++ wire zitadel and camunda vault secrets from real postgres passwords

infrastructure-secrets.yaml

@@ -3343,16 +3343,66 @@ environments:
                 infrastructure:
                     zitadel:
                         postgresql:
-                            enabled: ENC[AES256_GCM,data:fplysw==,iv:wvMF0Ci+qMHR2edSh9R7tlIo3FFUO6xMfN3LMfiUdJU=,tag:qsIQG11ExHZ+hPg6EwVnKQ==,type:bool]
+                            enabled: ENC[AES256_GCM,data:tUiXY8k=,iv:k+kCNn0FzHAJPoQVNGqd0Y6IVeolzVKuB4EQBRWouZE=,tag:dvF8Fl+h63oysx9aJdnhHQ==,type:bool]
-                            generate: ENC[AES256_GCM,data:ZJXWPQ==,iv:lWZh+7jo6+2+dgomSrXemPYKDx90q4X3xlob7gHlJ2s=,tag:GKbfMJHXyqzH7EejrP0EfA==,type:bool]
                     camunda:
                         postgresql:
-                            enabled: ENC[AES256_GCM,data:vnof0w==,iv:h2PIwpJSD/CEZi2vWVVJoRW6pQG5Oxo07Y9n0zmpXoQ=,tag:3qK5gZFwB8kUYb6It70exQ==,type:bool]
+                            enabled: ENC[AES256_GCM,data:vceGfUo=,iv:pAil/xNMzxPAPKXEN+My4sfdhG1XFEa3iHKuNaUzR28=,tag:HnSyvbXvwSDN5Y05qCQ4nA==,type:bool]
-                            generate: ENC[AES256_GCM,data:j65EOw==,iv:B7h/PaVk+R/73DhFtEmAdD400dj+U29t1GXYDcpO63A=,tag:SKoVhgINr1yQhGqOqGbwtw==,type:bool]
                         keycloak_admin:
-                            enabled: ENC[AES256_GCM,data:DSjxig==,iv:0JRmblA+hbldF+2KjWq6jLF1uLUnRpLVsG0mvQ30S48=,tag:noXT8L5vkpatfQgdfmyPcw==,type:bool]
+                            enabled: ENC[AES256_GCM,data:uhB8K0U=,iv:vSPbA9KHUFJvMSXjPqcYxtWFmfdKfdhHCUhcNGW+h1A=,tag:OgSP6tW8Rv1FAinJTwdofg==,type:bool]
-                            generate: ENC[AES256_GCM,data:mrCOdw==,iv:L1fuYUXmM3zhSyIwdMw1kEklLkrGNQO9E6R5FlMZvP4=,tag:21TZqNfHcpu2+X/gcn4YaQ==,type:bool]
+        secrets:
-        secrets: []
+            - name: zitadel-postgresql
+              namespace: zitadel
+              type: database
+              sink: vault
+              vault_path: zitadel/postgresql
+              depends_on:
+                cluster: main
+                db: zitadel
+                user: zitadel
+              custom_keys:
+                password: password
+              random_keys:
+                humanPassword:
+                    length: 32
+                    special: false
+            - name: camunda-keycloak-db-staging
+              namespace: camunda
+              type: database
+              sink: vault
+              vault_path: camunda/_keycloak_db
+              depends_on:
+                cluster: main
+                db: bitnami_keycloak
+                user: bn_keycloak
+              custom_keys:
+                password: password
+            - name: camunda-postgresql
+              namespace: camunda
+              type: database
+              sink: vault
+              vault_path: camunda/postgresql
+              depends_on:
+                cluster: main
+                db: identity
+                user: identity
+              custom_keys:
+                password: identity-password
+              extra_fields:
+                keycloak-password:
+                    source_kind: secret_ref
+                    ref: vault://camunda/_keycloak_db#password
+                postgres-password:
+                    source_kind: secret_ref
+                    ref: vault://postgresql/admin#postgres-password
+            - name: camunda-keycloak-admin
+              namespace: camunda
+              type: opaque
+              sink: vault
+              vault_path: camunda/keycloak-admin
+              random_keys:
+                admin-password:
+                    length: 32
+                    special: false
 sops:
     kms: []
     gcp_kms: []
@@ -3377,8 +3427,8 @@ sops:
             U1hiSTkrMzRwMGpOeGtYNnNyNElYOE0KOHsFrj5+iMx8tIymrIhLpB8xbLaztR7J
             E+ViNs6OGeIS90qwxAD7OP9raGB/lsTfh9V/zigM8gF+OzGErF73aQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T08:36:57Z"
+    lastmodified: "2026-08-26T08:57:48Z"
-    mac: ENC[AES256_GCM,data:CsabmmH29n9KOLVw5IwTVbzyfdla33HtgLwh2nfQiH+RzoCub3o5o2jGcKyZddLtqFs+NIS0p1yOFaRrAHbZl8gyBOkBqBE8rkRx8Zh6Skvp98EhRMUKrNnjCMywIfdjibliHvYa48LvFHRvdtZjfHitKXP3rMd1SZXnzNkU5SI=,iv:L+OSZ+lsVEjOoPgBkxktIwOPm4PgP6G3sgONHPjlAAs=,tag:XC/F2VFJW9FrGQchO7F+xA==,type:str]
+    mac: ENC[AES256_GCM,data:+zLoBUSLIImG5iB7zHec622MtuPZcHjHcT9irLmA5QXBV8zVMjgQwbDICzDGJBhmFno9agSfASOCNfARdOSPrz8eWCZbw71moJ5JFf6tnT5z18VjdNz0l8/Bjv9TRF8VNsn56NcKTG/3HaC1gSLcoxNqRUqVLO6FbAoL1TZoV5Q=,iv:/MzcAma6lsp+Axj5OBWdMkf6QJ1GaWtDbE1UY0qwqhg=,tag:OrEMeoGAI4Ma9PFQrN72yg==,type:str]
     pgp: []
     encrypted_regex: ^(data)$
     version: 3.12.2

infrastructure.yaml

@@ -659,6 +659,36 @@ environments:
           password_special: false
           conn_limit: 20
 
+      - cluster_id: main
+        database:
+          name: identity
+          extensions: []
+        user:
+          name: identity
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: bitnami_keycloak
+          extensions: []
+        user:
+          name: bn_keycloak
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: zitadel
+          extensions: []
+        user:
+          name: zitadel
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
     minio: {}
     buckets: []