86 lines
4.0 KiB
YAML
86 lines
4.0 KiB
YAML
# AWOOOI 正式環境 Secrets 模板
|
||
# ================================
|
||
# 負責人: CIO / CISO
|
||
# 版本: v1.1
|
||
# 日期: 2026-03-22
|
||
#
|
||
# ⚠️ 使用說明:
|
||
# 1. 複製此檔案為 03-secrets.yaml
|
||
# 2. 將所有 CHANGE_ME 替換為實際值
|
||
# 3. 03-secrets.yaml 已加入 .gitignore，禁止提交
|
||
# 4. 生產環境透過 CI/CD Secrets 注入
|
||
|
||
apiVersion: v1
|
||
kind: Secret
|
||
metadata:
|
||
name: awoooi-secrets
|
||
namespace: awoooi-prod
|
||
type: Opaque
|
||
stringData:
|
||
# ============================================================================
|
||
# 資料庫 (192.168.0.188 PostgreSQL)
|
||
# ============================================================================
|
||
DATABASE_URL: "postgresql+asyncpg://awoooi:CHANGE_ME@192.168.0.188:5432/awoooi_prod"
|
||
|
||
# ============================================================================
|
||
# Redis (192.168.0.188:6380, DB 0 - 與 OpenClaw 共用)
|
||
# ============================================================================
|
||
REDIS_URL: "redis://192.168.0.188:6380/0"
|
||
|
||
# ============================================================================
|
||
# AI 服務 API Keys
|
||
# 固定路由: GCP-A → GCP-B → host111 Ollama → Anthropic Claude → Gemini
|
||
# Secret 僅由受控 runtime 注入；不得把真值提交到 Git。
|
||
# ============================================================================
|
||
GEMINI_API_KEY: "CHANGE_ME"
|
||
CLAUDE_API_KEY: "CHANGE_ME"
|
||
|
||
# ============================================================================
|
||
# Phase 5.5: Telegram Gateway (OpenClaw 通知)
|
||
# ============================================================================
|
||
OPENCLAW_TG_BOT_TOKEN: "CHANGE_ME"
|
||
OPENCLAW_TG_CHAT_ID: "CHANGE_ME"
|
||
OPENCLAW_TG_USER_WHITELIST: "CHANGE_ME" # 逗號分隔的 User ID
|
||
SRE_GROUP_CHAT_ID: "CHANGE_ME" # ADR-073 P2-4 (2026-04-12 ogt): SRE 群組 Chat ID，HeartbeatReport 發送目標
|
||
|
||
# ============================================================================
|
||
# Webhook 安全 (CISO 要求: HMAC-SHA256 簽章)
|
||
# ============================================================================
|
||
WEBHOOK_HMAC_SECRET: "CHANGE_ME_TO_RANDOM_64_CHARS"
|
||
|
||
# ============================================================================
|
||
# AwoooP Operator Console mutation API
|
||
# ============================================================================
|
||
AWOOOP_OPERATOR_API_KEY: "CHANGE_ME_TO_RANDOM_64_CHARS"
|
||
|
||
# ============================================================================
|
||
# JWT 認證 (未來擴展)
|
||
# ============================================================================
|
||
JWT_SECRET: "CHANGE_ME_TO_RANDOM_STRING"
|
||
JWT_ALGORITHM: "HS256"
|
||
|
||
# ============================================================================
|
||
# Phase 15.1: Langfuse LLMOps (192.168.0.110:3100)
|
||
# ============================================================================
|
||
LANGFUSE_PUBLIC_KEY: "CHANGE_ME"
|
||
LANGFUSE_SECRET_KEY: "CHANGE_ME"
|
||
|
||
# ============================================================================
|
||
# Phase 10: Sentry Self-Hosted (sentry.wooo.work)
|
||
# 2026-03-27: 首席架構師審查 - 補齊遺漏配置
|
||
# 2026-03-29: Wave A.1 新增 SENTRY_AUTH_TOKEN (ADR-037)
|
||
# 2026-04-11: ADR-069 Sprint A — 更新為 HTTPS 公網域名 (sentry.wooo.work)
|
||
# 取得步驟：
|
||
# 1. SSH wooo@192.168.0.110
|
||
# 2. docker exec sentry-self-hosted-web-1 sentry django shell -c "
|
||
# from sentry.models import Project, ProjectKey
|
||
# p = Project.objects.get(name='awoooi-api')
|
||
# print(ProjectKey.objects.filter(project=p).first().get_dsn())"
|
||
# ============================================================================
|
||
# API DSN (Project ID: 3) — 格式：https://<key>@sentry.wooo.work/3
|
||
SENTRY_DSN: "https://8c4a210fd52909bbbdab642a166ff66e@sentry.wooo.work/3"
|
||
# Auth Token for API Comment/Issues 操作 (Settings → Developer Settings → Internal Integrations)
|
||
SENTRY_AUTH_TOKEN: "CHANGE_ME"
|
||
# Web DSN (Project ID: 2) - 需在 Web ConfigMap 配置
|
||
# NEXT_PUBLIC_SENTRY_DSN: "https://da02d4e5d6542e4d1ed6b2dd6542efeb@sentry.wooo.work/2"
|