
CertDax has been deployed to your cluster!

{{- if .Values.ingress.enabled }}

Access CertDax at:
{{- if .Values.ingress.tls.enabled }}
  https://{{ .Values.ingress.host }}
{{- else }}
  http://{{ .Values.ingress.host }}
{{- end }}

Make sure your DNS (or /etc/hosts) points {{ .Values.ingress.host }} to your
Ingress controller's external IP.

Find the external IP of your Ingress controller:

  kubectl get ingress {{ include "certdax.fullname" . }} -n {{ .Release.Namespace }}

Or check your Ingress controller's LoadBalancer service directly:

  kubectl get svc -A | grep -i ingress

Once you have the EXTERNAL-IP, create a DNS A record:

  {{ .Values.ingress.host }}  →  <EXTERNAL-IP>

Or for quick local testing, add it to /etc/hosts:

  echo "<EXTERNAL-IP> {{ .Values.ingress.host }}" | sudo tee -a /etc/hosts

{{- else }}

CertDax is not exposed externally (ingress is disabled).
To access it, use port-forward:

  kubectl port-forward svc/{{ include "certdax.fullname" . }}-frontend 8080:80 -n {{ .Release.Namespace }}

Then open http://localhost:8080 in your browser.

{{- end }}

First-time setup:
  1. Open CertDax and create your admin account
  2. Go to Settings → configure SMTP for email notifications (optional)
  3. Go to Providers → add a DNS provider or Certificate Authority
  4. Go to Certificates → request your first certificate

{{- if .Values.postgresql.enabled }}

PostgreSQL is running inside the cluster as a StatefulSet.
Data is persisted on a {{ .Values.postgresql.storage.size }} PVC.
{{- else }}

Using external database: {{ .Values.certdax.externalDatabaseUrl }}
{{- end }}

================================================================
SECURITY ACTION REQUIRED — export your OpenBao recovery file
================================================================

The init Job has written the Shamir unseal shares + initial root
token to:

  Secret/{{ include "certdax.openbaoKeysSecretName" . }} (namespace: {{ .Release.Namespace }})

Without this Secret you cannot unseal OpenBao on a fresh cluster,
which means PVC backups of openbao-data are useless on their own.
Export it once, right now, and move the result off-cluster
(password manager / GPG vault / hardware token):

  kubectl get secret {{ include "certdax.openbaoKeysSecretName" . }} \
    -n {{ .Release.Namespace }} -o yaml \
    | kubectl neat 2>/dev/null \
    | tee certdax-recovery.yaml

  # or encrypt straight away (recommended):
  kubectl get secret {{ include "certdax.openbaoKeysSecretName" . }} \
    -n {{ .Release.Namespace }} -o yaml \
    | gpg -e -r you@example.com > certdax-recovery.yaml.gpg

To restore on a fresh cluster:

  # 1. Restore the openbao-data PVC from your backup tooling
  #    (Velero, restic, etcd snapshot + CSI clone, ...). The
  #    Secret alone is NOT enough — without the storage backend
  #    OpenBao re-initialises and the init Job overwrites your
  #    restored Secret with brand new keys.
  # 2. Re-create the keys Secret BEFORE installing the chart:
  kubectl create namespace {{ .Release.Namespace }}
  kubectl apply -f certdax-recovery.yaml -n {{ .Release.Namespace }}
  # 3. Install / upgrade the chart pointing at the restored PVC:
  helm install certdax certdax/certdax -n {{ .Release.Namespace }} ...

The init Job detects an already-initialised cluster, skips
re-initialising, and the auto-unseal sidecar replays the shares
from the restored Secret on every pod start.

