# Example: seal platform secrets for namespace cloudhost.
# Full guide (any environment): RUNBOOK-DEPLOY.fa.md — Phase 3
# Real SealedSecret lives in cloud-host-gitops/sealed-secrets/ — never commit plaintext passwords.
#
# Required keys (must match backend Deployment + validate-production-config):
#   postgres-password, jwt-secret, jwt-refresh-secret, cluster-kubeconfig-key,
#   redis-password, elastic-password (must match elasticsearch-credentials in logging),
#   mizbansms-username, mizbansms-password (OTP SMS — required when backend.sms.enabled)
#
# Generate (replace CHANGE_ME_* with strong random values):
#
#   kubectl -n cloudhost create secret generic abrban-platform-secrets \
#     --from-literal=postgres-password='CHANGE_ME_PG' \
#     --from-literal=jwt-secret='CHANGE_ME_JWT_32CHARS_MIN' \
#     --from-literal=jwt-refresh-secret='CHANGE_ME_REFRESH_32CHARS_MIN' \
#     --from-literal=cluster-kubeconfig-key='0123456789abcdef0123456789abcdef' \
#     --from-literal=redis-password='CHANGE_ME_REDIS' \
#     --from-literal=elastic-password='CHANGE_ME_ELASTIC' \
#     --from-literal=mizbansms-username='CHANGE_ME_SMS_USER' \
#     --from-literal=mizbansms-password='CHANGE_ME_SMS_PASS' \
#     --dry-run=client -o json \
#   | kubeseal \
#       --controller-name=sealed-secrets-controller \
#       --controller-namespace=kube-system \
#       --format yaml \
#   > ../cloud-host-gitops/sealed-secrets/abrban-platform-secrets.yaml
#
# Then in platform/values-abrban.yaml:
#   secrets:
#     existingSecret: abrban-platform-secrets
#
# Apply:
#   kubectl apply -f ../cloud-host-gitops/sealed-secrets/abrban-platform-secrets.yaml
#
# Rotate redis-password: update SealedSecret, sync Argo, restart backend + redis pods.