---
{{- if not .Values.secrets.existingSecret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "oxicloud.fullname" . }}-secret
  labels:
    {{- include "oxicloud.labels" . | nindent 4 }}
type: Opaque
data:
  {{- if .Values.secrets.jwtSecret }}
  OXICLOUD_JWT_SECRET: {{ .Values.secrets.jwtSecret | b64enc | quote }}
  {{- end }}
  {{- if .Values.wopi.enabled }}
  {{- /* Existing secret retrieval to keep same password during upgrade */-}}
  {{- $secretName := printf "%s-secret" (include "oxicloud.fullname" .) }}
  {{- $existingSecret := lookup "v1" "Secret" .Release.Namespace $secretName }}
  {{- $password := "" }}
  {{- if and $existingSecret (hasKey $existingSecret.data "WOPI_ADMIN_PASSWORD") }}
    {{- $password = index $existingSecret.data "WOPI_ADMIN_PASSWORD" }}
  {{- else }}
    {{- $password = .Values.wopi.collabora.admin.password | default (randAlphaNum 20) | b64enc }}
  {{- end }}
  WOPI_ADMIN_PASSWORD: {{ $password | quote }}
  {{- end }}
{{- end }}