# Gitea MCP Server — secrets template
# NEVER commit actual values. Fill in and apply manually.
#
# Since 2026-10-19 the MCP server runs in OAuth mode and uses NO static
# token: users authorize with their own Gitea account. This secret is
# kept only for a rollback to static-token mode (see the deployment).
#
# Two secrets needed (static-token mode):
# 1. GITEA_TOKEN: Personal Access Token from Gitea
#    Create at: http://185.19.28.170:3000/user/settings/applications
#    Permissions: repo (read/write)
#
# 2. OAuth Client ID/Secret: Registered OAuth app in Gitea
#    Create at: http://185.19.28.170:3000/user/settings/applications
#    Redirect URIs: https://claude.ai/api/mcp/auth_callback
#                   http://127.0.0.1/callback   (Claude Code)
#    Confidential Client: UNCHECKED (PKCE). Only the Client ID is needed;
#    it goes into the claude.ai connector's Advanced settings, not here.
---
apiVersion: v1
kind: Secret
metadata:
  name: gitea-mcp-secrets
  namespace: shorashim
type: Opaque
stringData:
  # Gitea Personal Access Token for backend API access
  GITEA_TOKEN: "REPLACE_WITH_GITEA_PAT"