[jacobecox]

Targeted edits to 32 existing template pages. In each template's latest version, credentials moved out of plaintext Helm values and into prerequisite secrets that you create before installing.

Scope rule (maintainer instruction): each page changes only what concerns the required prerequisite secrets, plus removal of the plaintext credential values. Nothing else on the page was touched, so the diff stays reviewable. This covers Prerequisites (secret, type, keys, create command), the Installation --set line and --version bump, Configuration keys, the credential rows in Connecting, the Upgrading-from-X steps (create the secrets with the current values, then upgrade), rotation steps (all end in cpln workload force-redeployment), credential bullets in Important Notes, and removal of secret rows the chart no longer creates from "What Gets Created". Unrelated stale content was left as it is. There is one commit per page, plus one review-fix commit.

Pages

• Database-credentials change (21): chatwoot, docmost, fusionauth, gitea, glitchtip, grafana, guacamole, keycloak, langfuse, listmonk, metabase, n8n, nocodb, polaris, temporal, tooljet, twenty, umami, unleash, infisical, litellm. Database (and, where bundled, Redis/ClickHouse) credentials are now prerequisite dictionary secrets.
• ghost, airflow, sftpgo, infisical, litellm:
  • ghost: MySQL credentials and the root password are now two secrets.
  • airflow: the metadata DB credentials are a secret.
  • sftpgo: SFTP user passwords and S3-compatible keys are secrets.
  • infisical and litellm: the Redis password can now come from a secret (fromSecret).
• cpln-task-runner, tyk, searxng, cdc-pipeline:
  • cpln-task-runner and tyk: the Redis and Sentinel passwords are secrets.
  • searxng: the Redis password and the /metrics password are secrets.
  • cdc-pipeline: one eight-key credentials secret replaces the database and Kafka passwords.
• kafka, redis, redis-cluster, nats:
  • kafka, redis and redis-cluster keep an inline option; the secret is documented as the recommended path.
  • nats: authentication is new, and optional.

New headings (for wizard docs: anchors)

• searxng: Metrics Password
• kafka: Credentials (plus REST Proxy Credentials and Kafka Connect Credentials)
• nats: Authentication (plus Rotating the Credentials)

Near-scope edits, deliberate

• ghost drops mysql.enablePhpMyAdmin, which 1.3.0 now refuses at render.

• sftpgo names the alpine-slim image the credential start script requires (/bin/sh + awk).

• cdc-pipeline jumps 1.0.4 → 1.1.1 and carries the 1.1.x content that comes with the version bump. Without it the upgrade path would be wrong:

  • the wal_level = logical switch steps and the Debezium failover-slot check;
  • acl.superUsers now includes User:debezium;
  • Kafbat UI is off by default, and the exporter and orchestrator are off;
  • walLevel moved to postgres-highly-available.walLevel;
  • the bundled-version line.

  All of it comes from the 1.1.1 README and Chart.yaml.

• glitchtip: "on Control Plane" was trimmed from the frontmatter description so it stays under 300 characters.

Verification

• Review: PASS after one revision round, which fixed three tables broken by blank lines, stale nocodb secret text and some wording.
• Checked against each latest chart:
  • secret names, keys and types, compared with the README, values.yaml, the fail defines and catalog.yaml prerequisites;
  • error strings quoted on the pages, compared with the fail text;
  • old defaults cited in upgrade steps, compared with the previous versions' values.yaml.
• Audits on all 32 pages:
  • audit_cli.py: 0 errors.
  • audit_semantic.py: no ERROR/WARN.
  • audit_skeleton.py: no new findings compared with origin/main.
  • mintlify broken-links: clean.
  • Every in-page anchor and every wizard docs: anchor resolves.
• Not run: render-check.sh. mintlify dev fails at startup on the repo's OpenAPI file (/components/schemas/gvc: must have required property '$ref'). That is unrelated to these .mdx edits.
• cpln secret edit and cpln workload stop/start are used on some pages. They are real verbs (checked against --help); adding them to the automator's CLI reference is a separate change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WZ5WWhTn9mEkPY7cLt1cr4

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
controlplanecorporation	🔴 Failed	–	Oct 22, 2026, 8:48 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[github-actions]

No description provided.

[github-actions]

No description provided.

[github-actions]

No description provided.