From 2f84198600a469cdc199a63f48a2621ce8a34dad Mon Sep 17 00:00:00 2001
From: Jansen Fuller <jansendfuller@mailfence.com>
Date: Sat, 2 May 2026 15:42:41 -0600
Subject: [PATCH] Fix secret management

---
 .../templates/_helpers.tpl                    |  4 +++
 .../templates/deployment.yaml                 | 27 ++++---------------
 .../templates/secrets/postgres-secret.yaml    |  5 ----
 3 files changed, 9 insertions(+), 27 deletions(-)

diff --git a/helm/taskchampion-sync-server/templates/_helpers.tpl b/helm/taskchampion-sync-server/templates/_helpers.tpl
index c0f0792..d85c1ec 100644
--- a/helm/taskchampion-sync-server/templates/_helpers.tpl
+++ b/helm/taskchampion-sync-server/templates/_helpers.tpl
@@ -75,5 +75,9 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
 {{- define "taskchampion-sync-server.postgres-secret-name" -}}
+{{- if .Values.postgres.existingSecret -}}
+{{- .Values.postgres.existingSecret -}}
+{{- else -}}
 {{- printf "%s-connection" .Release.Name -}}
+{{- end -}}
 {{- end -}}
\ No newline at end of file
diff --git a/helm/taskchampion-sync-server/templates/deployment.yaml b/helm/taskchampion-sync-server/templates/deployment.yaml
index 8002152..7daadef 100644
--- a/helm/taskchampion-sync-server/templates/deployment.yaml
+++ b/helm/taskchampion-sync-server/templates/deployment.yaml
@@ -31,28 +31,11 @@ spec:
           image: "{{ .Values.postgres.initContainer.image }}"
           imagePullPolicy: {{ .Values.postgres.initContainer.imagePullPolicy }}
           env:
-            - name: PGHOST
+            - name: PGURI
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
-                  key: host
-            - name: PGPORT
-              value: "{{ .Values.postgres.port }}"
-            - name: PGUSER
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
-                  key: username
-            - name: PGPASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
-                  key: password
-            - name: PGDATABASE
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
-                  key: database
+                  name: {{ printf "%s-connection" .Release.Name }}
+                  key: connection
             - name: SCHEMA_URL
               value: {{ include "taskchampion-sync-server.schema-url" . | quote }}
           command:
@@ -60,7 +43,7 @@ spec:
             - -c
             - |
               set -e
-              until pg_isready -h "$PGHOST" -p "$PGPORT" -U "$PGUSER"; do
+              until pg_isready -d "$PGURI"; do
                 echo 'Waiting for PostgreSQL...'
                 sleep 2
               done
@@ -69,7 +52,7 @@ spec:
                 echo 'Failed to download schema - continuing with main container'
                 exit 0
               }
-              psql -h "$PGHOST" -p "$PGPORT" -U "$PGUSER" -d "$PGDATABASE" -f /tmp/schema.sql || {
+              psql "$PGURI" -f /tmp/schema.sql || {
                 echo 'Schema execution failed (SQL error) - continuing with main container'
                 exit 0
               }
diff --git a/helm/taskchampion-sync-server/templates/secrets/postgres-secret.yaml b/helm/taskchampion-sync-server/templates/secrets/postgres-secret.yaml
index c1a0405..8364a23 100644
--- a/helm/taskchampion-sync-server/templates/secrets/postgres-secret.yaml
+++ b/helm/taskchampion-sync-server/templates/secrets/postgres-secret.yaml
@@ -7,10 +7,5 @@ metadata:
     {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
 type: Opaque
 data:
-  host: {{ .Values.postgres.host | b64enc }}
-  port: {{ .Values.postgres.port | toString | b64enc }}
-  username: {{ .Values.postgres.username | b64enc }}
-  password: {{ .Values.postgres.password | b64enc }}
-  database: {{ .Values.postgres.database | b64enc }}
   connection: {{ include "taskchampion-sync-server.postgres-connection" . | b64enc }}
 {{- end }}
\ No newline at end of file