# ai Stack — Secrets Reference
# Source: ai.env
#
# Add SECRET values to Woodpecker at:
#   https://woodpecker.bryanmail.net
#   homelab/compose-files → Settings → Secrets
#
# NON-SECRET values can be hardcoded in ai.yaml or left in ai.env

# ── SECRETS (add to Woodpecker) ───────────────────────────────────────────────

# Woodpecker secret name:  ai_aws_access_key_id
# Used for:               AWS credentials for Amazon Bedrock
# Env var in .env:        AWS_ACCESS_KEY_ID
ai_aws_access_key_id=

# Woodpecker secret name:  ai_aws_secret_access_key
# Used for:               AWS credentials for Amazon Bedrock
# Env var in .env:        AWS_SECRET_ACCESS_KEY
ai_aws_secret_access_key=

# Woodpecker secret name:  ai_litellm_master_key
# Used for:               LiteLLM proxy API key (must start with sk-)
# Env var in .env:        LITELLM_MASTER_KEY
ai_litellm_master_key=

# Woodpecker secret name:  ai_litellm_salt_key
# Used for:               LiteLLM DB encryption key — DO NOT change after first run
# Env var in .env:        LITELLM_SALT_KEY
ai_litellm_salt_key=

# Woodpecker secret name:  ai_litellm_db_password
# Used for:               LiteLLM PostgreSQL password (embedded in DATABASE_URL)
# Env var in .env:        POSTGRES_PASSWORD / DATABASE_URL
ai_litellm_db_password=

# Woodpecker secret name:  ai_oauth_client_id
# Used for:               Authentik OAuth2 client ID for Open-WebUI
# Env var in .env:        OAUTH_CLIENT_ID
ai_oauth_client_id=

# Woodpecker secret name:  ai_oauth_client_secret
# Used for:               Authentik OAuth2 client secret for Open-WebUI
# Env var in .env:        OAUTH_CLIENT_SECRET
ai_oauth_client_secret=

# Woodpecker secret name:  ai_webui_secret_key
# Used for:               Open-WebUI session signing key
# Env var in .env:        WEBUI_SECRET_KEY
ai_webui_secret_key=

# Woodpecker secret name:  ai_open_webui_db_url
# Used for:               Open-WebUI PostgreSQL connection string (contains password)
# Env var in .env:        OPEN_WEBUI_DATABASE_URL
ai_open_webui_db_url=

# Woodpecker secret name:  ai_mcpo_api_key
# Used for:               MCPO MCP proxy API key
# Env var in .env:        MCPO_API_KEY
ai_mcpo_api_key=

# ── NON-SECRETS (safe in compose file or .env) ────────────────────────────────

# AWS_REGION_NAME                    AWS region (us-east-2)
# LITELLM_MODIFY_PARAMS              Boolean flag (True)
# WEBUI_URL                          Open-WebUI public URL
# ENABLE_OAUTH_SIGNUP                Boolean flag
# OAUTH_MERGE_ACCOUNTS_BY_EMAIL      Boolean flag
# OAUTH_PROVIDER_NAME                Display name (Authentik)
# OPENID_PROVIDER_URL                Authentik OIDC discovery URL
# OAUTH_SCOPES                       OIDC scopes
# OPENID_REDIRECT_URI                OAuth callback URL

# ── Woodpecker provision-secrets case entry ───────────────────────────────────
# Add this to the provision-secrets step in .woodpecker.yml:
#
#   ai)
#     create_or_update_secret "ai_aws_access_key_id"     "$AI_AWS_ACCESS_KEY_ID"
#     create_or_update_secret "ai_aws_secret_access_key" "$AI_AWS_SECRET_ACCESS_KEY"
#     create_or_update_secret "ai_litellm_master_key"    "$AI_LITELLM_MASTER_KEY"
#     create_or_update_secret "ai_litellm_salt_key"      "$AI_LITELLM_SALT_KEY"
#     create_or_update_secret "ai_litellm_db_password"   "$AI_LITELLM_DB_PASSWORD"
#     create_or_update_secret "ai_oauth_client_id"       "$AI_OAUTH_CLIENT_ID"
#     create_or_update_secret "ai_oauth_client_secret"   "$AI_OAUTH_CLIENT_SECRET"
#     create_or_update_secret "ai_webui_secret_key"      "$AI_WEBUI_SECRET_KEY"
#     create_or_update_secret "ai_open_webui_db_url"     "$AI_OPEN_WEBUI_DB_URL"
#     create_or_update_secret "ai_mcpo_api_key"          "$AI_MCPO_API_KEY"
#     ;;