{{- if and (not .Values.config.garage.existingSecret.name) .Values.config.garage.admin_token }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "garage-ui.fullname" . }}-admin-token
  labels:
    {{- include "garage-ui.labels" . | nindent 4 }}
type: Opaque
data:
  admin-token: {{ .Values.config.garage.admin_token | b64enc | quote }}
{{- end }}
---
{{- if and .Values.config.auth.admin.enabled (not .Values.config.auth.admin.existingSecret.name) }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "garage-ui.fullname" . }}-admin-password
  labels:
    {{- include "garage-ui.labels" . | nindent 4 }}
type: Opaque
data:
  {{- if .Values.config.auth.admin.password }}
  admin-password: {{ .Values.config.auth.admin.password | b64enc | quote }}
  {{- else }}
  admin-password: {{ randAlphaNum 32 | b64enc | quote }}
  {{- end }}
{{- end }}
---
{{- if and .Values.config.auth.oidc.enabled (not .Values.config.auth.oidc.existingSecret.name) .Values.config.auth.oidc.client_secret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "garage-ui.fullname" . }}-oidc-client-secret
  labels:
    {{- include "garage-ui.labels" . | nindent 4 }}
type: Opaque
data:
  client-secret: {{ .Values.config.auth.oidc.client_secret | b64enc | quote }}
{{- end }}
---
{{- if and (not .Values.config.auth.jwt_private_key_secret.name) .Values.config.auth.jwt_private_key }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "garage-ui.fullname" . }}-jwt-key
  labels:
    {{- include "garage-ui.labels" . | nindent 4 }}
  annotations:
    "helm.sh/resource-policy": keep
type: Opaque
data:
  jwt-key.pem: {{ .Values.config.auth.jwt_private_key | b64enc | quote }}
{{- end }}
---
{{- if not .Values.config.auth.jwt_private_key_secret.name }}
{{- $secretName := printf "%s-jwt-key" (include "garage-ui.fullname" .) }}
{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $secretName }}
{{- if not $existingSecret }}
{{- $privateKey := genPrivateKey "ed25519" }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName }}
  labels:
    {{- include "garage-ui.labels" . | nindent 4 }}
  annotations:
    "helm.sh/resource-policy": keep
type: Opaque
data:
  jwt-key.pem: {{ $privateKey | b64enc | quote }}
{{- end }}
{{- end }}