{{- if not .Values.secrets.existingSecret }}
{{- $pgPassword := include "momentum.postgresPassword" . }}
{{- $pgHost := include "momentum.postgresName" . }}
{{- $databaseUrl := printf "postgresql://%s:%s@%s:%v/%s" .Values.postgres.username $pgPassword $pgHost .Values.postgres.port .Values.postgres.database }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "momentum.fullname" . }}-secrets
  labels:
    {{- include "momentum.labels" . | nindent 4 }}
type: Opaque
stringData:
  # Consumed by the Postgres StatefulSet.
  POSTGRES_PASSWORD: {{ $pgPassword | quote }}
  # Consumed by the app + CronJobs (storage/db_pg.py prefers DATABASE_URL).
  DATABASE_URL: {{ $databaseUrl | quote }}
  # Alpaca paper broker (the client reads both the ALPACA_* and APCA_* names).
  ALPACA_API_KEY: {{ .Values.secrets.alpacaApiKey | quote }}
  ALPACA_SECRET_KEY: {{ .Values.secrets.alpacaSecretKey | quote }}
  APCA_API_KEY_ID: {{ .Values.secrets.alpacaApiKey | quote }}
  APCA_API_SECRET_KEY: {{ .Values.secrets.alpacaSecretKey | quote }}
  APCA_API_BASE_URL: {{ .Values.secrets.alpacaBaseUrl | quote }}
  {{- range $k, $v := .Values.secrets.schwab }}
  {{ $k }}: {{ $v | quote }}
  {{- end }}
{{- end }}