# guacamole Stack — Secrets Reference
# Source: guacamole.env
#
# Add SECRET values to Woodpecker at:
#   https://woodpecker.bryanmail.net
#   homelab/compose-files → Settings → Secrets

# ── SECRETS (add to Woodpecker) ───────────────────────────────────────────────

# Woodpecker secret name:  guacamole_ldap_bind_password
# Used for:               LDAP service account password for directory searches
# Env var in .env:        LDAP_SEARCH_BIND_PASSWORD
guacamole_ldap_bind_password=

# Woodpecker secret name:  guacamole_oidc_client_secret
# Used for:               Authentik OpenID Connect client secret
# Env var in .env:        OPENID_CLIENT_SECRET
guacamole_oidc_client_secret=

# Woodpecker secret name:  guacamole_db_password
# Used for:               Guacamole PostgreSQL database password
# Env var in .env:        POSTGRESQL_PASSWORD
guacamole_db_password=

# ── NON-SECRETS (safe in compose file or .env) ────────────────────────────────

# GUACD_HOSTNAME                  guacd container hostname
# GUACD_PORT                      guacd port (4822)
# LDAP_CONFIG_BASE_DN             LDAP base DN
# LDAP_HOSTNAME                   LDAP server hostname
# LDAP_USER_BASE_DN               LDAP user search base
# LDAP_PORT                       LDAP port (636)
# LDAP_SEARCH_BIND_DN             LDAP service account DN (AVB@bryanmail.net)
# OPENID_AUTHORIZATION_ENDPOINT   Authentik authorization URL
# OPENID_JWKS_ENDPOINT            Authentik JWKS URL
# OPENID_ISSUER                   Authentik issuer URL
# OPENID_CLIENT_ID                Authentik client ID (not sensitive)
# OPENID_REDIRECT_URI             OAuth callback URL
# POSTGRESQL_HOSTNAME             PostgreSQL hostname
# POSTGRESQL_PORT                 PostgreSQL port
# POSTGRESQL_DATABASE             Database name (guacamole_db)
# POSTGRESQL_USER                 Database username (guacamole)
# GUACAMOLE_HOST                  Traefik hostname

# ── Woodpecker provision-secrets case entry ───────────────────────────────────
#
#   guacamole)
#     create_or_update_secret "guacamole_ldap_bind_password" "$GUACAMOLE_LDAP_BIND_PASSWORD"
#     create_or_update_secret "guacamole_oidc_client_secret" "$GUACAMOLE_OIDC_CLIENT_SECRET"
#     create_or_update_secret "guacamole_db_password"        "$GUACAMOLE_DB_PASSWORD"
#     ;;