Document Helm chart deployment, mark Compose snippets as examples

- New "Kubernetes (Helm)" section on getting-started, with tabs for
  standalone and alongside-Aidbox modes, pointing at the published
  HealthSamurai/helm-charts/mdmbox chart.
- Intro line clarifies the Compose blocks are minimal examples for
  local trial runs, not production manifests.
- Add commented MDMBOX_LICENSE hint to both compose examples so users
  know where to put the JWT.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: skylightis666

assets/examples/docker-compose.shared.yml

@@ -65,6 +65,9 @@ services:
     ports:
       - "3000:3000"
     environment:
+      # License — get a JWT from https://aidbox.app/ui/portal (select MDMbox product).
+      # Leave unset to activate via browser on first visit to http://localhost:3000.
+      # MDMBOX_LICENSE: "<paste JWT here>"
       # Same database as Aidbox
       BOX_DB_HOST: db
       BOX_DB_PORT: "5432"

assets/examples/docker-compose.standalone.yml

@@ -21,6 +21,9 @@ services:
     ports:
       - "3000:3000"
     environment:
+      # License — get a JWT from https://aidbox.app/ui/portal (select MDMbox product).
+      # Leave unset to activate via browser on first visit to http://localhost:3000.
+      # MDMBOX_LICENSE: "<paste JWT here>"
       # Database
       BOX_DB_HOST: db
       BOX_DB_PORT: "5432"

docs/getting-started.md

@@ -8,6 +8,8 @@ MDMbox is distributed as a Docker image: `healthsamurai/mdmbox`.
 
 It requires a PostgreSQL 14+ database. All configuration is done through environment variables.
 
+The `docker-compose.yml` snippets below are minimal **examples for local trial runs** — clone, tweak, `docker compose up`. For Kubernetes, see [Kubernetes (Helm)](#kubernetes-helm).
+
 ## Standalone deployment
 
 In standalone mode, MDMbox manages its own database. You need two containers:  PostgreSQL and MDMbox.
@@ -40,6 +42,61 @@ docker-compose.yml
 The `BOX_*` environment variables must match your Aidbox configuration exactly. MDMbox and Aidbox share the same PostgreSQL instance, FHIR data, and engine settings.
 {% endhint %}
 
+## Kubernetes (Helm)
+
+For Kubernetes, MDMbox is published as a Helm chart: [HealthSamurai/helm-charts/mdmbox](https://github.com/HealthSamurai/helm-charts/tree/main/mdmbox). The chart does not provision PostgreSQL — bring your own (managed service, in-cluster operator, or [bitnami/postgresql](https://artifacthub.io/packages/helm/bitnami/postgresql)) — and supports the same two modes as the Compose examples above.
+
+```bash
+helm repo add healthsamurai https://healthsamurai.github.io/helm-charts
+
+helm upgrade --install mdmbox healthsamurai/mdmbox \
+  --namespace mdmbox --create-namespace \
+  --values values.yaml
+```
+
+{% tabs %}
+{% tab title="Standalone" %}
+Put non-secret `BOX_DB_*` values in `config:` and reference a `Secret` you created with the credentials via `extraEnvFromSecrets`:
+
+```yaml
+config:
+  MDMBOX_LICENSE: <license JWT>
+  BOX_DB_HOST: postgres
+  BOX_DB_PORT: "5432"
+  BOX_DB_DATABASE: mdmbox
+
+extraEnvFromSecrets:
+  - mdmbox-db   # contains BOX_DB_USER, BOX_DB_PASSWORD
+```
+
+{% endtab %}
+{% tab title="Alongside Aidbox" %}
+Reuse the `ConfigMap` and `Secret` your Aidbox already has — point the chart at them via `aidboxConfigMap` / `aidboxSecret`:
+
+```yaml
+aidboxConfigMap: aidbox-config   # BOX_DB_HOST, BOX_DB_PORT, BOX_DB_DATABASE...
+aidboxSecret: aidbox-secret      # BOX_DB_USER, BOX_DB_PASSWORD...
+
+config:
+  MDMBOX_LICENSE: <license JWT>
+```
+
+{% endtab %}
+{% endtabs %}
+
+The full list of values is in the [chart README](https://github.com/HealthSamurai/helm-charts/blob/main/mdmbox/README.md).
+
+## License
+
+MDMbox requires a license to start. There are two ways to activate it:
+
+1. **Environment variable.** Sign in to the [Aidbox portal](https://aidbox.app/ui/portal), open the MDMbox project, copy the license JWT, and pass it to the MDMbox container as `MDMBOX_LICENSE`. Recommended for production and CI.
+2. **Browser activation.** Leave `MDMBOX_LICENSE` unset and start MDMbox. Open `http://localhost:3000`, click **Continue with Aidbox account**, sign in to the portal — a development MDMbox license is generated and stored in the database automatically. Useful for local development.
+
+| Variable | Description | Required |
+| --- | --- | --- |
+| `MDMBOX_LICENSE` | License JWT copied from the Aidbox portal | No — falls back to browser activation |
+
 ## Configuration reference
 
 ### Database
@@ -54,12 +111,6 @@ MDMbox uses the standard Aidbox database environment variables:
 | `BOX_DB_USER` | Database user | Yes |
 | `BOX_DB_PASSWORD` | Database password | Yes |
 
-### FHIR engine
-
-MDMbox includes an embedded FHIR engine that uses the standard Aidbox `BOX_*` environment variables. In shared mode, these must match your Aidbox configuration. See the docker-compose examples above for the full list.
-
-Key settings: `BOX_BOOTSTRAP_FHIR_PACKAGES`, `BOX_FHIR_SEARCH_ENGINE`, `BOX_FHIR_COMPLIANT_MODE`, `BOX_SECURITY_DEV_MODE`, `BOX_ROOT_CLIENT_ID`, `BOX_ROOT_CLIENT_SECRET`.
-
 ### MDMbox connection pool
 
 MDMbox maintains its own connection pool separate from the embedded FHIR engine. Both pools connect to the same database but are sized independently.