2. Create the namespace and secrets

Create the namespace and the secrets Ayakaleaf Pro needs.

Everything goes into the namespace overleaf:

kubectl create namespace overleaf

Ayakaleaf Pro reads its secrets from environment variables. Generate them once and keep them in a Secret:

HISTORY=$(openssl rand -hex 32)
kubectl -n overleaf create secret generic overleaf-secrets \
  --from-literal=OVERLEAF_INVITE_TOKEN_SECRET="$(openssl rand -base64 32)" \
  --from-literal=OVERLEAF_SESSION_SECRET="$(openssl rand -hex 32)" \
  --from-literal=WEB_API_PASSWORD="$(openssl rand -hex 32)" \
  --from-literal=STAGING_PASSWORD="$HISTORY" \
  --from-literal=V1_HISTORY_PASSWORD="$HISTORY" \
  --from-literal=CRYPTO_RANDOM="$(openssl rand -hex 32)" \
  --from-literal=OT_JWT_AUTH_KEY="$(openssl rand -hex 32)"

Secret	Why
OVERLEAF_INVITE_TOKEN_SECRET	Required. Without it the pod stops with “Missing required secrets”. Changing it invalidates pending project invites.
OVERLEAF_SESSION_SECRET	Signs the session cookies. Without it, every restart of the pod logs everybody out.
WEB_API_PASSWORD, CRYPTO_RANDOM, OT_JWT_AUTH_KEY	Internal secrets. The container generates them on each start when they are missing; with more than one replica all replicas must share them.
STAGING_PASSWORD and V1_HISTORY_PASSWORD	Internal history secret; both must have the same value.

Back up the Secret (kubectl -n overleaf get secret overleaf-secrets -o yaml) with your data. Features that encrypt tokens in MongoDB need their own cipher passwords in this Secret as well, for example GITHUB_TOKEN_CIPHER_PASSWORD for GitHub Synchronisation.