From da467ceb2431a521ebc7411b2066ae72af2e631c Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Sat, 20 Jun 2026 23:21:50 -0700
Subject: [PATCH] Add media secrets reference (no secrets)

---
 secrets/media.secrets.example | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 secrets/media.secrets.example

diff --git a/secrets/media.secrets.example b/secrets/media.secrets.example
new file mode 100644
index 0000000..f417cb5
--- /dev/null
+++ b/secrets/media.secrets.example
@@ -0,0 +1,26 @@
+# media Stack — Secrets Reference
+# Source: media.env
+#
+# ✅ NO SECRETS — This stack contains no sensitive values.
+# All values are configuration settings safe to store in the compose file directly.
+#
+# This makes media an ideal first stack to test the pipeline with,
+# as there is nothing to provision in the provision-secrets step.
+
+# ── NON-SECRETS (all values safe in compose file or .env) ─────────────────────
+
+# PLEX_PUID          Process UID (0)
+# PLEX_PGID          Process GID (0)
+# ADVERTISE_IP       Plex advertised URL
+# LAN_NETWORK        Trusted LAN CIDR ranges for TicketBox
+# PLEX_HOST          Traefik hostname
+# RADARR_HOST        Traefik hostname
+# SONARR_HOST        Traefik hostname
+# TICKETBOX_HOST     Traefik hostname
+# JACKETT_HOST       Traefik hostname
+
+# ── Woodpecker provision-secrets case entry ───────────────────────────────────
+#
+#   media)
+#     echo "  No secrets required for media stack"
+#     ;;