# Copy to secret.yaml, fill in real values, and apply with:
#   kubectl apply -f secret.yaml
# Never commit the filled-in secret.yaml to git.
#
# DB_POSTGRESDB_USER/PASSWORD must match k8s/postgres/secret.yaml.
#
# N8N_ENCRYPTION_KEY encrypts credentials stored in the n8n database.
# Generate once with `openssl rand -hex 24` and never change it afterwards
# (rotating it locks n8n out of every credential already saved).
apiVersion: v1
kind: Secret
metadata:
  name: n8n-credentials
  namespace: watch
type: Opaque
stringData:
  DB_POSTGRESDB_USER: postgres
  DB_POSTGRESDB_PASSWORD: changeme
  N8N_ENCRYPTION_KEY: changeme