Wiki.js is installing at https://{{ .Values.host }}

{{ if .Values.dbInit.enabled -}}
The database "{{ .Values.db.name }}" and role "{{ .Values.db.user }}" are created
for you on {{ .Values.db.host }} by a pre-install hook, using the
"{{ .Values.dbInit.rootSecret }}" secret in this namespace.
{{- else -}}
dbInit is disabled: the database "{{ .Values.db.name }}" and role
"{{ .Values.db.user }}" must already exist on {{ .Values.db.host }}.
{{- end }}

{{ if .Values.secretProvision.enabled -}}
The secret "{{ .Values.existingSecret }}" is created for you, with a generated
db-password. Existing values are never overwritten, so upgrades keep the live
password.
{{- else -}}
secretProvision is disabled: the secret "{{ .Values.existingSecret }}" must
already exist with key "{{ .Values.secretKeys.dbPassword }}".
{{- end }}

NEXT STEPS

1. Open https://{{ .Values.host }} and complete the setup wizard to create the
   local administrator. On a fresh database Wiki.js serves the wizard directly.

2. Single sign-on.
{{ if .Values.oidcProvision.enabled -}}
   The Keycloak client "{{ .Values.oidcProvision.clientId | default (include "app.name" .) }}" has been created
   or updated for you, registered with a wildcard redirect URI on this host —
   Wiki.js mints its callback UUID only when you create the strategy, so the
   exact URI cannot be known in advance.

   Read the client secret with:
     kubectl -n {{ .Release.Namespace }} get secret {{ .Values.existingSecret }} \
       -o jsonpath='{.data.{{ .Values.oidcProvision.clientSecretKey }}}' | base64 -d

   Then add the strategy in Admin -> Auth and paste it there. Wiki.js keeps auth
   configuration in its own database, so this last step cannot be automated
   without writing to Wiki.js's internal schema.
{{- else -}}
   Configured inside Wiki.js (Admin -> Auth), not by this chart — Wiki.js keeps
   auth configuration in its own database. You need the OIDC client details from
   your identity provider, and you must add the callback URL Wiki.js shows you
   to that client's allowed redirect URIs.

   If this namespace has a "keycloak-provisioner" credential, set
   oidcProvision.enabled=true and the client is created for you.
{{- end }}
3. Mirroring pages to a git repo is optional and configured in Wiki.js itself,
   Admin -> Storage -> Git — this chart is not involved. Wiki.js accepts the SSH
   private key pasted directly into that form (key mode "Contents"), so nothing
   has to be mounted for it.

   Set the local repository path under /wiki/data so the working copy lands on
   the volume; otherwise an un-pushed commit is lost when the pod restarts.

NOTE: this release uses a ReadWriteOnce volume and replicas: 1. The single
replica is a correctness requirement, not sizing — with git storage configured,
two pods syncing one working copy would race. Every upgrade is a brief outage.
