Wiki.js is installing at https://{{ .Values.host }}

{{ if .Values.dbInit.enabled -}}
The database "{{ .Values.db.name }}" and role "{{ .Values.db.user }}" are created
for you on {{ .Values.db.host }} by a pre-install hook, using the
"{{ .Values.dbInit.rootSecret }}" secret in this namespace.
{{- else -}}
dbInit is disabled: the database "{{ .Values.db.name }}" and role
"{{ .Values.db.user }}" must already exist on {{ .Values.db.host }}.
{{- end }}

{{ if .Values.secretProvision.enabled -}}
The secret "{{ .Values.existingSecret }}" is created for you, with a generated
db-password. Existing values are never overwritten, so upgrades keep the live
password.
{{- else -}}
secretProvision is disabled: the secret "{{ .Values.existingSecret }}" must
already exist with key "{{ .Values.secretKeys.dbPassword }}".
{{- end }}

NEXT STEPS

1. Open https://{{ .Values.host }} and complete the setup wizard to create the
   local administrator. On a fresh database Wiki.js serves the wizard directly.

2. Single sign-on is configured inside Wiki.js (Admin -> Auth), not by this
   chart — Wiki.js keeps auth configuration in its own database. You will need
   the OIDC client details from your identity provider, and you must add the
   callback URL that Wiki.js shows you to that client's allowed redirect URIs.
{{ if .Values.git.enabled }}
3. Git sync is ENABLED. The deploy key is mounted at /wiki/keys/deploy.key.

   The secret "{{ .Values.existingSecret }}" MUST contain the key
   "{{ .Values.secretKeys.deployKey }}" holding an SSH private key, or the pod
   will stay in ContainerCreating — a generated value is no use here, since the
   key has to match one registered with your git host.

   Then in Admin -> Storage -> Git set:
     Private Key Path       /wiki/keys/deploy.key
     Local Repository Path  /wiki/data/repo

   Type the key path with NO LEADING SPACE. Wiki.js renders this field straight
   into core.sshCommand, and a leading space makes ssh look for a filename that
   begins with a space — every push then fails with Permission denied
   (publickey), with nothing in the UI to indicate why.
{{- else }}
3. Git sync is disabled (the default). To mirror page content to a git remote,
   set git.enabled=true and put an SSH private key in the secret
   "{{ .Values.existingSecret }}" under the key "{{ .Values.secretKeys.deployKey }}".
{{- end }}

NOTE: this release uses a ReadWriteOnce volume and replicas: 1 — the latter is a
correctness requirement, not sizing. Two pods running git sync against one
working copy would race. Every upgrade is therefore a brief outage.
