# Template only — DO NOT `kubectl apply` this file and DO NOT commit real values.
#
# Copy to secret.yaml (gitignored), fill in, apply, then delete your local copy:
#   cp secret.example.yaml /tmp/ca-secret.yaml
#   $EDITOR /tmp/ca-secret.yaml
#   kubectl apply -f /tmp/ca-secret.yaml && shred -u /tmp/ca-secret.yaml
#
# Generate each password with:  openssl rand -base64 24
---
apiVersion: v1
kind: Secret
metadata:
  name: ejbca-db
  namespace: vnc-ca
type: Opaque
stringData:
  # MariaDB credentials. The EJBCA database holds the CA private keys (soft
  # crypto token, encrypted at rest by EJBCA) — treat a dump of it as
  # equivalent to the intermediate CA key itself.
  MARIADB_ROOT_PASSWORD: CHANGEME_root
  MARIADB_USER: ejbca
  MARIADB_PASSWORD: CHANGEME_ejbca
  MARIADB_DATABASE: ejbca
---
apiVersion: v1
kind: Secret
metadata:
  name: ejbca-app
  namespace: vnc-ca
type: Opaque
stringData:
  # Passphrase protecting EJBCA's internal soft crypto token (the one that
  # wraps the intermediate CA key). Losing this loses the intermediate.
  # Back it up somewhere that is NOT this cluster.
  EJBCA_CRYPTO_TOKEN_PIN: CHANGEME_token