feat: チャートをゼロから再設計(外部DB前提のYOURLS+Nginx構成に作り直し)

旧チャートは存在しないDocker Hubイメージ(yourls/yourls)を参照し、Bitnami MySQL
サブチャートに依存するなど正しく動作しない状態だったため、YOURLS公式イメージ
(docker.io/yourls, container-entrypoint.sh/config-container.php)の実装を確認した上で
WordPressチャートと同一方針(外部DB、emptyDir+PVC分離、fsGroup非root実行、
real IP取得対応)でスクラッチから再構築した。

templates/NOTES.txt

@@ -9,36 +9,44 @@ To learn more about the release, try:
 
 1. Get the application URL by running these commands:
 {{- if .Values.ingress.enabled }}
-{{- range $host := .Values.ingress.hosts }}
-  {{- range .paths }}
-  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
-  {{- end }}
-{{- end }}
+  http{{ if or .Values.ingress.tls .Values.ingress.extraTls }}s{{ end }}://{{ .Values.ingress.hostname }}{{ .Values.ingress.path }}
 {{- else if contains "NodePort" .Values.service.type }}
   export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "yourls-nginx.fullname" . }})
   export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
   echo http://$NODE_IP:$NODE_PORT
 {{- else if contains "LoadBalancer" .Values.service.type }}
      NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "yourls-nginx.fullname" . }}'
+           You can watch the status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "yourls-nginx.fullname" . }}'
   export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "yourls-nginx.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
   echo http://$SERVICE_IP:{{ .Values.service.port }}
 {{- else if contains "ClusterIP" .Values.service.type }}
   export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "yourls-nginx.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
   echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:80
 {{- end }}
 
-2. Default credentials (CHANGE IMMEDIATELY):
-   Username: {{ .Values.yourls.config.username }}
-   Password: {{ .Values.yourls.config.password }}
+2. Important: YOURLS_SITE must match the URL you access this instance from.
+   Current value: {{ .Values.yourls.site }}
+   Short URLs are generated using this fixed value, unlike WordPress it is NOT
+   derived automatically from the request. Update .Values.yourls.site (and
+   re-run helm upgrade) if it does not match your real domain yet.
 
-3. Access the admin interface at:
-   http://your-domain/admin/
+3. Default admin credentials:
+   Username: {{ .Values.yourls.admin.username }}
+{{- if .Values.yourls.admin.existingSecret }}
+   Password: stored in existing Secret "{{ .Values.yourls.admin.existingSecret }}" (key: {{ .Values.yourls.admin.existingSecretKey }})
+{{- else }}
+   Password: check the generated Secret if you did not set yourls.admin.password:
+     kubectl get secret --namespace {{ .Release.Namespace }} {{ include "yourls-nginx.secretName" . }} -o jsonpath="{.data.admin-password}" | base64 -d; echo
+{{- end }}
+
+4. Access the admin interface at:
+   {{ .Values.yourls.site }}/admin/
+   (first visit creates the database tables automatically; the DB user needs
+   CREATE/ALTER privileges on {{ .Values.database.name }} for this to succeed)
 
 IMPORTANT SECURITY NOTES:
-- Change the default admin password immediately
-- Update the YOURLS_COOKIEKEY in values.yaml to a random string
-- Consider enabling HTTPS via Ingress with TLS
-- Review and adjust resource limits based on your needs
+- Change the default admin username/password before exposing this publicly.
+- yourls.privateMode is {{ .Values.yourls.privateMode }} (true = admin login required to
+  create/manage short URLs; recommended default).
+- Enable HTTPS via Ingress (ingress.tls: true) or your LoadBalancer/CDN in production.