{{- if .Values.secret.create }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "medical-chatbot.secretName" . }}
  labels:
    {{- include "medical-chatbot.labels" . | nindent 4 }}
type: Opaque
stringData:
  postgres-password: {{ .Values.secret.postgresPassword | quote }}
  postgres-dsn: {{ printf "postgresql://duoc_thu:%s@%s:5432/duoc_thu" .Values.secret.postgresPassword (default (printf "%s-postgres" (include "medical-chatbot.fullname" .)) .Values.secret.postgresHost) | quote }}
  grafana-admin-password: {{ .Values.secret.grafanaAdminPassword | quote }}
  {{- if and .Values.aws.staticCredentials.enabled .Values.aws.staticCredentials.accessKeyId }}
  aws-access-key-id: {{ .Values.aws.staticCredentials.accessKeyId | quote }}
  aws-secret-access-key: {{ .Values.aws.staticCredentials.secretAccessKey | quote }}
  {{- end }}
  {{- if .Values.secret.langfusePublicKey }}
  {{/* Both keys or neither: a public key without its secret authenticates
  nothing, and ai-service already treats a partial config as "not
  configured" (see rag/telemetry.py's _langfuse_exporters). */}}
  langfuse-public-key: {{ .Values.secret.langfusePublicKey | quote }}
  langfuse-secret-key: {{ required "secret.langfuseSecretKey is required when secret.langfusePublicKey is set" .Values.secret.langfuseSecretKey | quote }}
  {{- end }}
  {{- if or .Values.authService.enabled .Values.apiGateway.enabled }}
  {{/* Required (not defaulted) once either service is turned on — same
  fail-closed posture as the image-tag guard above: a guessable or empty
  secret here would let anyone forge an admin JWT. */}}
  jwt-secret: {{ required "secret.jwtSecret is required when authService or apiGateway is enabled" .Values.secret.jwtSecret | quote }}
  {{- end }}
{{- end }}