OpenWA has been installed as release "{{ .Release.Name }}".

  WARNING: replicaCount must stay 1. A session lease stops two pods from launching the
  same session, but socket eviction, WS rate limits and bulk batches stay process-local.
  See docs/13-horizontal-scaling.md.

1. Wait for the pod:
     kubectl -n {{ .Release.Namespace }} rollout status statefulset/{{ include "openwa.fullname" . }}

2. Get the API key. If secretEnv.API_MASTER_KEY was left empty, the app generated
   one on first boot and stored it on the PVC:
     kubectl -n {{ .Release.Namespace }} exec {{ include "openwa.fullname" . }}-0 -- cat {{ (.Values.env | default dict).BOOTSTRAP_KEY_FILE | default "/app/data/.api-key" }}

3. Reach the API + dashboard:
     kubectl -n {{ .Release.Namespace }} port-forward svc/{{ include "openwa.fullname" . }} 2785:{{ .Values.service.port }}
     then open http://localhost:2785 (dashboard) or call http://localhost:2785/api.
{{- if .Values.ingress.enabled }}
   Or via the ingress host: http{{ if .Values.ingress.tls }}s{{ end }}://{{ .Values.ingress.host }}
{{- $env := .Values.env | default dict }}
{{- $csp := toString (get $env "CSP_UPGRADE_INSECURE_REQUESTS") }}
{{- /* An absent NODE_ENV leaves the image's NODE_ENV=production in effect; an empty one overrides it. */}}
{{- $nodeEnv := ternary (toString (get $env "NODE_ENV")) "production" (hasKey $env "NODE_ENV") }}
{{- $upgrade := or (eq $csp "true") (and (ne $csp "false") (eq $nodeEnv "production")) }}
{{- if and (not .Values.ingress.tls) $upgrade }}

   WARNING: this ingress has no TLS, but the app tells browsers to upgrade insecure requests, so
   over plain http the dashboard fetches its scripts over https and renders blank. Terminate TLS
   (ingress.tls, or in front of the ingress) or set env.CSP_UPGRADE_INSECURE_REQUESTS="false".
   See docs/12-troubleshooting-faq.md.
{{- end }}
{{- end }}