axiom-secrets ({{ .Chart.Name }}-{{ .Chart.Version }}) — OpenBao is installed.

Server mode: {{ .Values.server.mode }}
In-cluster address: {{ include "axiom-secrets.address" . }}

{{- if eq .Values.server.mode "dev" }}

DEV MODE — in-memory, auto-unsealed, EPHEMERAL. Every restart wipes all
secrets. Do not use for real custody.

Wire the Axiom `secrets` extension (openbao provider, ADR-003):

  AXIOM_OPENBAO_URL={{ include "axiom-secrets.address" . }}
  AXIOM_OPENBAO_TOKEN=<from Secret {{ include "axiom-secrets.fullname" . }}-token, key "token">
  AXIOM_OPENBAO_MOUNT={{ .Values.extension.mount }}

Read the dev token back with:
  kubectl -n {{ .Release.Namespace }} get secret {{ include "axiom-secrets.fullname" . }}-token \
    -o jsonpath='{.data.token}' | base64 -d

{{- else }}

SEALED MODE — the server starts SEALED and will not serve until unsealed.
This is expected; the pod stays Running but not Ready until then.

1. Initialize once (records the unseal keys + initial root token):
     kubectl -n {{ .Release.Namespace }} exec -it {{ include "axiom-secrets.fullname" . }}-0 -- \
       bao operator init
   Store the unseal keys / recovery keys in a custody store OUTSIDE this
   cluster (an operator secret manager or KMS). Never commit them.

{{- if .Values.server.seal.type }}
   NOTE: seal type "{{ .Values.server.seal.type }}" is configured — the server
   auto-unseals from the external KMS/transit backend. `operator init` then
   returns recovery keys instead of unseal keys.
{{- else }}
2. Unseal after init and after every restart (manual seal):
     kubectl -n {{ .Release.Namespace }} exec -it {{ include "axiom-secrets.fullname" . }}-0 -- \
       bao operator unseal   # repeat with the threshold number of keys
   To avoid this manual step on restart, set server.seal.type to a KMS or
   transit backend (see deploy/README.md).
{{- end }}

3. Enable the kv/v2 mount and mint a scoped token for the extension:
     bao secrets enable -path={{ .Values.extension.mount }} kv-v2
     bao token create -policy=<axiom-read-policy>   # scope to what the app needs

4. Wire the Axiom `secrets` extension (openbao provider, ADR-003):
     AXIOM_OPENBAO_URL={{ include "axiom-secrets.address" . }}
     AXIOM_OPENBAO_TOKEN=<the scoped token from step 3>
     AXIOM_OPENBAO_MOUNT={{ .Values.extension.mount }}

   Verify:  axi secrets diagnose   (fails closed if the default is unreachable)
{{- end }}
