From 62d48830203b94b3dd0de73d4cae3f367ec6876c Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Sat, 20 Jun 2026 23:22:45 -0700
Subject: [PATCH] Add postgresql secrets reference

---
 secrets/postgresql.secrets.example | 42 ++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 secrets/postgresql.secrets.example

diff --git a/secrets/postgresql.secrets.example b/secrets/postgresql.secrets.example
new file mode 100644
index 0000000..744ec5e
--- /dev/null
+++ b/secrets/postgresql.secrets.example
@@ -0,0 +1,42 @@
+# postgresql Stack — Secrets Reference
+# Source: postgresql.env
+#
+# Add SECRET values to Woodpecker at:
+#   https://woodpecker.bryanmail.net
+#   homelab/compose-files → Settings → Secrets
+#
+# ⚠️  CRITICAL: This is the highest-risk stack in the homelab.
+#     The PostgreSQL master password is used by nearly every other stack
+#     (ai, auth, entertainment, guacamole, mealie, n8n, productivity,
+#     security, vaultwarden, woodpecker).
+#
+#     Migrate this stack LAST. Any misconfiguration will cascade and
+#     take down multiple services simultaneously. Ensure you have a
+#     working backup before making any changes.
+
+# ── SECRETS (add to Woodpecker) ───────────────────────────────────────────────
+
+# Woodpecker secret name:  postgresql_password
+# Used for:               PostgreSQL master password (PGadmin superuser)
+#                         ⚠️  Used by nearly every other stack
+# Env var in .env:        POSTGRES_PASSWORD
+postgresql_password=
+
+# Woodpecker secret name:  postgresql_pgadmin_password
+# Used for:               PGAdmin web UI login password
+# Env var in .env:        PGADMIN_DEFAULT_PASSWORD
+postgresql_pgadmin_password=
+
+# ── NON-SECRETS (safe in compose file or .env) ────────────────────────────────
+
+# POSTGRES_USER              Master PostgreSQL username (PGadmin)
+# PGADMIN_DEFAULT_EMAIL      PGAdmin login email
+# DATABASUS_HOST             Traefik hostname for pgAdmin
+# PGADMIN_HOST               Traefik hostname for pgAdmin UI
+
+# ── Woodpecker provision-secrets case entry ───────────────────────────────────
+#
+#   postgresql)
+#     create_or_update_secret "postgresql_password"         "$POSTGRESQL_PASSWORD"
+#     create_or_update_secret "postgresql_pgadmin_password" "$POSTGRESQL_PGADMIN_PASSWORD"
+#     ;;