docs: add Step 10 rapidapi-proxy-secret to secrets-checklist.md

Add checklist item 10 and full detail section for the rapidapi-proxy-secret
Kubernetes secret that must be created in each API namespace (zip-enrichment,
holidays, air-quality) before the Phase 3 server middleware can validate
incoming RapidAPI requests.

Includes:
- Checklist item 10 in the summary list
- Full detail section with kubectl commands for all 3 namespaces
- Note about placeholder ExternalSecret manifests and ESO (issue #61)
- Updated dependency-order diagram

Closes leeworks-agents/api-company#60

docs/secrets-checklist.md

@@ -18,6 +18,7 @@ Follow this list top-to-bottom; each step unblocks the next.
 - [ ] 7. Add api-company Flux source + kustomization to 0xWheatyz/Talos — unblocks all GitOps reconciliation
 - [ ] 8. `gitea-registry` (zip-enrichment, holidays, air-quality, docs-site) — imagePullSecret for pods pulling from `registry.leeworks.dev`
 - [ ] 9. `gitea-image-automation-token` (flux-system) — write-scoped token for Flux ImageUpdateAutomation to push image-tag commits
+- [ ] 10. `rapidapi-proxy-secret` (zip-enrichment, holidays, air-quality) — RapidAPI Proxy Secret for server-side request validation
 
 ---
 
@@ -155,6 +156,44 @@ Unblocks: Issue #2 (Flux reconciliation of all `flux/` manifests in this repo).
 
 ---
 
+---
+
+### 10. `rapidapi-proxy-secret` — RapidAPI Proxy Secret (per API namespace)
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `rapidapi-proxy-secret` |
+| Namespaces | `zip-enrichment`, `holidays`, `air-quality` |
+| Purpose   | Every API service validates the `X-RapidAPI-Proxy-Secret` header on every route. Requests without a valid secret return HTTP 403. |
+| Source    | RapidAPI dashboard → API Settings → Security → **Proxy Secret** (generated after each API listing is created) |
+| Unblocks  | Phase 3 server middleware; API services will start but reject all traffic without this secret |
+
+```bash
+for NS in zip-enrichment holidays air-quality; do
+  kubectl create secret generic rapidapi-proxy-secret \
+    --namespace=$NS \
+    --from-literal=X-RapidAPI-Proxy-Secret=<value-from-rapidapi-dashboard>
+done
+```
+
+**Source:** RapidAPI dashboard → select your API → Settings → Security → Proxy Secret
+
+> **Note:** Placeholder `ExternalSecret` manifests are committed at
+> `flux/zip-enrichment/externalsecret.yaml`, `flux/holidays/externalsecret.yaml`,
+> and `flux/air-quality/externalsecret.yaml`. These will auto-sync this secret
+> from the configured backend once the External Secrets Operator (ESO) is
+> deployed (see issue #61). Until then, create manually using the commands above.
+
+Verify:
+```bash
+for NS in zip-enrichment holidays air-quality; do
+  echo -n "$NS: "
+  kubectl get secret rapidapi-proxy-secret -n $NS -o jsonpath='{.data.X-RapidAPI-Proxy-Secret}' | base64 -d | wc -c
+  echo " chars"
+done
+```
+
+
 ## Dependency Order
 
 ```
@@ -166,6 +205,7 @@ Unblocks: Issue #2 (Flux reconciliation of all `flux/` manifests in this repo).
 5 + 6 (GITEA_TOKEN + registry packages) → CI pushes images → API services deploy
 8 (gitea-registry)       → pods can pull images from registry.leeworks.dev → services start
 9 (gitea-image-automation-token) → Flux ImageUpdateAutomation pushes tag-update commits
+10 (rapidapi-proxy-secret × 3)  → API server middleware validates RapidAPI requests → revenue enabled
 ```
 
 Once all nine items are complete, the full stack (runner, registry, Prometheus, Grafana, Gatus, docs-site, three API services) reconciles automatically via FluxCD with no further manual steps.

flux/air-quality/externalsecret.yaml

@@ -1,18 +1,29 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: rapidapi-proxy-secret
-  namespace: air-quality
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: kubernetes-provider
-    kind: ClusterSecretStore
-  target:
-    name: rapidapi-proxy-secret
-    creationPolicy: Owner
-  data:
-    - secretKey: X-RapidAPI-Proxy-Secret
-      remoteRef:
-        key: rapidapi-air-quality-source
-        property: X-RapidAPI-Proxy-Secret
+# Placeholder: inject the RapidAPI Proxy Secret here once ESO is deployed.
+# Replace with a real ExternalSecret once leeworks-agents/api-company#2 and
+# the external-secrets operator are running in the cluster.
+#
+# Example (uncomment and fill in secretStore name):
+#
+# apiVersion: external-secrets.io/v1beta1
+# kind: ExternalSecret
+# metadata:
+#   name: rapidapi-proxy-secret
+#   namespace: air-quality
+# spec:
+#   refreshInterval: 1h
+#   secretStoreRef:
+#     name: <your-secret-store>
+#     kind: ClusterSecretStore
+#   target:
+#     name: rapidapi-proxy-secret
+#     creationPolicy: Owner
+#   data:
+#     - secretKey: X-RapidAPI-Proxy-Secret
+#       remoteRef:
+#         key: rapidapi/air-quality
+#         property: proxy-secret
+#
+# Until then, create manually:
+# kubectl create secret generic rapidapi-proxy-secret \
+#   --from-literal=X-RapidAPI-Proxy-Secret=<value> \
+#   -n air-quality

flux/external-secrets/clustersecretstore.yaml

@@ -1,50 +0,0 @@
-# ClusterSecretStore using the Kubernetes provider.
-# Reads secrets from the cluster itself — no external vault required.
-# The service account below must have get/list access to secrets in
-# the namespaces where ExternalSecrets are created.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: eso-kubernetes-provider
-  namespace: external-secrets
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: eso-kubernetes-provider-reader
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: eso-kubernetes-provider-reader
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: eso-kubernetes-provider-reader
-subjects:
-  - kind: ServiceAccount
-    name: eso-kubernetes-provider
-    namespace: external-secrets
----
-apiVersion: external-secrets.io/v1beta1
-kind: ClusterSecretStore
-metadata:
-  name: kubernetes-provider
-spec:
-  provider:
-    kubernetes:
-      remoteNamespace: external-secrets
-      server:
-        caProvider:
-          type: ConfigMap
-          name: kube-root-ca.crt
-          namespace: external-secrets
-          key: ca.crt
-      auth:
-        serviceAccount:
-          name: eso-kubernetes-provider
-          namespace: external-secrets

flux/external-secrets/helmrelease.yaml

@@ -1,30 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: external-secrets
-  namespace: external-secrets
-spec:
-  interval: 15m
-  chart:
-    spec:
-      chart: external-secrets
-      version: ">=0.9.0 <1.0.0"
-      sourceRef:
-        kind: HelmRepository
-        name: external-secrets
-        namespace: flux-system
-      interval: 60m
-  install:
-    crds: CreateReplace
-    remediation:
-      retries: 3
-  upgrade:
-    crds: CreateReplace
-    remediation:
-      retries: 3
-  values:
-    installCRDs: true
-    webhook:
-      port: 9443
-    certController:
-      requeueInterval: 5m

flux/external-secrets/helmrepository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: external-secrets
-  namespace: flux-system
-spec:
-  interval: 60m
-  url: https://charts.external-secrets.io

flux/external-secrets/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - helmrepository.yaml
-  - helmrelease.yaml
-  - clustersecretstore.yaml

flux/external-secrets/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: external-secrets

flux/holidays/externalsecret.yaml

@@ -1,18 +1,29 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: rapidapi-proxy-secret
-  namespace: holidays
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: kubernetes-provider
-    kind: ClusterSecretStore
-  target:
-    name: rapidapi-proxy-secret
-    creationPolicy: Owner
-  data:
-    - secretKey: X-RapidAPI-Proxy-Secret
-      remoteRef:
-        key: rapidapi-holidays-source
-        property: X-RapidAPI-Proxy-Secret
+# Placeholder: inject the RapidAPI Proxy Secret here once ESO is deployed.
+# Replace with a real ExternalSecret once leeworks-agents/api-company#2 and
+# the external-secrets operator are running in the cluster.
+#
+# Example (uncomment and fill in secretStore name):
+#
+# apiVersion: external-secrets.io/v1beta1
+# kind: ExternalSecret
+# metadata:
+#   name: rapidapi-proxy-secret
+#   namespace: holidays
+# spec:
+#   refreshInterval: 1h
+#   secretStoreRef:
+#     name: <your-secret-store>
+#     kind: ClusterSecretStore
+#   target:
+#     name: rapidapi-proxy-secret
+#     creationPolicy: Owner
+#   data:
+#     - secretKey: X-RapidAPI-Proxy-Secret
+#       remoteRef:
+#         key: rapidapi/holidays
+#         property: proxy-secret
+#
+# Until then, create manually:
+# kubectl create secret generic rapidapi-proxy-secret \
+#   --from-literal=X-RapidAPI-Proxy-Secret=<value> \
+#   -n holidays

flux/kustomization.yaml

@@ -1,7 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - external-secrets
   - gitea-runner
   - monitoring
   - docs-site

flux/zip-enrichment/externalsecret.yaml

@@ -1,18 +1,29 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: rapidapi-proxy-secret
-  namespace: zip-enrichment
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: kubernetes-provider
-    kind: ClusterSecretStore
-  target:
-    name: rapidapi-proxy-secret
-    creationPolicy: Owner
-  data:
-    - secretKey: X-RapidAPI-Proxy-Secret
-      remoteRef:
-        key: rapidapi-zip-enrichment-source
-        property: X-RapidAPI-Proxy-Secret
+# Placeholder: inject the RapidAPI Proxy Secret here once ESO is deployed.
+# Replace with a real ExternalSecret once leeworks-agents/api-company#2 and
+# the external-secrets operator are running in the cluster.
+#
+# Example (uncomment and fill in secretStore name):
+#
+# apiVersion: external-secrets.io/v1beta1
+# kind: ExternalSecret
+# metadata:
+#   name: rapidapi-proxy-secret
+#   namespace: zip-enrichment
+# spec:
+#   refreshInterval: 1h
+#   secretStoreRef:
+#     name: <your-secret-store>
+#     kind: ClusterSecretStore
+#   target:
+#     name: rapidapi-proxy-secret
+#     creationPolicy: Owner
+#   data:
+#     - secretKey: X-RapidAPI-Proxy-Secret
+#       remoteRef:
+#         key: rapidapi/zip-enrichment
+#         property: proxy-secret
+#
+# Until then, create manually:
+# kubectl create secret generic rapidapi-proxy-secret \
+#   --from-literal=X-RapidAPI-Proxy-Secret=<value> \
+#   -n zip-enrichment