Add postgresql secrets reference

secrets/postgresql.secrets.example

@@ -0,0 +1,42 @@
+# postgresql Stack — Secrets Reference
+# Source: postgresql.env
+#
+# Add SECRET values to Woodpecker at:
+#   https://woodpecker.bryanmail.net
+#   homelab/compose-files → Settings → Secrets
+#
+# ⚠️  CRITICAL: This is the highest-risk stack in the homelab.
+#     The PostgreSQL master password is used by nearly every other stack
+#     (ai, auth, entertainment, guacamole, mealie, n8n, productivity,
+#     security, vaultwarden, woodpecker).
+#
+#     Migrate this stack LAST. Any misconfiguration will cascade and
+#     take down multiple services simultaneously. Ensure you have a
+#     working backup before making any changes.
+
+# ── SECRETS (add to Woodpecker) ───────────────────────────────────────────────
+
+# Woodpecker secret name:  postgresql_password
+# Used for:               PostgreSQL master password (PGadmin superuser)
+#                         ⚠️  Used by nearly every other stack
+# Env var in .env:        POSTGRES_PASSWORD
+postgresql_password=
+
+# Woodpecker secret name:  postgresql_pgadmin_password
+# Used for:               PGAdmin web UI login password
+# Env var in .env:        PGADMIN_DEFAULT_PASSWORD
+postgresql_pgadmin_password=
+
+# ── NON-SECRETS (safe in compose file or .env) ────────────────────────────────
+
+# POSTGRES_USER              Master PostgreSQL username (PGadmin)
+# PGADMIN_DEFAULT_EMAIL      PGAdmin login email
+# DATABASUS_HOST             Traefik hostname for pgAdmin
+# PGADMIN_HOST               Traefik hostname for pgAdmin UI
+
+# ── Woodpecker provision-secrets case entry ───────────────────────────────────
+#
+#   postgresql)
+#     create_or_update_secret "postgresql_password"         "$POSTGRESQL_PASSWORD"
+#     create_or_update_secret "postgresql_pgadmin_password" "$POSTGRESQL_PGADMIN_PASSWORD"
+#     ;;