Wiki.js is installing at https://{{ .Values.host }}

{{ if .Values.dbInit.enabled -}}
The database "{{ .Values.db.name }}" and role "{{ .Values.db.user }}" are created
for you on {{ .Values.db.host }} by a pre-install hook, using the
"{{ .Values.dbInit.rootSecret }}" secret in this namespace.
{{- else -}}
dbInit is disabled: the database "{{ .Values.db.name }}" and role
"{{ .Values.db.user }}" must already exist on {{ .Values.db.host }}.
{{- end }}

{{ if .Values.secretProvision.enabled -}}
The secret "{{ .Values.existingSecret }}" is created for you, with a generated
db-password. Existing values are never overwritten, so upgrades keep the live
password.
{{- else -}}
secretProvision is disabled: the secret "{{ .Values.existingSecret }}" must
already exist with key "{{ .Values.secretKeys.dbPassword }}".
{{- end }}

NEXT STEPS

1. Open https://{{ .Values.host }} and complete the setup wizard to create the
   local administrator. On a fresh database Wiki.js serves the wizard directly.

2. Single sign-on.
{{ if .Values.oidcProvision.enabled -}}
   The Keycloak client "{{ .Values.oidcProvision.clientId | default (include "app.name" .) }}" has been created
   or updated for you, registered with a wildcard redirect URI on this host —
   Wiki.js mints its callback UUID only when you create the strategy, so the
   exact URI cannot be known in advance.

   Read the client secret with:
     kubectl -n {{ .Release.Namespace }} get secret {{ .Values.existingSecret }} \
       -o jsonpath='{.data.{{ .Values.oidcProvision.clientSecretKey }}}' | base64 -d

   Then add the strategy in Admin -> Auth and paste it there. Wiki.js keeps auth
   configuration in its own database, so this last step cannot be automated
   without writing to Wiki.js's internal schema.
{{- else -}}
   Configured inside Wiki.js (Admin -> Auth), not by this chart — Wiki.js keeps
   auth configuration in its own database. You need the OIDC client details from
   your identity provider, and you must add the callback URL Wiki.js shows you
   to that client's allowed redirect URIs.

   If this namespace has a "keycloak-provisioner" credential, set
   oidcProvision.enabled=true and the client is created for you.
{{- end }}
{{ if .Values.git.enabled }}
3. Git sync is ENABLED. The deploy key is mounted at /wiki/keys/deploy.key.

   The secret "{{ .Values.existingSecret }}" MUST contain the key
   "{{ .Values.secretKeys.deployKey }}" holding an SSH private key, or the pod
   will stay in ContainerCreating — a generated value is no use here, since the
   key has to match one registered with your git host.

   Then in Admin -> Storage -> Git set:
     Private Key Path       /wiki/keys/deploy.key
     Local Repository Path  /wiki/data/repo

   Type the key path with NO LEADING SPACE. Wiki.js renders this field straight
   into core.sshCommand, and a leading space makes ssh look for a filename that
   begins with a space — every push then fails with Permission denied
   (publickey), with nothing in the UI to indicate why.
{{- else }}
3. Git sync is disabled (the default). To mirror page content to a git remote,
   set git.enabled=true and put an SSH private key in the secret
   "{{ .Values.existingSecret }}" under the key "{{ .Values.secretKeys.deployKey }}".
{{- end }}

NOTE: this release uses a ReadWriteOnce volume and replicas: 1 — the latter is a
correctness requirement, not sizing. Two pods running git sync against one
working copy would race. Every upgrade is therefore a brief outage.
