# Trading Secrets - Encrypt with SOPS before applying
# Usage: sops -e -i trading-secrets.yaml && kubectl apply -f trading-secrets.yaml
#
# DO NOT commit unencrypted secrets to git!
# Generate secrets with: python -c "import secrets; print(secrets.token_urlsafe(24))"
apiVersion: v1
kind: Secret
metadata:
  name: trading-secrets
  namespace: customer1
  labels:
    app.kubernetes.io/managed-by: security-audit
  annotations:
    secrets.yaml.sops.io/v2: encrypted
type: Opaque
stringData:
  # JWT authentication - use 32+ byte hex token
  EXECUTE_JWT_SECRET_KEY: ""

  # Exchange private keys - NEVER commit plaintext!
  EXECUTE_HYPERLIQUID_PRIVATE_KEY: ""
  EXECUTE_SOLANA_PRIVATE_KEY_BASE58: ""

  # Database credentials - use 24+ byte URL-safe tokens
  POSTGRES_PASSWORD: ""
  NEWS_DB_PASSWORD: ""

  # Redis password
  REDIS_PASSWORD: ""

  # Kafka SASL authentication
  KAFKA_SASL_USERNAME: ""
  KAFKA_SASL_PASSWORD: ""