From f83201f976ef2b1044e48657734d95f28b961b70 Mon Sep 17 00:00:00 2001
From: Demisu <19689915+Demisu@users.noreply.github.com>
Date: Sun, 27 Sep 2026 13:21:03 +0200
Subject: [PATCH] fix(helm): quote Secret stringData values

---
 charts/trek/templates/secret.yaml             | 20 +++++++++----------
 .../unit/app-config/config-templates.test.ts  |  4 ++--
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/charts/trek/templates/secret.yaml b/charts/trek/templates/secret.yaml
index 0277285f7..de5ce8222 100644
--- a/charts/trek/templates/secret.yaml
+++ b/charts/trek/templates/secret.yaml
@@ -46,32 +46,32 @@ metadata:
 type: Opaque
 stringData:
   {{- if and $existingSecret $existingSecret.data }}
-  {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ index $existingSecret.data (.Values.existingSecretKey | default "ENCRYPTION_KEY") | b64dec }}
+  {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ index $existingSecret.data (.Values.existingSecretKey | default "ENCRYPTION_KEY") | b64dec | quote }}
   {{- else }}
-  {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ randAlphaNum 32 }}
+  {{ .Values.existingSecretKey | default "ENCRYPTION_KEY" }}: {{ randAlphaNum 32 | quote }}
   {{- end }}
   {{- if .Values.secretEnv.ADMIN_EMAIL }}
-  ADMIN_EMAIL: {{ .Values.secretEnv.ADMIN_EMAIL }}
+  ADMIN_EMAIL: {{ .Values.secretEnv.ADMIN_EMAIL | quote }}
   {{- end }}
   {{- if .Values.secretEnv.ADMIN_PASSWORD }}
-  ADMIN_PASSWORD: {{ .Values.secretEnv.ADMIN_PASSWORD }}
+  ADMIN_PASSWORD: {{ .Values.secretEnv.ADMIN_PASSWORD | quote }}
   {{- end }}
   {{- if .Values.secretEnv.OIDC_CLIENT_SECRET }}
-  OIDC_CLIENT_SECRET: {{ .Values.secretEnv.OIDC_CLIENT_SECRET }}
+  OIDC_CLIENT_SECRET: {{ .Values.secretEnv.OIDC_CLIENT_SECRET | quote }}
   {{- end }}
   {{- if .Values.secretEnv.UNSPLASH_ACCESS_KEY }}
-  UNSPLASH_ACCESS_KEY: {{ .Values.secretEnv.UNSPLASH_ACCESS_KEY }}
+  UNSPLASH_ACCESS_KEY: {{ .Values.secretEnv.UNSPLASH_ACCESS_KEY | quote }}
   {{- end }}
   {{- if .Values.secretEnv.PLACES_API_KEY }}
-  PLACES_API_KEY: {{ .Values.secretEnv.PLACES_API_KEY }}
+  PLACES_API_KEY: {{ .Values.secretEnv.PLACES_API_KEY | quote }}
   {{- end }}
   {{- if .Values.secretEnv.AMAP_API_KEY }}
-  AMAP_API_KEY: {{ .Values.secretEnv.AMAP_API_KEY }}
+  AMAP_API_KEY: {{ .Values.secretEnv.AMAP_API_KEY | quote }}
   {{- end }}
   {{- if .Values.secretEnv.AMAP_API_SECRET }}
-  AMAP_API_SECRET: {{ .Values.secretEnv.AMAP_API_SECRET }}
+  AMAP_API_SECRET: {{ .Values.secretEnv.AMAP_API_SECRET | quote }}
   {{- end }}
   {{- if .Values.secretEnv.VAPID_PRIVATE_KEY }}
-  VAPID_PRIVATE_KEY: {{ .Values.secretEnv.VAPID_PRIVATE_KEY }}
+  VAPID_PRIVATE_KEY: {{ .Values.secretEnv.VAPID_PRIVATE_KEY | quote }}
   {{- end }}
 {{- end }}
diff --git a/server/tests/unit/app-config/config-templates.test.ts b/server/tests/unit/app-config/config-templates.test.ts
index d58af1649..478333489 100644
--- a/server/tests/unit/app-config/config-templates.test.ts
+++ b/server/tests/unit/app-config/config-templates.test.ts
@@ -74,7 +74,7 @@ describe('the Places and Amap switches in the templates', () => {
     for (const name of ['PLACES_API_KEY', 'AMAP_API_KEY', 'AMAP_API_SECRET']) {
       expect(helmValues).toContain(`  ${name}: ""`);
       expect(helmSecret).toContain(`${name}: {{ .Values.secretEnv.${name} | b64enc | quote }}`);
-      expect(helmSecret).toContain(`${name}: {{ .Values.secretEnv.${name} }}`);
+      expect(helmSecret).toContain(`${name}: {{ .Values.secretEnv.${name} | quote }}`);
       expect(helmDeployment).toContain(`- name: ${name}\n              valueFrom:\n                secretKeyRef:`);
       expect(helmDeployment).toContain(`key: ${name}\n                  optional: true`);
       expect(helmConfigMap).not.toContain(name);
@@ -134,7 +134,7 @@ describe('the Web Push keys in the templates', () => {
     const name = 'VAPID_PRIVATE_KEY';
     expect(helmValues).toContain(`  ${name}: ""`);
     expect(helmSecret).toContain(`${name}: {{ .Values.secretEnv.${name} | b64enc | quote }}`);
-    expect(helmSecret).toContain(`${name}: {{ .Values.secretEnv.${name} }}`);
+    expect(helmSecret).toContain(`${name}: {{ .Values.secretEnv.${name} | quote }}`);
     expect(helmDeployment).toContain(`- name: ${name}\n              valueFrom:\n                secretKeyRef:`);
     expect(helmDeployment).toContain(`key: ${name}\n                  optional: true`);
     expect(helmConfigMap).not.toContain(name);