{{- if .Values.secret.create }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "medical-chatbot.secretName" . }}
  labels:
    {{- include "medical-chatbot.labels" . | nindent 4 }}
type: Opaque
stringData:
  postgres-password: {{ .Values.secret.postgresPassword | quote }}
  postgres-dsn: {{ printf "postgresql://duoc_thu:%s@%s:5432/duoc_thu" .Values.secret.postgresPassword (default (printf "%s-postgres" (include "medical-chatbot.fullname" .)) .Values.secret.postgresHost) | quote }}
  grafana-admin-password: {{ .Values.secret.grafanaAdminPassword | quote }}
  {{- if and .Values.aws.staticCredentials.enabled .Values.aws.staticCredentials.accessKeyId }}
  aws-access-key-id: {{ .Values.aws.staticCredentials.accessKeyId | quote }}
  aws-secret-access-key: {{ .Values.aws.staticCredentials.secretAccessKey | quote }}
  {{- end }}
  {{- if or .Values.authService.enabled .Values.apiGateway.enabled }}
  {{/* Required (not defaulted) once either service is turned on — same
  fail-closed posture as the image-tag guard above: a guessable or empty
  secret here would let anyone forge an admin JWT. */}}
  jwt-secret: {{ required "secret.jwtSecret is required when authService or apiGateway is enabled" .Values.secret.jwtSecret | quote }}
  {{- end }}
  {{- if .Values.authService.seed.enabled }}
  {{/* Required (not defaulted) once the seed job runs — see the comment on
  secret.adminSeedPassword in values.yaml for why "1" must never reach here. */}}
  admin-seed-password: {{ required "secret.adminSeedPassword is required when authService.seed.enabled" .Values.secret.adminSeedPassword | quote }}
  demo-seed-password: {{ required "secret.demoSeedPassword is required when authService.seed.enabled" .Values.secret.demoSeedPassword | quote }}
  {{- end }}
{{- end }}