Stop versioning the real secret.yaml

k8s/secret.yaml held the actual PostgreSQL password, Keycloak admin
password and OIDC client secrets, and .gitignore only covered .DS_Store
and *.tmp. Untrack it and ignore it, matching what infra-librechat already
does, and extend the ignore list to TLS key material.

kustomization.yaml still references the file, so the README now documents
creating it from secret.example.yaml — whose key set is identical — before
the first apply.

This only stops future leaks. The values remain in commit 6d3431c and on
the remote, so they must still be treated as compromised and rotated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -1,2 +1,12 @@
 .DS_Store
 *.tmp
+
+# Real secrets: only secret.example.yaml is versioned.
+# k8s/kustomization.yaml still references secret.yaml, so a fresh clone must
+# create it first — see README.
+k8s/secret.yaml
+
+# TLS material
+*.crt
+*.key
+*.pem

k8s/README.md

@@ -42,6 +42,18 @@ k8s/
 
 ## Déploiement
 
+`k8s/secret.yaml` n'est pas versionné : il porte les mots de passe réels (base
+PostgreSQL, admin Keycloak, secrets clients OIDC). Le créer une fois depuis le
+gabarit, puis renseigner chaque `<CHANGE_ME>` :
+
+```bash
+cp k8s/secret.example.yaml k8s/secret.yaml
+$EDITOR k8s/secret.yaml
+```
+
+`k8s/kustomization.yaml` le référence, donc le déploiement échoue tant qu'il
+est absent.
+
 ```bash
 kubectl apply -k k8s/
 ```

k8s/keycloak/deployment.yaml

@@ -19,6 +19,13 @@ spec:
         app.kubernetes.io/name: keycloak
         app.kubernetes.io/component: idp
         app.kubernetes.io/part-of: keycloak
+      annotations:
+        # Discovered by the Prometheus in the observability namespace.
+        # Endpoint exposed by KC_METRICS_ENABLED=true, on the management
+        # port (9000), never on the application port.
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "9000"
+        prometheus.io/path: "/metrics"
     spec:
       initContainers:
         - name: download-otel-agent
@@ -102,7 +109,7 @@ spec:
             - name: OTEL_SERVICE_NAME
               value: "keycloak"
             - name: OTEL_EXPORTER_OTLP_ENDPOINT
-              value: "http://jaeger.observability.svc.cluster.local:4318"
+              value: "http://tempo.observability.svc.cluster.local:4318"
             - name: OTEL_EXPORTER_OTLP_PROTOCOL
               value: "http/protobuf"
             - name: OTEL_TRACES_EXPORTER

k8s/secret.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: keycloak-secrets
-  namespace: keycloak
-type: Opaque
-stringData:
-  POSTGRES_USER: keycloak
-  POSTGRES_PASSWORD: keycloak-db-pass-2026
-  POSTGRES_DB: keycloak
-  KC_DB_USERNAME: keycloak
-  KC_DB_PASSWORD: keycloak-db-pass-2026
-  KC_BOOTSTRAP_ADMIN_USERNAME: admin
-  KC_BOOTSTRAP_ADMIN_PASSWORD: mermAid-giganTic-s3ea
-  KEYCLOAK_ADMIN: admin
-  KEYCLOAK_ADMIN_PASSWORD: mermAid-giganTic-s3ea
-  LIBRECHAT_OIDC_SECRET: librechat-oidc-secret-2026
-  CLIENT_SECRET: classic-models-client-secret-2026
-  USER_PASSWORD: Password123@