# ArgoCD repo credential for the PRIVATE GitHub seed — deploy key (read-only).
# Apply at Phase 0 BEFORE root-app-github.yaml. This is a TEMPLATE: never commit
# the real private key.
#
#   ssh-keygen -t ed25519 -C "argocd@homelab" -f argocd_seed -N ""
#   # add argocd_seed.pub → GitHub repo → Settings → Deploy keys (Read-only, no write)
#   kubectl create ns argocd --dry-run=client -o yaml | kubectl apply -f -
#   kubectl -n argocd create secret generic seed-github-repo \
#     --from-literal=type=git \
#     --from-literal=url=git@github.com:Riotpiaole/riotpiao.homelab.com.git \
#     --from-file=sshPrivateKey=argocd_seed
#   kubectl -n argocd label secret seed-github-repo argocd.argoproj.io/secret-type=repository
#
# url MUST match root-app-github.yaml's repoURL (SSH form).
apiVersion: v1
kind: Secret
metadata:
  name: seed-github-repo
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: repository
stringData:
  type: git
  url: git@github.com:Riotpiaole/riotpiao.homelab.com.git
  sshPrivateKey: |
    -----BEGIN OPENSSH PRIVATE KEY-----
    REPLACE-WITH-READ-ONLY-DEPLOY-KEY-PRIVATE-HALF — DO NOT COMMIT THE REAL KEY
    -----END OPENSSH PRIVATE KEY-----