# ~/.zshrc.local — per-machine customizations. Copy this file to
# ~/.zshrc.local and fill in what this box needs. It is sourced at the end
# of the managed ~/.zshrc, is never overwritten by bootstrap, and never
# lives in the repo — this is the ONLY place to put secrets.
#
#   cp zsh/zshrc.local.example ~/.zshrc.local && chmod 600 ~/.zshrc.local

# --- Gitea -------------------------------------------------------------
# Personal access token for git.nic-oconnor.com (API/CLI use; HTTPS git
# auth itself goes through credential.helper store, see git/).
# export GITEA_KEY=...

# --- covert-gpt LiteLLM gateway -----------------------------------------
# LITELLM_KEY is normally exported by mcp-config's sync hook from
# ~/.config/mcp-sync/key — run mcp-config/install.sh once instead of
# setting it here. Only set it here on a box without mcp-sync:
# export LITELLM_KEY=sk-...
#
# To develop mcp-config/ or skills/ against a working checkout instead of
# Gitea's main, point the sync at it and source it directly:
# MCP_SYNC_RAW_URL="file://$HOME/source/dotfiles/mcp-config/opencode.gateway.json"
# MCP_SYNC_SKILLS_SRC="$HOME/source/dotfiles/skills"
# . "$HOME/source/dotfiles/mcp-config/sync.sh"

# --- 1Password CLI -------------------------------------------------------
# Service-account token for non-interactive `op read` / `op run`.
# export OP_SERVICE_ACCOUNT_TOKEN=ops_...

# --- Proxmox MCP gateway (ai-k8s-iac) ------------------------------------
# Credentials for the Proxmox MCP server registered on the covert-gpt
# LiteLLM gateway. `task up` in ai-k8s-iac reads these env vars and stores
# them in the inference-mcp Secret; they are never committed.
# export PROXMOX_MCP_HOST="https://pve.local:8006"
# export PROXMOX_MCP_TOKEN_ID="root@pam!terragrunt-proxmox"
# export PROXMOX_MCP_TOKEN_SECRET="00000000-0000-0000-0000-000000000000"
# export PROXMOX_MCP_INSECURE_TLS="true"

# --- Anything else -------------------------------------------------------
# Aliases, PATH additions, kubeconfig defaults, etc. This file loads last,
# so it can override anything the managed zshrc sets.
# export KUBECONFIG="$HOME/.kube/homelab.yaml"