{{- $needsSecret := false -}}
{{- if not .Values.config.secretKey.existingSecret -}}
  {{- $needsSecret = true -}}
{{- end -}}
{{- if not .Values.postgresql.external.existingSecret -}}
  {{- $needsSecret = true -}}
{{- end -}}
{{- if and .Values.redis.external.password (not .Values.redis.external.existingSecret) -}}
  {{- $needsSecret = true -}}
{{- end -}}
{{- if and .Values.config.admin.user (not .Values.config.admin.existingSecret) -}}
  {{- $needsSecret = true -}}
{{- end -}}
{{- if and .Values.config.email.host .Values.config.email.user (not .Values.config.email.existingSecret) -}}
  {{- $needsSecret = true -}}
{{- end -}}

{{- if $needsSecret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "paperless-ngx.fullname" . }}-secrets
  labels:
    {{- include "paperless-ngx.labels" . | nindent 4 }}
type: Opaque
data:
  {{- if not .Values.config.secretKey.existingSecret }}
  {{ .Values.config.secretKey.secretKey | default "secret-key" }}: {{ .Values.config.secretKey.value | default "change-me-paperless-secret-key-at-least-32-characters-long" | b64enc }}
  {{- end }}
  {{- if not .Values.postgresql.external.existingSecret }}
  {{ .Values.postgresql.external.passwordKey | default "postgresql-password" }}: {{ .Values.postgresql.external.password | default "paperless" | b64enc }}
  {{- end }}
  {{- if and .Values.redis.external.password (not .Values.redis.external.existingSecret) }}
  {{ .Values.redis.external.passwordKey | default "redis-password" }}: {{ .Values.redis.external.password | b64enc }}
  {{- end }}
  {{- if and .Values.config.admin.user (not .Values.config.admin.existingSecret) }}
  {{ .Values.config.admin.userKey | default "admin-user" }}: {{ .Values.config.admin.user | b64enc }}
  {{ .Values.config.admin.passwordKey | default "admin-password" }}: {{ .Values.config.admin.password | default "changeme" | b64enc }}
  {{- end }}
  {{- if and .Values.config.email.host .Values.config.email.user (not .Values.config.email.existingSecret) }}
  {{ .Values.config.email.userKey | default "email-user" }}: {{ .Values.config.email.user | b64enc }}
  {{ .Values.config.email.passwordKey | default "email-password" }}: {{ .Values.config.email.password | default "" | b64enc }}
  {{- end }}
{{- end }}