# Secrets

`nereus-db` holds two keys, used by `postgres.yaml` and `rollout.yaml`:

- `POSTGRES_PASSWORD`
- `DATABASE_URL` — `postgres://nereus:<password>@nereus-postgres:5432/nereus?sslmode=disable`

It is not in `base/kustomization.yaml`. Plaintext never lands in the repo, and
gitleaks runs on every push.

## dev (k3d)

Create it directly, before `kubectl apply -k deploy/overlays/dev`:

```fish
set pw (openssl rand -hex 16)
kubectl create secret generic nereus-db -n nereus \
  --from-literal=POSTGRES_PASSWORD=$pw \
  --from-literal=DATABASE_URL="postgres://nereus:$pw@nereus-postgres:5432/nereus?sslmode=disable"
```

Rotating means deleting the secret, the StatefulSet's PVC, and restarting —
Postgres only reads `POSTGRES_PASSWORD` when it initialises the data directory.

## prod (sealed)

Write the plaintext to `nereus-db.plain.yaml` (gitignored), then:

```fish
kubeseal --format yaml < nereus-db.plain.yaml > nereus-db-sealed.yaml
```

Commit only `nereus-db-sealed.yaml` and add it to the prod overlay. The
controller isn't installed yet — `kubectl get crd | grep sealed` comes back
empty.