{{- if not .Values.existingSecret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ .Release.Name }}-secrets
  labels:
    {{- include "armature.labels" . | nindent 4 }}
type: Opaque
stringData:
  JWT_SECRET: {{ required "jwtSecret is required" .Values.jwtSecret | quote }}
  {{- if .Values.encryptionKey }}
  ENCRYPTION_KEY: {{ .Values.encryptionKey | quote }}
  {{- end }}
  {{- if .Values.database.postgres.password }}
  POSTGRES_PASSWORD: {{ .Values.database.postgres.password | quote }}
  {{- end }}
  {{- if .Values.admin.password }}
  ARMATURE_ADMIN_USERNAME: {{ .Values.admin.username | quote }}
  ARMATURE_ADMIN_PASSWORD: {{ .Values.admin.password | quote }}
  {{- end }}
  {{- if .Values.admin.email }}
  ARMATURE_ADMIN_EMAIL: {{ .Values.admin.email | quote }}
  {{- end }}
  {{- if .Values.storage.s3.accessKey }}
  S3_ACCESS_KEY: {{ .Values.storage.s3.accessKey | quote }}
  S3_SECRET_KEY: {{ .Values.storage.s3.secretKey | quote }}
  {{- end }}
  {{- if and (eq .Values.auth.mode "oidc") .Values.auth.oidc.clientSecret }}
  OIDC_CLIENT_SECRET: {{ .Values.auth.oidc.clientSecret | quote }}
  {{- end }}
{{- end }}