{{- $fullname := include "aptly.fullname" . -}}
{{- $secretName := printf "%s-credentials" $fullname -}}
{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName -}}
{{- $internalPassword := "" -}}
{{- if and $existing (hasKey $existing.data "internal-password") -}}
{{- $internalPassword = index $existing.data "internal-password" | b64dec -}}
{{- else -}}
{{- $internalPassword = randAlphaNum 32 -}}
{{- end -}}
{{- $userLines := list -}}
{{- range $name, $pass := .Values.security.auth.users -}}
{{- $userLines = append $userLines (printf "%s:%s" $name $pass) -}}
{{- end -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName }}
  labels:
    {{- include "aptly.labels" . | nindent 4 }}
  annotations:
    # Reused across `helm upgrade` (via `lookup` above) and preserved across
    # `helm uninstall` so aptly-reconcile keeps working without a manual step
    # after a reinstall. Never regenerate this key from a template — see
    # rootfs/usr/local/bin/aptly-init for why hashing must not happen here.
    helm.sh/resource-policy: keep
type: Opaque
stringData:
  internal-password: {{ $internalPassword | quote }}
  {{- if $userLines }}
  users: |
    {{- range $userLines }}
    {{ . }}
    {{- end }}
  {{- end }}