# ─────────────────────────────────────────────────────────────────────────────
# secrets-map.yaml — DATA-ONLY manifest for deploy/provision-stack.py
#
# RULES:
#   - This file contains NO code, NO shell, NO secret values — only names.
#   - Each stack entry declares:
#       env_template:   repo path of the FULL env-file template (tracked).
#                       The template is authoritative: the COMPLETE env file is
#                       rendered from it on every provisioning run. Nothing is
#                       line-edited in place, so keys can never silently go
#                       missing.
#       env_dest:       host path (relative to /volume1/docker/compose-files/)
#                       the rendered env file is shipped to. Rendered file
#                       exists ONLY on the host — never committed to git.
#       docker_secrets: map of docker-swarm-secret-name -> CI ENV VAR NAME
#                       (Pattern C). The env var must be declared via
#                       from_secret: in .woodpecker/deploy.yml's
#                       provision-secrets step (Woodpecker v3 requires explicit
#                       per-secret declaration; there is no expose-all).
#
# ADDING A NEW SECRET (3 small steps, no shell edits):
#   1. Add the secret value in Woodpecker UI (repo Settings -> Secrets).
#   2. Declare it in .woodpecker/deploy.yml provision-secrets environment:
#      block (from_secret) — mechanical two-line addition.
#   3. Reference it here (docker_secrets:) and/or in the stack's
#      .env.template as a dollar-brace placeholder.
#
# Stacks not listed here fall through to deploy.yml's legacy case-entries
# untouched. Migration is deliberately one stack per PR.
# ─────────────────────────────────────────────────────────────────────────────
stacks:
  ai:
    env_template: ai/ai.env.template
    env_dest: ai/ai.env
    docker_secrets:
      flowagent_azure_client_id: FLOWAGENT_AZURE_CLIENT_ID
      flowagent_azure_tenant_id: FLOWAGENT_AZURE_TENANT_ID
      flowagent_azure_client_secret: FLOWAGENT_AZURE_CLIENT_SECRET