# vaultwarden Stack — Secrets Reference
# Source: vaultwarden.env
#
# Add SECRET values to Woodpecker at:
#   https://woodpecker.bryanmail.net
#   homelab/compose-files → Settings → Secrets
#
# ⚠️  HIGH VALUE TARGET: Vaultwarden stores all passwords for the household.
#     Treat the admin token and database URL with extreme care.
#     Ensure you have an offline backup of the Vaultwarden data volume
#     before making any changes to this stack.

# ── SECRETS (add to Woodpecker) ───────────────────────────────────────────────

# Woodpecker secret name:  vaultwarden_admin_token
# Used for:               Vaultwarden admin panel access token (Argon2id hash)
#                         Generate with: vaultwarden hash --preset owasp
#                         Store the full $argon2id$... hash string
# Env var in .env:        ADMIN_TOKEN
vaultwarden_admin_token=

# Woodpecker secret name:  vaultwarden_database_url
# Used for:               Vaultwarden PostgreSQL connection string (contains password)
#                         Store the full postgresql://... URL
# Env var in .env:        DATABASE_URL
vaultwarden_database_url=

# ── NON-SECRETS (safe in compose file or .env) ────────────────────────────────

# VAULTWARDEN_RULE    Traefik routing rule (multi-hostname expression)

# ── Woodpecker provision-secrets case entry ───────────────────────────────────
#
#   vaultwarden)
#     create_or_update_secret "vaultwarden_admin_token"   "$VAULTWARDEN_ADMIN_TOKEN"
#     create_or_update_secret "vaultwarden_database_url"  "$VAULTWARDEN_DATABASE_URL"
#     ;;