# postgresql Stack — Secrets Reference
# Source: postgresql.env
#
# Add SECRET values to Woodpecker at:
#   https://woodpecker.bryanmail.net
#   homelab/compose-files → Settings → Secrets
#
# ⚠️  CRITICAL: This is the highest-risk stack in the homelab.
#     The PostgreSQL master password is used by nearly every other stack
#     (ai, auth, entertainment, guacamole, mealie, n8n, productivity,
#     security, vaultwarden, woodpecker).
#
#     Migrate this stack LAST. Any misconfiguration will cascade and
#     take down multiple services simultaneously. Ensure you have a
#     working backup before making any changes.

# ── SECRETS (add to Woodpecker) ──────────────────────────────────────────

# Woodpecker secret name:  postgresql_password
# Used for:                PostgreSQL master password (PGadmin superuser)
#                          ⚠️  Used by nearly every other stack
# Env var in .env:         POSTGRES_USER
postgresql_password=

# Woodpecker secret name:  postgresql_pgadmin_password
# Used for:                PGAdmin web UI login password
# Env var in .env:         PGADMIN_DEFAULT_PASSWORD
postgresql_pgadmin_password=

# Woodpecker secret name:  postgresql_replication_password
# Used for:                Patroni streaming-replication role password
#                          (used by patroni-0/patroni-1 for pg_basebackup +
#                          WAL streaming between primary and standby)
# Added:                   ADR-0001 HA build-out (Phase 1)
postgresql_replication_password=

# Woodpecker secret name:  postgresql_patroni_password
# Used for:                Patroni REST API basic-auth password (:8008)
#                          (used by HAProxy health checks and patronictl)
# Added:                   ADR-0001 HA build-out (Phase 1)
postgresql_patroni_password=

# ── NON-SECRETS (safe in compose file or .env) ───────────────────────────

# POSTGRES_USER              Master PostgreSQL username (PGadmin)
# PGADMIN_DEFAULT_EMAIL      PGAdmin login email
# DATABASUS_HOST             Traefik hostname for pgAdmin
# PGADMIN_HOST               Traefik hostname for pgAdmin UI

# ── Woodpecker provision-secrets case entry ──────────────────────────────
#
#   postgresql)
#     create_or_update_secret "postgresql_password"             "$POSTGRESQL_PASSWORD"
#     create_or_update_secret "postgresql_pgadmin_password"     "$POSTGRESQL_PGADMIN_PASSWORD"
#     create_or_update_secret "postgresql_replication_password" "$POSTGRESQL_REPLICATION_PASSWORD"
#     create_or_update_secret "postgresql_patroni_password"     "$POSTGRESQL_PATRONI_PASSWORD"
#     ;;