRET: geo-web-change-me-in-production
  OPS_JWT_SECRET: geo-ops-change-me-in-production
  OPS_DEFAULT_ADMIN_PASSWORD: Aa123456
  SCHEDULER_INTERNAL_METRICS_TOKEN: geo-metrics-token
  BROWSER_FETCH_TOKEN: geo-browser-fetch-change-me
  config.local.yaml: |
    database:
      password: ${POSTGRES_PASSWORD:geo_dev}

    monitoring_database:
      password: ${POSTGRES_PASSWORD:geo_dev}

    rabbitmq:
      url: amqp://geo:geo_dev@rabbitmq:5672/geo

    object_storage:
      access_key: minioadmin
      secret_key: minioadmin

    jwt:
      secret: "change-me-in-production"

    scheduler:
      internal_metrics_token: "geo-metrics-token"

    browser_fetch:
      token: ${BROWSER_FETCH_TOKEN:geo-browser-fetch-change-me}

    auth:
      password_cipher:
        enabled: true
        key_id: login-password-rsa-oaep-v1
        # 多 Pod 必须使用同一把私钥；上线前用 `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048`
        # 生成后粘贴完整 PEM。不要把生产私钥提交到代码仓库。
        private_key_pem: |
          -----BEGIN PRIVATE KEY-----
          REPLACE_WITH_TENANT_LOGIN_PASSWORD_RSA_PRIVATE_KEY
          -----END PRIVATE KEY-----

  ops-config.local.yaml: |
    auth:
      password_cipher:
        enabled: true
        key_id: ops-password-rsa-oaep-v1
        # 建议与租户端使用不同私钥；所有 ops-api Pod 必须挂载同一份 Secret。
        private_key_pem: |
          -----BEGIN PRIVATE KEY-----
          REPLACE_WITH_OPS_LOGIN_PASSWORD_RSA_PRIVATE_KEY
          -----END PRIVATE KEY-----