{{- $fullname := include "aptly.fullname" . -}}
{{- $sec := include "aptly.security" . | fromJson -}}
aptly ({{ .Chart.AppVersion }}, chart {{ .Chart.Version }}) is deploying as {{ $fullname }}-0 in {{ .Release.Namespace }}.

{{- if eq .Values.security.preset "open" }}

  *** security.preset: open ***
  Both reading AND writing (the mutating /api/ path) are reachable with NO
  authentication from anything that can reach the Service — this is exactly
  the "komplett unabgesichert" mode, working as configured. Nothing further
  to set up; just make sure this is really what you want before exposing it
  beyond your own network.
{{- end }}

--- Check it's up -------------------------------------------------------

  kubectl exec -n {{ .Release.Namespace }} {{ $fullname }}-0 -c aptly -- \
    curl -fsS http://127.0.0.1:8080/api/ready

  kubectl logs -n {{ .Release.Namespace }} job/{{ $fullname }}-reconcile
    # (only present right after install/upgrade in `hook` mode)

--- Reach it -------------------------------------------------------------

{{- if .Values.ingress.enabled }}
{{- with .Values.ingress.repo.host }}

  https://{{ . }}/   (Ingress)
{{- end }}
{{- end }}
{{- if .Values.gateway.enabled }}
{{- range .Values.gateway.repo.hostnames }}

  https://{{ . }}/   (Gateway API)
{{- end }}
{{- end }}
{{- if not (or .Values.ingress.enabled .Values.gateway.enabled) }}

  kubectl port-forward -n {{ .Release.Namespace }} svc/{{ $fullname }} 8080:{{ .Values.service.port }}
  # then use http://127.0.0.1:8080/ below
{{- end }}

--- Configure apt on a client ---------------------------------------------

{{- $host := "apt.example.com" }}
{{- if and .Values.ingress.enabled .Values.ingress.repo.host }}
{{- $host = .Values.ingress.repo.host }}
{{- else if and .Values.gateway.enabled .Values.gateway.repo.hostnames }}
{{- $host = first .Values.gateway.repo.hostnames }}
{{- end }}
{{- if .Values.aptly.gpg.enabled }}
{{- if .Values.aptly.gpg.publishPublicKey.enabled }}

  curl -fsSL https://{{ $host }}{{ .Values.aptly.gpg.publishPublicKey.path }} \
    | gpg --dearmor | sudo tee /usr/share/keyrings/{{ include "aptly.name" . }}.gpg >/dev/null

  echo 'deb [signed-by=/usr/share/keyrings/{{ include "aptly.name" . }}.gpg] https://{{ $host }}/ <dist> <component>' \
    | sudo tee /etc/apt/sources.list.d/{{ include "aptly.name" . }}.list
{{- else }}

  aptly.gpg.enabled=true but aptly.gpg.publishPublicKey.enabled=false — the
  signing key is not being served; distribute it to clients yourself.
  echo 'deb [signed-by=/path/to/your-key.gpg] https://{{ $host }}/ <dist> <component>' \
    | sudo tee /etc/apt/sources.list.d/{{ include "aptly.name" . }}.list
{{- end }}
{{- else }}

  echo 'deb [trusted=yes] https://{{ $host }}/ <dist> <component>' \
    | sudo tee /etc/apt/sources.list.d/{{ include "aptly.name" . }}.list
{{- end }}
{{- if $sec.ra }}

  Reads require credentials in this preset ({{ .Values.security.preset }}):
    echo 'machine {{ $host }} login <user> password <password>' \
      | sudo tee -a /etc/apt/auth.conf.d/{{ include "aptly.name" . }}.conf
{{- end }}

--- Resizing storage later -------------------------------------------------

  persistence.size on an already-installed StatefulSet is IMMUTABLE via
  `helm upgrade` (Kubernetes forbids changing volumeClaimTemplates in place).
  For production, set persistence.existingClaim to a PVC you manage yourself
  — resizing that is a plain PVC edit. See docs/operations.md for the
  recovery procedure if you need to resize a chart-managed PVC anyway.
{{- if and .Values.podDisruptionBudget.enabled (le (int .Values.podDisruptionBudget.maxUnavailable) 0) }}

  *** podDisruptionBudget.maxUnavailable is 0 with replicas=1 — this blocks
  every voluntary node drain forever. ***
{{- end }}