From 11470d911599e26e14c4d1d8541d39b0dcf58766 Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Sat, 20 Jun 2026 23:22:45 -0700
Subject: [PATCH] Add productivity secrets reference

---
 secrets/productivity.secrets.example | 48 ++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 secrets/productivity.secrets.example

diff --git a/secrets/productivity.secrets.example b/secrets/productivity.secrets.example
new file mode 100644
index 0000000..6320727
--- /dev/null
+++ b/secrets/productivity.secrets.example
@@ -0,0 +1,48 @@
+# productivity Stack — Secrets Reference
+# Source: productivity.env
+#
+# Add SECRET values to Woodpecker at:
+#   https://woodpecker.bryanmail.net
+#   homelab/compose-files → Settings → Secrets
+
+# ── SECRETS (add to Woodpecker) ───────────────────────────────────────────────
+
+# Woodpecker secret name:  productivity_paperless_secret_key
+# Used for:               Paperless-ngx secret key for session signing
+# Env var in .env:        PAPERLESS_SECRET_KEY
+productivity_paperless_secret_key=
+
+# Woodpecker secret name:  productivity_db_password
+# Used for:               Paperless-ngx PostgreSQL database password
+# Env var in .env:        PAPERLESS_DBPASS
+productivity_db_password=
+
+# Woodpecker secret name:  productivity_oidc_providers
+# Used for:               Paperless-ngx Authentik SSO config (contains client_id + secret)
+#                         NOTE: This is a JSON blob — store the entire value as-is
+# Env var in .env:        PAPERLESS_SOCIALACCOUNT_PROVIDERS
+productivity_oidc_providers=
+
+# ── NON-SECRETS (safe in compose file or .env) ────────────────────────────────
+
+# PAPERLESS_URL                          Public URL
+# PAPERLESS_CSRF_TRUSTED_ORIGINS         CSRF allowed origins
+# PAPERLESS_TIME_ZONE                    Timezone
+# PAPERLESS_OCR_LANGUAGE                 OCR language (eng)
+# PAPERLESS_DBNAME                       Database name (paperless)
+# PAPERLESS_DBUSER                       Database username (paperless)
+# PAPERLESS_APPS                         Django app list
+# PAPERLESS_LOGOUT_REDIRECT_URL          Authentik logout URL
+# PAPERLESS_SOCIAL_AUTO_SIGNUP           Boolean flag
+# PAPERLESS_SOCIALACCOUNT_ALLOW_SIGNUPS  Boolean flag
+# PAPERLESS_TRUSTED_PROXIES              Trusted proxy CIDR
+# PAPERLESS_USE_X_FORWARD_HOST           Boolean flag
+# PAPERLESS_USE_X_FORWARD_PORT           Boolean flag
+
+# ── Woodpecker provision-secrets case entry ───────────────────────────────────
+#
+#   productivity)
+#     create_or_update_secret "productivity_paperless_secret_key" "$PRODUCTIVITY_PAPERLESS_SECRET_KEY"
+#     create_or_update_secret "productivity_db_password"          "$PRODUCTIVITY_DB_PASSWORD"
+#     create_or_update_secret "productivity_oidc_providers"       "$PRODUCTIVITY_OIDC_PROVIDERS"
+#     ;;