trelix has been deployed.

{{- if .Values.persistence.enabled }}

⚠️  REPO MODEL — READ THIS FIRST
--------------------------------
This one Deployment/PVC pair can serve MANY repos, not just one. trelix
serve's REST API is stateless per request: every route independently
re-derives its config from the `repo` query param you pass, so `repo_path`
in the container's startup command is decorative only.

Index and query repos as SUBDIRECTORIES of the shared PVC, mounted at
{{ .Values.persistence.mountPath }}:

  1. Get a shell with the PVC mounted (or `kubectl -n {{ .Release.Namespace }} cp` a repo checkout in):
       kubectl -n {{ .Release.Namespace }} exec -it deploy/{{ include "trelix.fullname" . }} -- sh

  2. Copy or index a repo under {{ .Values.persistence.mountPath }}, e.g.
     {{ .Values.persistence.mountPath }}/my-project

  3. Every REST call passes that absolute path as `repo`:
       POST {{ .Values.persistence.mountPath }}/my-project via /index
       GET  /search?repo={{ .Values.persistence.mountPath }}/my-project&query=...

{{- end }}

{{- if or .Values.apiAuth.token .Values.apiAuth.existingSecretName }}

ℹ️  API AUTH ENABLED
--------------------
TRELIX_API_AUTH_TOKEN is set. Every route except /health now requires an
`X-Trelix-Api-Key` header matching that token, e.g.:
  curl -H "X-Trelix-Api-Key: <token>" http://<host>/search?query=...&repo=...

This is a single shared token, not per-user auth — still recommend a
fronting proxy/ingress-auth for defense in depth before exposing this
publicly, and rotate the token by updating the Secret and restarting.
The token is read when the container starts, so the old one stays valid until
the pod restarts. A new apiAuth.token restarts the pod on `helm upgrade`; after
you change the Secret behind apiAuth.existingSecretName, run:
  kubectl -n {{ .Release.Namespace }} rollout restart deployment/{{ include "trelix.fullname" . }}

{{- else }}

⚠️  NO AUTHENTICATION ON THE REST API
--------------------------------------
trelix serve has zero auth middleware by default — every route is open to
anyone who can reach the Service. This chart defaults `ingress.enabled:
false` for exactly this reason.

Before setting `ingress.enabled: true`, either set `apiAuth.token` /
`apiAuth.existingSecretName` (see values.yaml) to require an
`X-Trelix-Api-Key` header, or put an authenticating layer in front (an
ingress-controller auth annotation, e.g. NGINX
`nginx.ingress.kubernetes.io/auth-*`, or an OAuth2-proxy sidecar/gateway).
Without one, a public Ingress exposes:
  - POST /index    — lets any caller trigger arbitrary-path indexing
  - GET  /ask      — lets any caller run LLM synthesis at your API-key's cost
  - GET  /search   — exposes full source/body content of every indexed repo

{{- end }}

{{- if eq .Values.store.backend "qdrant" }}

ℹ️  QDRANT BACKEND
------------------
store.backend=qdrant is set, but this chart does NOT deploy or manage
Qdrant — you must point store.qdrant.url at an existing instance (Qdrant
Cloud or self-hosted). Qdrant's own Helm chart states its "Support ... is
limited to community support," and self-hosted Qdrant lacks zero-downtime
upgrades, backup/DR, and shard rebalancing (Cloud/Enterprise-Operator-only
features). Operating Qdrant's availability and durability is entirely on
you with this setting.
{{- end }}

{{- if .Values.mcp.enabled }}

ℹ️  TRELIX-MCP (MCP over Streamable HTTP)
-----------------------------------------
The trelix-mcp container serves only the repositories under
{{ .Values.persistence.mountPath }}, on Service port {{ .Values.mcp.port }} (named `mcp`). Every request
except GET /health needs the mcp.auth token as `Authorization: Bearer <token>`;
it is not the apiAuth token.

  kubectl -n {{ .Release.Namespace }} port-forward svc/{{ include "trelix.fullname" . }} {{ .Values.mcp.port }}:{{ .Values.mcp.port }}
  claude mcp add --transport http trelix http://127.0.0.1:{{ .Values.mcp.port }}/mcp --header "Authorization: Bearer <token>"

The Host check accepts {{ include "trelix.mcpAllowedHosts" . }} and the loopback names.
Any other name answers 403 until it is listed in mcp.allowedHosts (an Ingress
host, or the .svc.cluster.local form).

To rotate the token: it is read when the container starts, so the old one stays
valid until the pod restarts. A new mcp.auth.token restarts the pod on
`helm upgrade`. The chart cannot see a Secret it does not own, so after you
change the Secret behind mcp.auth.existingSecretName, run:
  kubectl -n {{ .Release.Namespace }} rollout restart deployment/{{ include "trelix.fullname" . }}

image.tag must be a release whose trelix-mcp has `--transport http`; if the
container exits at once, read why:
  kubectl -n {{ .Release.Namespace }} logs deploy/{{ include "trelix.fullname" . }} -c trelix-mcp
{{- end }}

Get the application URL by running:
{{- if .Values.ingress.enabled }}
{{- range .Values.ingress.hosts }}
  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ .host }}{{ (first .paths).path }}
{{- end }}
{{- else if eq .Values.service.type "LoadBalancer" }}
  kubectl -n {{ .Release.Namespace }} get svc -w {{ include "trelix.fullname" . }}
{{- else }}
  kubectl -n {{ .Release.Namespace }} port-forward svc/{{ include "trelix.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }}
  then open http://127.0.0.1:{{ .Values.service.port }}/docs
{{- end }}
