{{- if .Values.postgresql.enabled }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ .Values.postgresql.credentialsSecret }}
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "osint-dashboard.labels" . | nindent 4 }}
  annotations:
    # SOPS will encrypt this - use 'sops --encrypt --in-place' after generation
type: Opaque
stringData:
  username: osint_admin
  password: CHANGE_ME_USE_SOPS
  connection_string: "postgresql://osint_admin:CHANGE_ME_USE_SOPS@{{ .Values.postgresql.clusterName }}.{{ .Values.namespace }}.svc:5432/osint?sslmode=require"
---
apiVersion: v1
kind: Secret
metadata:
  name: osint-pg-reader-credentials
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "osint-dashboard.labels" . | nindent 4 }}
type: Opaque
stringData:
  username: osint_reader
  password: CHANGE_ME_USE_SOPS
  connection_string: "postgresql://osint_reader:CHANGE_ME_USE_SOPS@{{ .Values.postgresql.clusterName }}.{{ .Values.namespace }}.svc:5432/osint?sslmode=require"
{{- end }}