{{- /*
NOTES.txt — printed after `helm install` / `helm upgrade`.
*/ -}}
{{- $fullname := include "chatcli.fullname" . -}}
{{- $extraCred := false -}}
{{- range .Values.extraEnv -}}
{{- if has .name (list "CHATCLI_SERVER_TOKEN" "CHATCLI_JWT_SECRET" "CHATCLI_JWT_PUBLIC_KEY" "CHATCLI_SERVER_TLS_CLIENT_CA") -}}
{{- $extraCred = true -}}
{{- end -}}
{{- end -}}
{{- $loopback := has .Values.security.bindAddress (list "127.0.0.1" "localhost" "::1") -}}
{{- $cred := or .Values.server.token .Values.security.jwtSecret .Values.security.jwtSecretRef .Values.security.jwtPublicKey .Values.security.jwtPublicKeyRef .Values.security.tlsClientCA $extraCred -}}
ChatCLI server {{ .Chart.AppVersion }} is deployed as {{ $fullname }} in namespace {{ .Release.Namespace }}.

{{- if and (not $cred) (not $loopback) }}
{{- if .Values.secrets.existingSecret }}

NOTE: no credential is set in the chart values. The server refuses to start
on a reachable address without one, so secrets.existingSecret
({{ .Values.secrets.existingSecret }}) must carry CHATCLI_SERVER_TOKEN,
CHATCLI_JWT_SECRET or CHATCLI_JWT_PUBLIC_KEY. If it does not, the pod exits
with "refusing to serve an unauthenticated API".
{{- else }}

WARNING: no credential is configured. Inside Kubernetes the server binds
every interface and refuses to start unauthenticated, so this pod will exit
with "refusing to serve an unauthenticated API". Set one of:

    --set server.token="$(openssl rand -hex 32)"
    --set security.jwtSecretRef.name=<secret> --set security.jwtSecretRef.key=<key>
{{- end }}
{{- end }}
{{- $atrestMode := include "chatcli.atrestMode" . }}
{{- if eq $atrestMode "auto" }}

Encryption at rest: on. The server keeps its key in Secret
{{ include "chatcli.atrestKeySecretName" . }} (created on its first start, never overwritten, kept by
helm uninstall). Deleting it makes the encrypted data unreadable: back it up
with the PVC data.
{{- if not .Values.rbac.create }}
rbac.create=false: grant the server's ServiceAccount get on that Secret and
create on secrets, or the server refuses to start.
{{- end }}
{{- else if eq $atrestMode "secretRef" }}

Encryption at rest: on, key from Secret {{ .Values.security.encryptionKeySecret.name }}.
{{- else if eq $atrestMode "plain" }}

Encryption at rest: on, but security.encryptionKey is deprecated (the key is in
plaintext in the Deployment): move it to a Secret and set
security.encryptionKeySecret.name.
{{- else if eq $atrestMode "off" }}

Encryption at rest: not set by the chart (security.encryptionAtRest=false); the
stores are plaintext unless secrets.existingSecret carries CHATCLI_ENCRYPTION_KEY.
{{- end }}

Connect from your machine:

    kubectl -n {{ .Release.Namespace }} port-forward svc/{{ $fullname }} {{ .Values.service.port }}:{{ .Values.service.port }}
{{- if .Values.tls.enabled }}
    chatcli connect localhost:{{ .Values.service.port }} --ca-cert ca.crt --token "$CHATCLI_REMOTE_TOKEN"

(--ca-cert implies TLS; through a port-forward the certificate must also be
valid for localhost)
{{- else }}
    CHATCLI_ALLOW_INSECURE=true chatcli connect localhost:{{ .Values.service.port }} --token "$CHATCLI_REMOTE_TOKEN"

The listener is plaintext (tls.enabled=false): the client dials TLS unless
CHATCLI_ALLOW_INSECURE=true. Enable TLS before exposing it beyond the pod
network.
{{- end }}
{{- if .Values.server.token }}

Read the shared token back with:

    kubectl -n {{ .Release.Namespace }} get secret {{ include "chatcli.tokenSecretName" . }} \
      -o jsonpath='{.data.CHATCLI_SERVER_TOKEN}' | base64 -d
{{- end }}
{{- if .Values.server.metricsPort }}

Metrics and the /healthz probe endpoint: port {{ .Values.server.metricsPort }} (plain HTTP, no auth).
{{- end }}
The gRPC port also answers grpc.health.v1 without a credential. Logs are JSON
lines on stderr: kubectl -n {{ .Release.Namespace }} logs deploy/{{ $fullname }}

Upgrade with --reset-then-reuse-values (Helm 3.14+) or your values file: plain
--reuse-values skips the defaults of keys added by newer chart versions.
