f037812f15
Phase 8 CI/CD 藍圖: - GitHub Actions deploy-prod.yml (沿用 AIOPS 成熟模式) - Signal Worker K8s Deployment - Telegram Notify 閉環 - Bootstrap 自動化腳本 架構鐵律: - Build: 110 金庫 (Harbor + Self-Hosted Runner) - Deploy: 120 K3s Master - 嚴禁 Docker Compose，K8s 唯一合法部署 Co-Authored-By: Claude <noreply@anthropic.com>
53 lines
2.1 KiB
YAML
53 lines
2.1 KiB
YAML
# AWOOOI 正式環境 Secrets 模板
|
||
# ================================
|
||
# 負責人: CIO / CISO
|
||
# 版本: v1.1
|
||
# 日期: 2026-03-22
|
||
#
|
||
# ⚠️ 使用說明:
|
||
# 1. 複製此檔案為 03-secrets.yaml
|
||
# 2. 將所有 CHANGE_ME 替換為實際值
|
||
# 3. 03-secrets.yaml 已加入 .gitignore，禁止提交
|
||
# 4. 生產環境透過 CI/CD Secrets 注入
|
||
|
||
apiVersion: v1
|
||
kind: Secret
|
||
metadata:
|
||
name: awoooi-secrets
|
||
namespace: awoooi-prod
|
||
type: Opaque
|
||
stringData:
|
||
# ============================================================================
|
||
# 資料庫 (192.168.0.188 PostgreSQL)
|
||
# ============================================================================
|
||
DATABASE_URL: "postgresql+asyncpg://awoooi:CHANGE_ME@192.168.0.188:5432/awoooi_prod"
|
||
|
||
# ============================================================================
|
||
# Redis (192.168.0.188:6380, DB 10-15 for AWOOOI)
|
||
# ============================================================================
|
||
REDIS_URL: "redis://192.168.0.188:6380/10"
|
||
|
||
# ============================================================================
|
||
# AI 服務 API Keys (ADR-006 備援順序: Ollama → Gemini → Claude)
|
||
# ============================================================================
|
||
GEMINI_API_KEY: "CHANGE_ME"
|
||
CLAUDE_API_KEY: "CHANGE_ME"
|
||
|
||
# ============================================================================
|
||
# Phase 5.5: Telegram Gateway (OpenClaw 通知)
|
||
# ============================================================================
|
||
OPENCLAW_TG_BOT_TOKEN: "CHANGE_ME"
|
||
OPENCLAW_TG_CHAT_ID: "CHANGE_ME"
|
||
OPENCLAW_TG_USER_WHITELIST: "CHANGE_ME" # 逗號分隔的 User ID
|
||
|
||
# ============================================================================
|
||
# Webhook 安全 (CISO 要求: HMAC-SHA256 簽章)
|
||
# ============================================================================
|
||
WEBHOOK_HMAC_SECRET: "CHANGE_ME_TO_RANDOM_64_CHARS"
|
||
|
||
# ============================================================================
|
||
# JWT 認證 (未來擴展)
|
||
# ============================================================================
|
||
JWT_SECRET: "CHANGE_ME_TO_RANDOM_STRING"
|
||
JWT_ALGORITHM: "HS256"
|