# EXAMPLE ONLY — do not apply this as-is and do not commit a real key.
#
# The server reads TIDAL_API_KEY and requires `Authorization: Bearer <key>` on
# every data route when it is set. If the key is empty/unset the server runs
# UNAUTHENTICATED and logs a loud startup WARN — never do that on a real network.
#
# This file is intentionally LEFT OUT of kustomization.yaml. Create the real
# secret out-of-band so the key never lands in git:
#
#   kubectl -n tidaldb create secret generic tidaldb-api-key \
#     --from-literal=api-key="$(openssl rand -hex 32)"
#
# or manage it with your secret store (External Secrets Operator, Sealed
# Secrets, Vault Agent, etc.). The StatefulSet mounts key `api-key` from the
# secret named `tidaldb-api-key`.
apiVersion: v1
kind: Secret
metadata:
  name: tidaldb-api-key
  namespace: tidaldb
  labels:
    app.kubernetes.io/name: tidaldb
type: Opaque
stringData:
  api-key: "CHANGE-ME-use-a-32-byte-random-hex-string"