From cdf1515d81f4e47223cebb9b66d506625acc4ea8 Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Sat, 20 Jun 2026 23:21:12 -0700
Subject: [PATCH] Add guacamole secrets reference

---
 secrets/guacamole.secrets.example | 51 +++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 secrets/guacamole.secrets.example

diff --git a/secrets/guacamole.secrets.example b/secrets/guacamole.secrets.example
new file mode 100644
index 0000000..9279f50
--- /dev/null
+++ b/secrets/guacamole.secrets.example
@@ -0,0 +1,51 @@
+# guacamole Stack — Secrets Reference
+# Source: guacamole.env
+#
+# Add SECRET values to Woodpecker at:
+#   https://woodpecker.bryanmail.net
+#   homelab/compose-files → Settings → Secrets
+
+# ── SECRETS (add to Woodpecker) ───────────────────────────────────────────────
+
+# Woodpecker secret name:  guacamole_ldap_bind_password
+# Used for:               LDAP service account password for directory searches
+# Env var in .env:        LDAP_SEARCH_BIND_PASSWORD
+guacamole_ldap_bind_password=
+
+# Woodpecker secret name:  guacamole_oidc_client_secret
+# Used for:               Authentik OpenID Connect client secret
+# Env var in .env:        OPENID_CLIENT_SECRET
+guacamole_oidc_client_secret=
+
+# Woodpecker secret name:  guacamole_db_password
+# Used for:               Guacamole PostgreSQL database password
+# Env var in .env:        POSTGRESQL_PASSWORD
+guacamole_db_password=
+
+# ── NON-SECRETS (safe in compose file or .env) ────────────────────────────────
+
+# GUACD_HOSTNAME                  guacd container hostname
+# GUACD_PORT                      guacd port (4822)
+# LDAP_CONFIG_BASE_DN             LDAP base DN
+# LDAP_HOSTNAME                   LDAP server hostname
+# LDAP_USER_BASE_DN               LDAP user search base
+# LDAP_PORT                       LDAP port (636)
+# LDAP_SEARCH_BIND_DN             LDAP service account DN (AVB@bryanmail.net)
+# OPENID_AUTHORIZATION_ENDPOINT   Authentik authorization URL
+# OPENID_JWKS_ENDPOINT            Authentik JWKS URL
+# OPENID_ISSUER                   Authentik issuer URL
+# OPENID_CLIENT_ID                Authentik client ID (not sensitive)
+# OPENID_REDIRECT_URI             OAuth callback URL
+# POSTGRESQL_HOSTNAME             PostgreSQL hostname
+# POSTGRESQL_PORT                 PostgreSQL port
+# POSTGRESQL_DATABASE             Database name (guacamole_db)
+# POSTGRESQL_USER                 Database username (guacamole)
+# GUACAMOLE_HOST                  Traefik hostname
+
+# ── Woodpecker provision-secrets case entry ───────────────────────────────────
+#
+#   guacamole)
+#     create_or_update_secret "guacamole_ldap_bind_password" "$GUACAMOLE_LDAP_BIND_PASSWORD"
+#     create_or_update_secret "guacamole_oidc_client_secret" "$GUACAMOLE_OIDC_CLIENT_SECRET"
+#     create_or_update_secret "guacamole_db_password"        "$GUACAMOLE_DB_PASSWORD"
+#     ;;