{{- if and (.Values.signing.enabled) (not .Values.secrets.gpg.existingSecret.enabled) -}}
{{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}}
  {{- fail "Either specify `signing.privateKey`, `signing.existingSecret` or `secrets.gpg.existingSecret`" -}}
{{- end }}
{{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}}
apiVersion: v1
kind: Secret
metadata:
  {{- with (include "gitea.secret.gpg.annotations" .) }}
  annotations:
    {{- . | nindent 4 }}
  {{- end }}
  labels:
    {{- include "gitea.secret.gpg.labels" . | nindent 4 }}
  name: {{ include "gitea.secret.gpg.name" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
type: Opaque
data:
  privateKey: {{ .Values.signing.privateKey | b64enc }}
{{- end }}
{{- end }}