doran/deploy/k8s/secrets/README.md

Required Kubernetes secrets

Base manifests and the Hetzner single-node overlay both expect secrets to be supplied out-of-band. The Hetzner overlay generates unrip/unrip-secrets, forgejo/forgejo-secrets, observability/observability-secrets, and registry/registry-secrets from local files.

Required secrets

• unrip/unrip-secrets
  • NEAR_INTENTS_API_KEY
• forgejo/forgejo-secrets
  • root_url
  • domain
• registry/registry-secrets
  • htpasswd
• observability/observability-secrets
  • grafana_admin_user
  • grafana_admin_password
  • grafana_root_url

Overlay-driven generation

The deploy/k8s/overlays/hetzner-single-node overlay can generate these from local files via secretGenerator.

Example workflow:

cp deploy/k8s/overlays/hetzner-single-node/secrets/unrip.env.example deploy/k8s/overlays/hetzner-single-node/secrets/unrip.env
cp deploy/k8s/overlays/hetzner-single-node/secrets/forgejo.env.example deploy/k8s/overlays/hetzner-single-node/secrets/forgejo.env
cp deploy/k8s/overlays/hetzner-single-node/secrets/observability.env.example deploy/k8s/overlays/hetzner-single-node/secrets/observability.env
cp deploy/k8s/overlays/hetzner-single-node/secrets/registry.htpasswd.example deploy/k8s/overlays/hetzner-single-node/secrets/registry.htpasswd
kubectl apply -k deploy/k8s/overlays/hetzner-single-node

The Forgejo runner no longer expects a pre-seeded runner_registration_token secret; scripts/hetzner/bootstrap.sh generates a one-time token in-cluster, registers the runner, stores the resulting /data/.runner config on the forgejo-runner-data PVC, and then restarts the deployment.

For future projects, follow the same convention with project-specific secret names in project-specific namespaces.

Do not commit populated secret files.