# Secrets Templates

Provide secrets via environment variables or plain-text files in `stacks/secrets/` before running `stacks/scripts/bootstrap.sh`.

Supported inputs:
- Environment variables (preferred for CI/sealed envs)
- Files: `stacks/secrets/<secret_name>.txt`
- If absent, bootstrap will generate random values for most; placeholders for structured values.

Secrets used by stacks:
- `pg_root_password`: Postgres superuser password
- `mariadb_root_password`: MariaDB root password
- `gitea_db_password`: Gitea DB user password
- `nextcloud_db_password`: Nextcloud DB user password
- `smtp_user`, `smtp_pass`: Vaultwarden SMTP creds
- `appflowy_db_url`: e.g., `postgres://user:pass@postgresql_primary:5432/appflowy`
- `minio_access_key`, `minio_secret_key`: MinIO root creds

Example files:
```
stacks/secrets/pg_root_password.txt
stacks/secrets/mariadb_root_password.txt
stacks/secrets/gitea_db_password.txt
stacks/secrets/nextcloud_db_password.txt
stacks/secrets/smtp_user.txt
stacks/secrets/smtp_pass.txt
stacks/secrets/appflowy_db_url.txt
stacks/secrets/minio_access_key.txt
stacks/secrets/minio_secret_key.txt
```
