apiVersion: v1
kind: Secret
metadata:
  name: oghma-proxy-secrets
  namespace: nimmersky
  labels:
    app.kubernetes.io/name: oghma-proxy
    app.kubernetes.io/part-of: nimmerverse
type: Opaque
stringData:
  # Replace with actual values or use external secret management
  OPENROUTER_API_KEY: "your-openrouter-api-key-here"
  UPSTREAM_URL: "https://openrouter.ai/api/v1"

---
# Alternative: Use ExternalSecret with Vault/Vaultwarden
# apiVersion: external-secrets.io/v1beta1
# kind: ExternalSecret
# metadata:
#   name: oghma-proxy-secrets
#   namespace: nimmersky
# spec:
#   refreshInterval: 1h
#   secretStoreRef:
#     name: vault-backend
#     kind: ClusterSecretStore
#   target:
#     name: oghma-proxy-secrets
#   data:
#     - secretKey: OPENROUTER_API_KEY
#       remoteRef:
#         key: nimmerverse/skyrimnet
#         property: openrouter_api_key