From 516589720021794eb0b3540264e8ba6e470d25e7 Mon Sep 17 00:00:00 2001
From: Jansen Fuller <jansendfuller@mailfence.com>
Date: Tue, 12 May 2026 12:00:16 +0000
Subject: [PATCH] Helm-chart GitHub action (#199)

---
 .github/workflows/publish-docs.yml |  1 +
 .github/workflows/publish-helm.yml | 37 ++++++++++++++++++
 docs/src/SUMMARY.md                |  5 ++-
 docs/src/usage/helm.md             | 60 ++++++++++++++++++++++++++++++
 4 files changed, 101 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/publish-helm.yml
 create mode 100644 docs/src/usage/helm.md

diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml
index 1baf8d2..6baee36 100644
--- a/.github/workflows/publish-docs.yml
+++ b/.github/workflows/publish-docs.yml
@@ -28,3 +28,4 @@ jobs:
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./docs/book
+          keep_files: true
diff --git a/.github/workflows/publish-helm.yml b/.github/workflows/publish-helm.yml
new file mode 100644
index 0000000..63f689e
--- /dev/null
+++ b/.github/workflows/publish-helm.yml
@@ -0,0 +1,37 @@
+name: Publish Helm Charts
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'helm/**'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Install Helm
+        uses: azure/setup-helm@v4
+
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@v1.6.0
+        env:
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        with:
+          charts_dir: helm
+          charts_repo_url: https://gothenburgbitfactory.org/taskchampion-sync-server/helm-chart
+          pages_index_path: helm-charts
diff --git a/docs/src/SUMMARY.md b/docs/src/SUMMARY.md
index 3ce3908..2d76cd9 100644
--- a/docs/src/SUMMARY.md
+++ b/docs/src/SUMMARY.md
@@ -2,9 +2,10 @@
 
 - [Introduction](./introduction.md)
 - [Usage](./usage.md)
-  - [Docker Compose](./usage/docker-compose.md)
-  - [Docker Images](./usage/docker-images.md)
   - [Binaries](./usage/binaries.md)
+  - [Docker Images](./usage/docker-images.md)
+  - [Docker Compose](./usage/docker-compose.md)
+  - [Helm](./usage/helm.md)
 - [Integration](./integration.md)
   - [Pre-built Images](./integration/pre-built.md)
   - [Rust Crates](./integration/crates.md)
diff --git a/docs/src/usage/helm.md b/docs/src/usage/helm.md
new file mode 100644
index 0000000..bc74215
--- /dev/null
+++ b/docs/src/usage/helm.md
@@ -0,0 +1,60 @@
+# Helm
+
+A Helm chart is available for deploying taskchampion-sync-server on Kubernetes.
+
+## Adding the Repository
+
+```sh
+helm repo add taskchampion https://gothenburgbitfactory.org/taskchampion-sync-server/helm-charts
+helm repo update
+```
+
+## Installing the Chart
+
+The chart requires exactly one storage backend to be enabled. To install with
+the SQLite backend:
+
+```sh
+helm install taskchampion-sync-server taskchampion/taskchampion-sync-server \
+  --set sqlite.enabled=true
+```
+
+To install with the Postgres backend, provide the connection details:
+
+```sh
+helm install taskchampion-sync-server taskchampion/taskchampion-sync-server \
+  --set postgres.enabled=true \
+  --set postgres.host=my-postgres \
+  --set postgres.database=taskchampion \
+  --set postgres.username=myuser \
+  --set postgres.password=mypassword
+```
+
+Alternatively, pass an existing Secret name via `postgres.existingSecret`. The
+secret must contain a `connection` key holding a [LibPQ-style connection
+URI](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING-URIS).
+
+## Configuration
+
+The chart does not implement TLS. The expectation is that a Kubernetes ingress
+or gateway will terminate TLS and proxy HTTP traffic to the server container.
+Enable one of the built-in options or configure your own:
+
+```sh
+# NGINX ingress
+--set ingress.enabled=true --set ingress.hosts[0]=taskchampion.example.com
+
+# Gateway API HTTPRoute
+--set httpRoute.enabled=true \
+--set httpRoute.gateway=my-gateway \
+--set httpRoute.host=taskchampion.example.com
+```
+
+To restrict which client IDs the server accepts, create a Secret containing a
+newline-separated list of UUIDs and reference it:
+
+```sh
+--set clientIdSecret=my-client-ids-secret
+```
+
+See the chart's `values.yaml` for the full set of configuration options.