{{- /*
The 1Password items this chart materializes. Each is rendered only when its
op:// path is set, because two of the three are genuinely optional.

WHAT THE FIELD NAMES ARE AND WHY THEY ARE NOT FREE-FORM: the operator
materializes one Secret key per FIELD of the item, and these templates mount or
reference those keys by name. An item without the expected field leaves the
container in CreateContainerConfigError. NOTES.txt lists them for the installer.

AND THE LIMIT THAT CANNOT BE CLOSED: a change to the CONTENT of any of these
items does not restart anything. Helm never sees a secret's value - the
operator fills the Secret in-cluster after rendering - so there is nothing to
hash. What this chart does cover is the op:// PATH, through checksum/secret-ref
on the pod template (see the StatefulSet): repointing one of the values below
at a different vault item does roll the pods. For a content change, and after
rotating a password inside the item, the manual step is
  kubectl -n <ns> rollout restart statefulset/<release>-stalwart-<group>-sfs
for every group. The 1Password operator's auto-restart annotation is NOT set
here and must not be: verified against operator 1.12.0 it enumerates
Deployments only, so on a StatefulSet it is a silent no-op that advertises a
guarantee it does not provide (README, guideline 9).
*/ -}}
{{- if .Values.secrets.dataStoreSecretRef }}
apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
  name: {{ include "stalwart.fullname" . }}-datastore-secret
  labels:
    app: {{ include "stalwart.fullname" . }}
spec:
  # Must carry the field: password
  #
  # Only the password. The data store's username is dataStore.postgres.username
  # and is rendered into the ConfigMap, because authUsername is a plain String
  # on the DataStore object while authSecret is a SecretKeyOptional - upstream
  # offers a secret form for one and not the other.
  itemPath: {{ .Values.secrets.dataStoreSecretRef }}
{{- end }}
{{- if .Values.secrets.recoveryAdminSecretRef }}
---
apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
  name: {{ include "stalwart.fullname" . }}-recovery-admin-secret
  labels:
    app: {{ include "stalwart.fullname" . }}
spec:
  # Must carry the field: recovery-admin
  #
  # Holding the COMPLETE value of STALWART_RECOVERY_ADMIN as one string,
  # "admin:<password>". The chart deliberately does not assemble it from a
  # username and a password field: the upstream parser splits on the first ":"
  # and drops the entry when either half is empty, so a half-filled item would
  # silently mean "no recovery admin" rather than failing - and this credential
  # is a back door that logs in regardless of directory state, which is not
  # something to be uncertain about in either direction.
  itemPath: {{ .Values.secrets.recoveryAdminSecretRef }}
{{- end }}
{{- if .Values.secrets.s3SecretRef }}
---
apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
  name: {{ include "stalwart.fullname" . }}-s3-secret
  labels:
    app: {{ include "stalwart.fullname" . }}
spec:
  # Must carry the fields: access-key, secret-key
  #
  # This chart does not configure the blob store - that object lives in the
  # database. It exposes both fields to the container as {{ include "stalwart.env.s3AccessKey" . }}
  # and {{ include "stalwart.env.s3SecretKey" . }}, so the BlobStore object created in the WebUI can
  # reference them by name instead of storing the credentials in the database.
  itemPath: {{ .Values.secrets.s3SecretRef }}
{{- end }}