{{- /*
Auto-provision the submission credential Secret in the chart's release
namespace.

This Secret is the CANONICAL source of truth for the SMTP submission
credential. Two consumers:
  1. The post-install setup Job (templates/setup-job.yaml) reads this
     Secret via env-var injection (`bp-stalwart-sovereign.submissionPasswordEnv`),
     then registers the principal in Stalwart's runtime via /api/principal
     AND mirrors the bytes into `catalyst-system/sovereign-smtp-credentials`
     for bp-catalyst-platform's chart-rendered Secret to read.
  2. catalyst-api / services-auth / services-notification consume the
     SAME bytes via the catalyst-system mirror Secret rendered by
     bp-catalyst-platform's `catalyst-openova-kc-credentials` template
     (which performs Helm `lookup "v1" "Secret" "catalyst-system"
     "sovereign-smtp-credentials"` with SOURCE-wins precedence per
     #910 Bug 3).

Per docs/INVIOLABLE-PRINCIPLES.md #10: the random value lives ONLY in
the Secret bytes — NEVER echoed, logged, or persisted elsewhere.
helm.sh/resource-policy: keep ensures `helm uninstall` does not orphan
catalyst-api pods (they keep authenticating until next reconcile).
*/}}
{{- $secretName := .Values.smtp.submissionSecretName -}}
{{- $namespace := .Release.Namespace -}}
{{- $submissionUser := .Values.smtp.submissionUser -}}
{{- $fqdn := include "bp-stalwart-sovereign.sovereignFQDN" . -}}
{{- $sender := include "bp-stalwart-sovereign.senderAddress" . -}}
{{- $mailHost := include "bp-stalwart-sovereign.mailFQDN" . -}}
{{- $submissionPassword := include "bp-stalwart-sovereign.submissionPassword" . -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName | quote }}
  namespace: {{ $namespace | quote }}
  labels:
    {{- include "bp-stalwart-sovereign.labels" . | nindent 4 }}
    catalyst.openova.io/component: stalwart-sovereign-submission
  annotations:
    helm.sh/resource-policy: keep
type: Opaque
data:
  # Submission credentials — the bytes the post-install Job uses to
  # register the principal AND the bytes the catalyst-system mirror
  # Secret carries (mirror is hydrated by the Job from this Secret).
  smtp-user: {{ $submissionUser | b64enc | quote }}
  smtp-pass: {{ $submissionPassword | b64enc | quote }}
  # Operator-readable infrastructure addresses. Empty when sovereignFQDN
  # is unset (smoke-render-safe).
  smtp-host: {{ $mailHost | default "" | b64enc | quote }}
  smtp-port: {{ "587" | b64enc | quote }}
  smtp-from: {{ $sender | default "" | b64enc | quote }}
