feat: add treatvault block and TreatVault label constants

validate.go

@@ -14,7 +14,15 @@ func NormalizeHostname(hostname string) string {
 	return strings.TrimSuffix(strings.ToLower(strings.TrimSpace(hostname)), ".")
 }
 
-const DockerSecretPrefix = "barkstack_"
+const (
+	DockerSecretPrefix        = "barkstack_"
+	TreatVaultManagedLabel    = "io.barkstack.treatvault"
+	TreatVaultSecretNameLabel = "io.barkstack.treatvault.name"
+	TreatVaultVaultIDLabel    = "io.barkstack.treatvault.vault"
+	TreatVaultRevisionLabel   = "io.barkstack.treatvault.revision"
+	TreatVaultConsumerLabel   = "io.barkstack.treatvault.secrets"
+	TreatVaultNamesLabel      = "io.barkstack.treatvault.names"
+)
 
 var secretReferencePattern = regexp.MustCompile(`^[a-z][a-z0-9_]*$`)
 
@@ -40,6 +48,14 @@ func (c Config) Validate() error {
 	if len(c.Databases) == 0 {
 		errs = append(errs, errors.New("at least one database route is required"))
 	}
+	if c.TreatVault != nil {
+		if strings.TrimSpace(c.TreatVault.File) == "" {
+			errs = append(errs, errors.New("treatvault file is required"))
+		}
+		if !ValidSecretReference(c.TreatVault.IdentitySecret) {
+			errs = append(errs, fmt.Errorf("treatvault identity_secret %q must start with a lowercase letter, contain only lowercase letters, digits, or underscores, and be at most 54 characters", c.TreatVault.IdentitySecret))
+		}
+	}
 
 	seenHostnames := make(map[string]string, len(c.Databases))
 	seenNames := make(map[string]struct{}, len(c.Databases))
@@ -67,6 +83,9 @@ func (c Config) Validate() error {
 			if err := validatePostgres(*database.Postgres); err != nil {
 				errs = append(errs, fmt.Errorf("database %q: postgres: %w", name, err))
 			}
+			if c.TreatVault != nil && database.Postgres.PasswordSecret == c.TreatVault.IdentitySecret {
+				errs = append(errs, fmt.Errorf("database %q: password_secret must not reference the TreatVault identity secret", name))
+			}
 		} else if strings.TrimSpace(database.Upstream) == "" {
 			errs = append(errs, fmt.Errorf("database %q: upstream or postgres is required", name))
 		} else if err := validateAddress(database.Upstream); err != nil {