{{- if not .Values.n8n.existingSecret -}}
{{- $secretName := include "n8n.fullname" . -}}
{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName }}
  labels:
    {{- include "n8n.labels" . | nindent 4 }}
  annotations:
    helm.sh/resource-policy: keep
type: Opaque
data:
  {{- if .Values.n8n.encryptionKey }}
  encryption-key: {{ .Values.n8n.encryptionKey | b64enc | quote }}
  {{- else if $existing }}
  encryption-key: {{ index $existing.data "encryption-key" }}
  {{- else }}
  encryption-key: {{ randAlphaNum 32 | b64enc | quote }}
  {{- end }}
  {{- if and .Values.n8n.basicAuth.enabled (not .Values.n8n.basicAuth.existingSecret) }}
  {{- if .Values.n8n.basicAuth.password }}
  basic-auth-password: {{ .Values.n8n.basicAuth.password | b64enc | quote }}
  {{- else if $existing }}
  basic-auth-password: {{ index $existing.data "basic-auth-password" | default (randAlphaNum 16 | b64enc) }}
  {{- else }}
  basic-auth-password: {{ randAlphaNum 16 | b64enc | quote }}
  {{- end }}
  {{- end }}
  {{- if and (eq .Values.n8n.database.type "postgresdb") (not .Values.n8n.database.postgresdb.existingSecret) }}
  postgres-password: {{ .Values.n8n.database.postgresdb.password | b64enc | quote }}
  {{- end }}
{{- end }}