From ce9bf5b676ea3f162210dcbf01a5d771ba982c46 Mon Sep 17 00:00:00 2001
From: Viktor Barzin <vbarzin@gmail.com>
Date: Sat, 9 May 2026 11:43:01 +0000
Subject: [PATCH] postiz: wire INSTAGRAM_APP_ID/SECRET via ESO for
 IG-standalone provider

Standalone provider (instagram-standalone OAuth flow) is what the user
is trying after the FB-Login path was blocked by their Business Account
ad-policy flag. Uses modern scope names (instagram_business_*), so no
JS patch needed unlike the FB-Login provider.
---
 stacks/postiz/modules/postiz/main.tf | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/stacks/postiz/modules/postiz/main.tf b/stacks/postiz/modules/postiz/main.tf
index 67a4c4bb..d5a159f6 100644
--- a/stacks/postiz/modules/postiz/main.tf
+++ b/stacks/postiz/modules/postiz/main.tf
@@ -95,6 +95,14 @@ resource "kubernetes_manifest" "external_secret_jwt" {
           secretKey = "FACEBOOK_APP_SECRET"
           remoteRef = { key = "instagram-poster", property = "facebook_app_secret" }
         },
+        {
+          secretKey = "INSTAGRAM_APP_ID"
+          remoteRef = { key = "instagram-poster", property = "instagram_app_id" }
+        },
+        {
+          secretKey = "INSTAGRAM_APP_SECRET"
+          remoteRef = { key = "instagram-poster", property = "instagram_app_secret" }
+        },
       ]
     }
   }
@@ -158,6 +166,10 @@ resource "helm_release" "postiz" {
       # placeholder; ESO patches the real values from Vault below.
       FACEBOOK_APP_ID      = ""
       FACEBOOK_APP_SECRET  = ""
+      # IG standalone (Postiz Instagram-Login integration). Uses the modern
+      # `instagram_business_*` scopes — does not require the FB Login dance.
+      INSTAGRAM_APP_ID     = ""
+      INSTAGRAM_APP_SECRET = ""
     }
 
     # Use our PVC for uploads (overrides the chart's emptyDir default).