[twk3]

Owner: @twk3

What and why

Three values are listed under Required in the configuration reference, default to "", and were each read behind a {{- if ... }}. The conditional meant a default helm install templated cleanly and dropped the environment variable instead of failing.

• currents.apiInternalToken.secretName — the server ran with no API_SECRET, which packages/api reads as ''. The director also lost API_URL, so run fail-fast and CI cancellation were silently inert.
• currents.betterAuth.secretName, currents.rootUser.password.secretName — validateOnPremMode lists BETTER_AUTH_SECRET and ON_PREM_PASSWORD among the fields the server refuses to start without, so these crash-looped with the reason only in a container log.

Each lookup now goes through required, matching the chart's existing inline style (currents.sso.saml.metadataSecretName, currents.email.ses.region). API_URL leaves the director's conditional with the token, since it has no meaning without it.

values.yaml and the regenerated docs/configuration.md say what each secret is for, that templating fails without it, and how to generate one.

How it was tested

• charts/currents/ci/lint-values.yaml sets all three and the lint workflow creates the matching secrets, so ct lint and ct install exercise the populated path.
• Rendered both deployment templates with placeholders substituted for the Go actions and confirmed the result still parses as YAML with ON_PREM_PASSWORD, BETTER_AUTH_SECRET and API_SECRET present unconditionally.
• Not run: helm template and helm-docs. The sandbox proxy blocks get.helm.sh and has no Docker daemon for scripts/build-docs.sh, so the docs/configuration.md rows are hand-written to match helm-docs' output (comment lines joined with single spaces, checked against the existing multi-line currents.redis.host row). Please let the Docs check and Lint and Test Charts workflows confirm both before merging.

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[baz-reviewer]

Baz Summary

Fail Helm templating when required authentication secret names are unset, ensuring the server and director receive mandatory credentials. Update chart values and configuration documentation to explain each secret’s purpose, failure behavior, and generation command.

Topics

Topic	Details
Required secrets	Require API_SECRET, BETTER_AUTH_SECRET, and ON_PREM_PASSWORD during deployment rendering, preventing empty credentials and ensuring director-to-server authentication and server startup requirements are enforced. Modified files (2) charts/currents/templates/director/deployment.yaml charts/currents/templates/server/deployment.yaml Latest Contributors(2) User Commit Date noreply@anthropic.com fix: require currents.... November 02, 2026 dj@currents.dev feat: expose the app-c... October 13, 2026
Secret documentation	Document the required secret behavior, credential purposes, and openssl commands for generating valid values. Modified files (2) charts/currents/values.yaml docs/configuration.md Latest Contributors(2) User Commit Date noreply@anthropic.com fix: require currents.... November 02, 2026 dj@currents.dev release: 1.0.1 [] (#69) October 28, 2026

---

Merger   ✅ Ready to Merge

The chart now unconditionally requires all three secrets and documents the behavior; CI ran and there are no unresolved discussions or diff-confirmed blockers.

---

  _{Activate Skill Maintainer to keep your skills up to date}

  _{This PR would have been improved with Baz Planner - Try it now}