{{- if not .Values.llm.existingSecret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "turnstone.fullname" . }}-secrets
  labels:
    {{- include "turnstone.labels" . | nindent 4 }}
type: Opaque
data:
  {{- if .Values.llm.apiKey }}
  OPENAI_API_KEY: {{ .Values.llm.apiKey | b64enc | quote }}
  {{- end }}
  {{- if and .Values.postgresql.enabled .Values.postgresql.auth.password }}
  POSTGRES_PASSWORD: {{ .Values.postgresql.auth.password | b64enc | quote }}
  {{- else if and (not .Values.postgresql.enabled) .Values.database.external.password }}
  POSTGRES_PASSWORD: {{ .Values.database.external.password | b64enc | quote }}
  {{- end }}
  {{- if and .Values.auth.jwtSecret (not .Values.auth.existingSecret) }}
  TURNSTONE_JWT_SECRET: {{ .Values.auth.jwtSecret | b64enc | quote }}
  {{- end }}
{{- end }}
