{{- include "rhema-dist.validate" . }}
rhema-dist (bucket {{ .Values.bucket | quote }}) has been deployed.

The bucket serves as a static website — the distribution's public
face — and over S3, its write surface:

  Website: {{- if .Values.web.ingress.tls.enabled }} https{{- else }} http{{- end }}://{{ .Values.web.ingress.host }}
  S3 (in-cluster): {{ include "rhema-dist.s3Endpoint" . }}
{{- if .Values.s3.ingress.enabled }}
  S3 (public): {{- if .Values.s3.ingress.tls.enabled }} https{{- else }} http{{- end }}://{{ .Values.s3.ingress.host }}
{{- end }}

The release workflow uploads against the S3 endpoint with the
generated key pair:

  kubectl get secret {{ include "rhema-dist.garageSecretName" . }} \
    -o go-template='access: {{"{{"}} .data.access-key | base64decode {{"}}"}} secret: {{"{{"}} .data.secret-key | base64decode {{"}}"}}'

Website access is enabled per bucket, over the S3 API — the release
workflow does it on every run (PutBucketWebsite, idempotent); to bring
a fresh bucket up by hand:

  aws s3api put-bucket-website --bucket {{ .Values.bucket }} \
    --endpoint-url {{ include "rhema-dist.s3Endpoint" . }} \
    --website-configuration '{"IndexDocument":{"Suffix":"index.html"}}'

What a release uploads, the contract the installer consumes:

  <version>/rhema-<os>-<arch>.tar.gz   one rhema binary at the root
  <version>/checksums.txt              sha256sum format, over the files
  manifest.json                        {"stable": "<version>",
                                        "binaries": {"rhema-linux-amd64":
                                          {"url": ..., "sha256": ...}}}
  edge/manifest.json                   the same shape, when edge exists
