From eee66c5475eb4a64d3833835fe1f1d3c256ccd2b Mon Sep 17 00:00:00 2001
From: Jansen Fuller <jansendfuller@mailfence.com>
Date: Fri, 1 May 2026 10:15:27 -0600
Subject: [PATCH] Validation for postges

---
 .../templates/_helpers.tpl                    | 65 +++++++++++++++++++
 .../templates/deployment.yaml                 | 12 +---
 2 files changed, 66 insertions(+), 11 deletions(-)

diff --git a/helm/taskchampion-sync-server/templates/_helpers.tpl b/helm/taskchampion-sync-server/templates/_helpers.tpl
index be73dc9..b436ee4 100644
--- a/helm/taskchampion-sync-server/templates/_helpers.tpl
+++ b/helm/taskchampion-sync-server/templates/_helpers.tpl
@@ -39,3 +39,68 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{- define "taskchampion-sync-server.postgres-connection" -}}
+  {{- $secret := .Values.postgres.existingSecret -}}
+  {{- $secretData := "" -}}
+  {{- if $secret -}}
+    {{- $secretData = (lookup "v1" "Secret" .Release.Namespace $secret).data -}}
+  {{- end -}}
+  
+  {{- $host := "" -}}
+  {{- $port := "5432" -}}
+  {{- $username := "" -}}
+  {{- $password := "" -}}
+  {{- $database := "taskchampion" -}}
+  
+  {{- /* Get values from secret (higher priority) */ -}}
+  {{- if $secretData -}}
+    {{- if hasKey $secretData "host" -}}
+      {{- $host = (b64dec $secretData.host) -}}
+    {{- end -}}
+    {{- if hasKey $secretData "port" -}}
+      {{- $port = (b64dec $secretData.port) -}}
+    {{- end -}}
+    {{- if hasKey $secretData "username" -}}
+      {{- $username = (b64dec $secretData.username) -}}
+    {{- end -}}
+    {{- if hasKey $secretData "password" -}}
+      {{- $password = (b64dec $secretData.password) -}}
+    {{- end -}}
+    {{- if hasKey $secretData "database" -}}
+      {{- $database = (b64dec $secretData.database) -}}
+    {{- end -}}
+  {{- end -}}
+  
+  {{- /* Fallback to values.yaml */ -}}
+  {{- if eq $host "" -}}
+    {{- $host = .Values.postgres.host -}}
+  {{- end -}}
+  {{- if eq $username "" -}}
+    {{- $username = .Values.postgres.username -}}
+  {{- end -}}
+  {{- if eq $password "" -}}
+    {{- $password = .Values.postgres.password -}}
+  {{- end -}}
+  {{- if eq $database "" -}}
+    {{- $database = .Values.postgres.database -}}
+  {{- end -}}
+  
+  {{- /* Build URI */ -}}
+  {{- $uri := printf "postgresql://" -}}
+  {{- if ne $username "" -}}
+    {{- $uri = printf "%s%s" $uri $username -}}
+    {{- if ne $password "" -}}
+      {{- $uri = printf "%s:%s" $uri $password -}}
+    {{- end -}}
+    {{- $uri = printf "%s@" $uri -}}
+  {{- end -}}
+  {{- $uri = printf "%s%s" $uri $host -}}
+  {{- if ne $port "5432" -}}
+    {{- $uri = printf "%s:%s" $uri $port -}}
+  {{- end -}}
+  {{- if ne $database "taskchampion" -}}
+    {{- $uri = printf "%s/%s" $uri $database -}}
+  {{- end -}}
+  {{- $uri -}}
+{{- end -}}
diff --git a/helm/taskchampion-sync-server/templates/deployment.yaml b/helm/taskchampion-sync-server/templates/deployment.yaml
index aef6395..ccc44b1 100644
--- a/helm/taskchampion-sync-server/templates/deployment.yaml
+++ b/helm/taskchampion-sync-server/templates/deployment.yaml
@@ -52,17 +52,7 @@ spec:
             {{- end }}
             {{- if eq .Values.postgres.enabled true }}
             - name: CONNECTION
-              valueFrom:
-                secretKeyRef:
-                  name: {{ required "postgres.existingSecret is required when postgres is enabled" .Values.postgres.existingSecret }}
-                  key: connection
-                  optional: true
-            - name: PGPASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Values.postgres.existingSecret }}
-                  key: password
-                  optional: true
+              value: {{ include "taskchampion-sync-server.postgres-connection" . | quote }}
             {{- end }}
           ports:
             - name: http