guanghulab/server/setup/lighthouse-cn/gitea-secrets-template.yaml

# ════════════════════════════════════════════════════════════════
# 光湖灯塔 · 国内 Gitea 仓库 Secrets 模板
# Sovereign: TCS-0002∞ · 国作登字-2026-A-00037559
#
# 用法:
#   1. 灯塔 Gitea 部署完, 用管理员账号登录
#   2. 创建 guanghulab 仓库 (mirror push 自 COS 包)
#   3. 进 Repo Settings → Secrets and Variables → Actions
#   4. 按本文件分组逐项 New Secret
#   5. value 留空的, 由冰朔 / 霜砚填入
# ════════════════════════════════════════════════════════════════

# ─── A 组 · 服务器与基础设施 ─────────────────────────────────
- name: CN_LIGHTHOUSE_HOST
  group: A-infra
  description: 国内灯塔主服务器公网 IP
  example: 43.139.251.175
  required: true

- name: CN_LIGHTHOUSE_USER
  group: A-infra
  description: 主服务器 SSH 用户
  example: root
  required: true

- name: CN_LIGHTHOUSE_KEY
  group: A-infra
  description: 主服务器 SSH 私钥 (ed25519, 含 BEGIN/END 行)
  required: true
  sensitive: true

- name: CN_LIGHTHOUSE_PORT
  group: A-infra
  description: 主服务器 SSH 端口
  example: "22"
  required: true

- name: CN_LIGHTHOUSE_DOMAIN
  group: A-infra
  description: 主服务器对外域名 (备案前用 IP)
  example: 43.139.251.175
  required: true

- name: CN_LIGHTHOUSE_BACKUP_HOST
  group: A-infra
  description: 备用机公网 IP (未购则留空)
  required: false

- name: CN_LIGHTHOUSE_BACKUP_USER
  group: A-infra
  required: false

- name: CN_LIGHTHOUSE_BACKUP_KEY
  group: A-infra
  required: false
  sensitive: true

- name: CN_OVERSEAS_RELAY_HOST
  group: A-infra
  description: 海外中转服务器 IP (神笔马良跨境取物钩用)
  required: false

- name: CN_OVERSEAS_RELAY_USER
  group: A-infra
  required: false

- name: CN_OVERSEAS_RELAY_KEY
  group: A-infra
  required: false
  sensitive: true

- name: CN_SSH_KNOWN_HOSTS
  group: A-infra
  description: known_hosts 内容 (避免每次握手警告)
  required: false

# ─── B 组 · 域名与 SSL ───────────────────────────────────────
- name: CN_DOMAIN_LIGHTHOUSE
  group: B-domain
  description: 灯塔主域名 (ICP 备案后)
  required: false

- name: CN_DOMAIN_TOTAL_CONSOLE
  group: B-domain
  description: 操作系统总控台对外域名
  required: false

- name: CN_DOMAIN_FORUM
  group: B-domain
  description: 论坛域名
  required: false

- name: CN_SSL_FULLCHAIN
  group: B-domain
  description: SSL fullchain.pem 全文
  required: false
  sensitive: true

- name: CN_SSL_PRIVKEY
  group: B-domain
  description: SSL privkey.pem 全文
  required: false
  sensitive: true

# ─── C 组 · 模型与商业 API ──────────────────────────────────
- name: CN_SILICONFLOW_API_KEY
  group: C-model
  description: 硅基流动 API Key (裸模型推理)
  required: true
  sensitive: true

- name: CN_SILICONFLOW_BASE_MODEL_ID
  group: C-model
  description: 母模型 ID (硅基流动)
  required: true

- name: CN_SILICONFLOW_CODE_MODEL_ID
  group: C-model
  description: 代码模型 ID (硅基流动)
  required: true

- name: CN_DEEPSEEK_API_KEY
  group: C-model
  description: DeepSeek 推理 API Key
  required: false
  sensitive: true

- name: CN_QIANWEN_API_KEY
  group: C-model
  description: 通义千问 API Key (DashScope / Bailian)
  required: false
  sensitive: true

- name: CN_KIMI_API_KEY
  group: C-model
  description: 月之暗面 Kimi API Key
  required: false
  sensitive: true

- name: CN_QINGYAN_API_KEY
  group: C-model
  description: 智谱清言 API Key
  required: false
  sensitive: true

# ─── D 组 · 存储与数据库 ─────────────────────────────────────
- name: CN_COS_SECRET_ID
  group: D-storage
  description: 腾讯云 COS SecretId
  required: true
  sensitive: true

- name: CN_COS_SECRET_KEY
  group: D-storage
  description: 腾讯云 COS SecretKey
  required: true
  sensitive: true

- name: CN_COS_REGION
  group: D-storage
  example: ap-guangzhou
  required: true

- name: CN_COS_LIGHTHOUSE_BUCKET
  group: D-storage
  description: 灯塔公共存储桶名
  required: true

- name: CN_COS_USER_BRAIN_BUCKET
  group: D-storage
  description: 用户人格大脑回写桶
  required: false

- name: CN_DB_HOST
  group: D-storage
  required: false

- name: CN_DB_PORT
  group: D-storage
  example: "5432"
  required: false

- name: CN_DB_USER
  group: D-storage
  required: false

- name: CN_DB_PASS
  group: D-storage
  required: false
  sensitive: true

- name: CN_DB_NAME
  group: D-storage
  required: false

- name: CN_REDIS_HOST
  group: D-storage
  required: false

- name: CN_REDIS_PORT
  group: D-storage
  example: "6379"
  required: false

- name: CN_REDIS_PASS
  group: D-storage
  required: false
  sensitive: true

# ─── E 组 · Gitea 自身与 CI/CD ──────────────────────────────
- name: CN_GITEA_TOKEN
  group: E-gitea
  description: 铸渊用来推 PR 的 Gitea PAT (repo + write:issue + read:org)
  required: true
  sensitive: true

- name: CN_GITEA_RUNNER_TOKEN
  group: E-gitea
  description: Gitea Actions Runner 注册 token
  required: true
  sensitive: true

- name: CN_GITEA_WEBHOOK_SECRET
  group: E-gitea
  description: Gitea Webhook 校验 secret
  required: false
  sensitive: true

- name: CN_DISPATCH_TOKEN
  group: E-gitea
  description: 跨仓库触发用 (对应 GitHub 的 ZY_DISPATCH_TOKEN)
  required: false
  sensitive: true

# ─── F 组 · 通知与对接 ───────────────────────────────────────
- name: CN_NOTION_TOKEN
  group: F-notify
  description: Notion API token (霜砚联动)
  required: true
  sensitive: true

- name: CN_NOTION_RECEIPT_DB
  group: F-notify
  required: false

- name: CN_NOTION_SYSLOG_DB
  group: F-notify
  required: false

- name: CN_NOTION_BULLETIN_PAGE
  group: F-notify
  required: false

- name: CN_DINGTALK_APP_KEY
  group: F-notify
  required: false
  sensitive: true

- name: CN_DINGTALK_APP_SECRET
  group: F-notify
  required: false
  sensitive: true

- name: CN_SMTP_USER
  group: F-notify
  required: false

- name: CN_SMTP_PASS
  group: F-notify
  required: false
  sensitive: true

# ─── G 组 · 操作系统总控台 ──────────────────────────────────
- name: CN_TOTAL_CONSOLE_JWT_SECRET
  group: G-console
  description: 用户登录总控台的 JWT 签名秘钥 (随机 ≥64 字符)
  required: true
  sensitive: true

- name: CN_TOTAL_CONSOLE_API_KEY
  group: G-console
  description: 用户服务器接入总控台的握手 API key
  required: true
  sensitive: true

- name: CN_PERSONA_REGISTRATION_SECRET
  group: G-console
  description: 人格体注册回灯塔的握手秘钥
  required: true
  sensitive: true