{{- if .Values.netbird.enabled -}}
# SealedSecret placeholders for the NetBird OIDC client secret AND the
# coturn static-auth secret.
#
# Per docs/INVIOLABLE-PRINCIPLES.md #5 the chart must NEVER carry the
# real secret value. These manifests declare SealedSecrets with empty
# placeholders; the operator runs:
#
#   kubeseal --controller-namespace kube-system \
#     --controller-name sealed-secrets \
#     --raw --from-file=client-secret=/path/to/secret \
#     --namespace {{ .Release.Namespace }} \
#     --name {{ .Values.netbird.oidc.clientSecretRef.name }}
#
# …pastes the resulting ciphertext into encryptedData.client-secret,
# and re-applies via Flux. Same flow for the coturn auth secret —
# generated as `openssl rand -hex 32` and sealed.
#
# When the SealedSecret-controller's CRD is unavailable (test
# environments without bp-sealed-secrets), helm-template still
# succeeds — the manifest applies but Flux's reconciliation logs
# the missing CRD and the deployment will block on the absent
# Secret. That is the intended behaviour: bp-sealed-secrets is a
# hard dep of bp-netbird.
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: {{ .Values.netbird.oidc.clientSecretRef.name }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-netbird.labels" . | nindent 4 }}
spec:
  encryptedData:
    # Empty placeholder — operator replaces via kubeseal.
    {{ .Values.netbird.oidc.clientSecretRef.key }}: ""
  template:
    metadata:
      name: {{ .Values.netbird.oidc.clientSecretRef.name }}
      namespace: {{ .Release.Namespace }}
      labels:
        {{- include "bp-netbird.labels" . | nindent 8 }}
    type: Opaque
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: {{ .Values.netbird.coturn.authSecretRef.name }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-netbird.labels" . | nindent 4 }}
    catalyst.openova.io/component: coturn
spec:
  encryptedData:
    {{ .Values.netbird.coturn.authSecretRef.key }}: ""
  template:
    metadata:
      name: {{ .Values.netbird.coturn.authSecretRef.name }}
      namespace: {{ .Release.Namespace }}
      labels:
        {{- include "bp-netbird.labels" . | nindent 8 }}
        catalyst.openova.io/component: coturn
    type: Opaque
{{- end }}
