{{- include "certctl.validateAuthType" . }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "certctl.fullname" . }}-server
  labels:
    {{- include "certctl.labels" . | nindent 4 }}
    app.kubernetes.io/component: server
type: Opaque
stringData:
  # Bundle B / Audit M-018 (PCI-DSS Req 4): sslmode wired from
  # postgresql.tls.mode. Default "disable" preserves the in-cluster
  # Helm-bundled-Postgres path; operators on PCI-scoped clusters set
  # postgresql.tls.mode to require / verify-ca / verify-full.
  database-url: {{ include "certctl.databaseURL" . | quote }}
  {{- if and (eq .Values.server.auth.type "api-key") .Values.server.auth.apiKey }}
  api-key: {{ .Values.server.auth.apiKey | quote }}
  {{- end }}
  {{- if .Values.server.smtp.enabled }}
  smtp-password: {{ .Values.server.smtp.password | quote }}
  {{- end }}
