Add more specific settings for HTTPRoute (#203)

* Adding Helm chart

* Update maintainer

* Updating filesystem settings to prevent issues

* CREATE_CLIENTS is now true by default

* Add name override options

* Validation for postges

* Fix plain connection string in pod env

* Simplifying secret management

* Fix port quoting

* Init container to run sql file

* Fix port type

* Fix secret management

* Working now

* Fixing Postgres connection issue

* Upgrade postgres init container

* Auto add UUIDs when starting postgres

* feat: Use standard value names for adding HTTPReoute

* fix: Remove merge issues

* chore: bump version

.github/dependabot.yml

@@ -5,6 +5,9 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns: ["*"]
   # Enable updates for Rust packages
   - package-ecosystem: "cargo"
     directory: "/" # Location of package manifests
@@ -16,3 +19,8 @@ updates:
       # behind
       - dependency-name: "*"
         update-types: ["version-update:semver-patch"]
+    groups:
+      cargo:
+        patterns: ["*"]
+        # leave major changes in their own PRs
+        update-types: ["minor", "patch"]

.github/workflows/add-to-project.yml

@@ -0,0 +1,18 @@
+# This adds all new issues to the Taskwarrior project, for better tracking.
+# It uses a PAT that belongs to @taskwarrior.
+name: Add issues to Taskwarrior Project
+
+on:
+  issues:
+    types:
+      - opened
+
+jobs:
+  add-to-project:
+    name: Add issue to project
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/add-to-project@v2.0.0
+        with:
+          project-url: https://github.com/orgs/GothenburgBitFactory/projects/4
+          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/checks.yml

@@ -13,16 +13,16 @@ jobs:
     name: "Check & Clippy"
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Cache cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cargo/registry
           key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Cache cargo build
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: target
           key: ${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}
@@ -48,10 +48,10 @@ jobs:
     name: "Rustdoc"
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Cache cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cargo/registry
           key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
@@ -96,7 +96,7 @@ jobs:
     runs-on: ubuntu-latest
     name: "Formatting"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - uses: actions-rs/toolchain@v1
         with:
@@ -114,7 +114,7 @@ jobs:
     runs-on: ubuntu-latest
     name: "Cargo Semver Checks"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: obi1kenobi/cargo-semver-checks-action@v2
         with:
           # exclude the binary package from semver checks, since it is not published as a crate.
@@ -125,7 +125,7 @@ jobs:
     name: "mdBook Documentation"
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Setup mdBook
         uses: peaceiris/actions-mdbook@v2

.github/workflows/docker.yml

@@ -10,18 +10,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       - name: Login to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Docker meta
         id: meta-sqlite
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ghcr.io/gothenburgbitfactory/taskchampion-sync-server
@@ -31,7 +31,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=match,pattern=\d.\d.\d,value=latest
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           file: "./Dockerfile-sqlite"
           platforms: linux/amd64,linux/arm64
@@ -42,16 +42,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Login to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Docker meta
         id: meta-postgres
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ghcr.io/gothenburgbitfactory/taskchampion-sync-server-postgres
@@ -61,7 +61,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=match,pattern=\d.\d.\d,value=latest
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           file: "./Dockerfile-postgres"
           platforms: linux/amd64,linux/arm64

.github/workflows/helm-test.yml

@@ -0,0 +1,171 @@
+name: Helm Chart Tests
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'helm/**'
+  pull_request:
+    paths:
+      - 'helm/**'
+
+jobs:
+  helm-test:
+    runs-on: ubuntu-latest
+    name: "Helm Lint & Template"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Helm
+        uses: azure/setup-helm@v5
+        with:
+          version: latest
+
+      - name: Helm lint (default values — expects failure, no backend enabled)
+        run: |
+          helm lint helm/taskchampion-sync-server \
+            --strict 2>&1 || true
+
+      - name: Template default values — must fail validation
+        run: |
+          if helm template test-release helm/taskchampion-sync-server 2>/dev/null; then
+            echo "❌ Expected chart to fail validation (no backend enabled) but it succeeded"
+            exit 1
+          fi
+          echo "✓ Correctly rejects chart with no backend enabled"
+
+      - name: Template with SQLite values
+        run: |
+          helm template test-release helm/taskchampion-sync-server \
+            -f helm/taskchampion-sync-server/examples/sqlite-values.yaml \
+            --debug > /tmp/helm-sqlite.yaml
+
+          echo "=== Generated resources (SQLite) ==="
+          grep -E '^# Source:' /tmp/helm-sqlite.yaml
+
+          # Verify key resources exist
+          grep -q 'kind: Deployment' /tmp/helm-sqlite.yaml
+          grep -q 'kind: Service' /tmp/helm-sqlite.yaml
+          grep -q 'kind: Ingress' /tmp/helm-sqlite.yaml
+          grep -q 'kind: ServiceAccount' /tmp/helm-sqlite.yaml
+
+          # Verify SQLite-specific rendering
+          grep -q 'emptyDir' /tmp/helm-sqlite.yaml
+          grep -q 'DATA_DIR' /tmp/helm-sqlite.yaml
+
+          # Verify PostgreSQL-specific rendering is absent
+          if grep -q 'initContainers' /tmp/helm-sqlite.yaml; then
+            echo "❌ initContainers should not appear in SQLite mode"
+            exit 1
+          fi
+          if grep -q 'CONNECTION' /tmp/helm-sqlite.yaml; then
+            echo "❌ CONNECTION env var should not appear in SQLite mode"
+            exit 1
+          fi
+
+          # Verify correct image tag (no -postgres suffix)
+          grep -q 'image:.*taskchampion-sync-server:0.7.0' /tmp/helm-sqlite.yaml
+          echo "✓ SQLite template generated successfully"
+
+      - name: Template with PostgreSQL values
+        run: |
+          helm template test-release helm/taskchampion-sync-server \
+            -f helm/taskchampion-sync-server/examples/postgres-values.yaml \
+            --debug > /tmp/helm-postgres.yaml
+
+          echo "=== Generated resources (PostgreSQL) ==="
+          grep -E '^# Source:' /tmp/helm-postgres.yaml
+
+          # Verify key resources exist
+          grep -q 'kind: Deployment' /tmp/helm-postgres.yaml
+          grep -q 'kind: Service' /tmp/helm-postgres.yaml
+          grep -q 'kind: Secret' /tmp/helm-postgres.yaml
+          grep -q 'kind: ServiceAccount' /tmp/helm-postgres.yaml
+
+          # Verify PostgreSQL-specific rendering
+          grep -q 'kind: HTTPRoute' /tmp/helm-postgres.yaml
+          grep -q 'initContainers' /tmp/helm-postgres.yaml
+          grep -q 'CONNECTION' /tmp/helm-postgres.yaml
+          grep -q 'replicas: 3' /tmp/helm-postgres.yaml
+
+          # Verify correct image tag (with -postgres suffix)
+          grep -q 'image:.*taskchampion-sync-server-postgres:0.7.0' /tmp/helm-postgres.yaml
+
+          # Verify SQLite-specific rendering is absent
+          if grep -q 'DATA_DIR' /tmp/helm-postgres.yaml; then
+            echo "❌ DATA_DIR env var should not appear in PostgreSQL mode"
+            exit 1
+          fi
+          echo "✓ PostgreSQL template generated successfully"
+
+      - name: Template with both backends enabled — must fail validation
+        run: |
+          if helm template test-release helm/taskchampion-sync-server \
+            --set sqlite.enabled=true \
+            --set postgres.enabled=true 2>/dev/null; then
+            echo "❌ Expected chart to fail validation (both backends enabled) but it succeeded"
+            exit 1
+          fi
+          echo "✓ Correctly rejects chart with both backends enabled"
+
+      - name: Template with custom overrides
+        run: |
+          helm template test-release helm/taskchampion-sync-server \
+            --set sqlite.enabled=true \
+            --set postgres.enabled=false \
+            --set nameOverride=custom-name \
+            --set image.tag=latest \
+            --debug > /tmp/helm-custom.yaml
+
+          # Verify custom name override
+          grep -q 'custom-name' /tmp/helm-custom.yaml
+          grep -q 'custom-name-pvc' /tmp/helm-custom.yaml
+
+          # Verify custom image tag
+          grep -q 'image:.*taskchampion-sync-server:latest' /tmp/helm-custom.yaml
+          echo "✓ Custom overrides template generated successfully"
+
+      - name: Helm install dry-run (SQLite)
+        run: |
+          helm install test-release helm/taskchampion-sync-server \
+            -f helm/taskchampion-sync-server/examples/sqlite-values.yaml \
+            --dry-run 2>&1 | head -5
+          echo "✓ Helm install dry-run (SQLite) succeeded"
+
+  helm-kubeconform:
+    runs-on: ubuntu-latest
+    name: "Kubeconform Validation"
+    needs: helm-test
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Helm
+        uses: azure/setup-helm@v5
+        with:
+          version: latest
+
+      - name: Download kubeconform
+        run: |
+          wget -q -O /tmp/kubeconform.tar.gz \
+            https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz
+          tar -xzf /tmp/kubeconform.tar.gz -C /usr/local/bin/ kubeconform
+          kubeconform -v
+
+      - name: Validate SQLite output against Kubernetes schemas
+        run: |
+          helm template test-release helm/taskchampion-sync-server \
+            -f helm/taskchampion-sync-server/examples/sqlite-values.yaml > /tmp/helm-sqlite.yaml
+          kubeconform -strict /tmp/helm-sqlite.yaml
+          echo "✓ SQLite resources are valid Kubernetes manifests"
+
+      - name: Validate PostgreSQL output against Kubernetes schemas
+        run: |
+          helm template test-release helm/taskchampion-sync-server \
+            -f helm/taskchampion-sync-server/examples/postgres-values.yaml > /tmp/helm-postgres.yaml
+          # Skip kubeconform on HTTPRoute since Gateway API CRDs aren't bundled
+          kubeconform -strict -ignore-missing-schemas /tmp/helm-postgres.yaml
+          echo "✓ PostgreSQL resources are valid Kubernetes manifests"

.github/workflows/publish-docs.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Setup mdBook
         uses: peaceiris/actions-mdbook@v2
@@ -28,3 +28,4 @@ jobs:
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./docs/book
+          keep_files: true

.github/workflows/publish-helm.yml

@@ -0,0 +1,37 @@
+name: Publish Helm Charts
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'helm/**'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Install Helm
+        uses: azure/setup-helm@v5
+
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@v1.7.0
+        env:
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        with:
+          charts_dir: helm
+          charts_repo_url: https://gothenburgbitfactory.org/taskchampion-sync-server/helm-chart
+          pages_index_path: helm-charts

.github/workflows/rust-tests.yml

@@ -15,7 +15,7 @@ jobs:
           - "17"
         rust:
           # MSRV
-          - "1.85.0"
+          - "1.88.0"
           - "stable"
 
     runs-on: ubuntu-latest
@@ -39,16 +39,16 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
 
       - name: Cache cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cargo/registry
           key: ${{ runner.os }}-${{ matrix.rust }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Cache cargo build
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: target
           key: ${{ runner.os }}-${{ matrix.rust }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}

.github/workflows/security.yml

@@ -14,7 +14,7 @@ jobs:
     permissions: write-all
     name: "Audit Rust Dependencies"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: rustsec/audit-check@v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

Cargo.lock

@@ -21,9 +21,9 @@ dependencies = [
 
 [[package]]
 name = "actix-http"
-version = "3.11.0"
+version = "3.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44dfe5c9e0004c623edc65391dfd51daa201e7e30ebd9c9bedf873048ec32bc2"
+checksum = "93acb4a42f64936f9b8cae4a433b237599dd6eb6ed06124eb67132ef8cc90662"
 dependencies = [
  "actix-codec",
  "actix-rt",
@@ -49,7 +49,7 @@ dependencies = [
  "mime",
  "percent-encoding",
  "pin-project-lite",
- "rand",
+ "rand 0.10.1",
  "sha1",
  "smallvec",
  "tokio",
@@ -70,9 +70,9 @@ dependencies = [
 
 [[package]]
 name = "actix-router"
-version = "0.5.3"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13d324164c51f63867b57e73ba5936ea151b8a41a1d23d1031eeb9f70d0236f8"
+checksum = "14f8c75c51892f18d9c46150c5ac7beb81c95f78c8b83a634d49f4ca32551fe7"
 dependencies = [
  "bytestring",
  "cfg-if",
@@ -133,9 +133,9 @@ dependencies = [
 
 [[package]]
 name = "actix-web"
-version = "4.11.0"
+version = "4.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a597b77b5c6d6a1e1097fddde329a83665e25c5437c696a3a9a4aa514a614dea"
+checksum = "ff87453bc3b56e9b2b23c1cc0b1be8797184accf51d2abe0f8a33ec275d316bf"
 dependencies = [
  "actix-codec",
  "actix-http",
@@ -168,7 +168,7 @@ dependencies = [
  "serde_json",
  "serde_urlencoded",
  "smallvec",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "time",
  "tracing",
  "url",
@@ -192,18 +192,6 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
-[[package]]
-name = "ahash"
-version = "0.8.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
-dependencies = [
- "cfg-if",
- "once_cell",
- "version_check",
- "zerocopy",
-]
-
 [[package]]
 name = "aho-corasick"
 version = "1.1.3"
@@ -250,7 +238,22 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "301af1932e46185686725e0fad2f8f2aa7da69dd70bf6ecc44d6b703844a3933"
 dependencies = [
  "anstyle",
- "anstyle-parse",
+ "anstyle-parse 0.2.7",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse 1.0.0",
  "anstyle-query",
  "anstyle-wincon",
  "colorchoice",
@@ -260,9 +263,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.11"
+version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
 
 [[package]]
 name = "anstyle-parse"
@@ -273,6 +276,15 @@ dependencies = [
  "utf8parse",
 ]
 
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
 [[package]]
 name = "anstyle-query"
 version = "1.1.3"
@@ -359,6 +371,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "brotli"
 version = "8.0.1"
@@ -394,9 +415,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "bytestring"
@@ -424,6 +445,17 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
 
+[[package]]
+name = "chacha20"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.41"
@@ -441,20 +473,20 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.41"
+version = "4.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be92d32e80243a54711e5d7ce823c35c41c9d929dc4ab58e1276f625841aadf9"
+checksum = "b193af5b67834b676abd72466a96c1024e6a6ad978a1f484bd90b85c94041351"
 dependencies = [
  "clap_builder",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.5.41"
+version = "4.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707eab41e9622f9139419d573eca0900137718000c517d47da73045f54331c3d"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
 dependencies = [
- "anstream",
+ "anstream 1.0.0",
  "anstyle",
  "clap_lex",
  "strsim",
@@ -462,9 +494,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.7.5"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b94f61472cee1439c0b966b47e3aca9ae07e45d070759512cd390ea2bebc6675"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
 [[package]]
 name = "colorchoice"
@@ -472,6 +504,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "cookie"
 version = "0.16.2"
@@ -508,6 +546,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crc32fast"
 version = "1.4.2"
@@ -528,10 +575,19 @@ dependencies = [
 ]
 
 [[package]]
-name = "deranged"
-version = "0.4.0"
+name = "crypto-common"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
+checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ececcb659e7ba858fb4f10388c250a7252eb0a27373f1a72b8748afdd248e587"
 dependencies = [
  "powerfmt",
 ]
@@ -569,11 +625,22 @@ version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer",
- "crypto-common",
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.6",
  "subtle",
 ]
 
+[[package]]
+name = "digest"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4850db49bf08e663084f7fb5c87d202ef91a3907271aff24a94eb97ff039153c"
+dependencies = [
+ "block-buffer 0.12.0",
+ "const-oid",
+ "crypto-common 0.2.1",
+]
+
 [[package]]
 name = "displaydoc"
 version = "0.2.5"
@@ -610,7 +677,7 @@ version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13c863f0904021b108aa8b2f55046443e6b1ebde8fd4a15c399893aae4fa069f"
 dependencies = [
- "anstream",
+ "anstream 0.6.19",
  "anstyle",
  "env_filter",
  "jiff",
@@ -815,10 +882,24 @@ dependencies = [
 ]
 
 [[package]]
-name = "h2"
-version = "0.3.26"
+name = "getrandom"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
+checksum = "139ef39800118c7683f2fd3c98c1b23c09ae076556b435f8e9064ae108aaeeec"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "rand_core 0.10.1",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "h2"
+version = "0.3.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d"
 dependencies = [
  "bytes",
  "fnv",
@@ -833,37 +914,37 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-dependencies = [
- "ahash",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.15.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
+dependencies = [
+ "foldhash",
+]
 
 [[package]]
 name = "hashlink"
-version = "0.9.1"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
+checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
 dependencies = [
- "hashbrown 0.14.5",
+ "hashbrown",
 ]
 
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
 [[package]]
 name = "hmac"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -889,6 +970,15 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3944cf8cf766b40e2a1a333ee5e9b563f854d5fa49d6a8ca2764e97c6eddb214"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "iana-time-zone"
 version = "0.1.63"
@@ -999,6 +1089,12 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
 [[package]]
 name = "idna"
 version = "1.0.3"
@@ -1033,7 +1129,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe4cd85333e22411419a0bcae1297d25e58c9443848b11dc6a86fefe8c78a661"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.4",
+ "hashbrown",
+ "serde",
 ]
 
 [[package]]
@@ -1078,7 +1175,7 @@ version = "0.1.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "38f262f097c174adebe41eb73d66ae9c06b2844fb0da69969647bbddd9b0538a"
 dependencies = [
- "getrandom",
+ "getrandom 0.3.3",
  "libc",
 ]
 
@@ -1099,16 +1196,22 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d4345964bb142484797b161f473a503a434de77149dd8c7427788c6e13379388"
 
 [[package]]
-name = "libc"
-version = "0.2.174"
+name = "leb128fmt"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.184"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48f5d2a454e16a5ea0f4ced81bd44e4cfc7bd3a507b61887c99fd3538b28e4af"
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.30.1"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+checksum = "133c182a6a2c87864fe97778797e46c7e999672690dc9fa3ee8e241aa4a9c13f"
 dependencies = [
  "cc",
  "pkg-config",
@@ -1117,9 +1220,9 @@ dependencies = [
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.9.4"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
@@ -1167,7 +1270,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
 dependencies = [
  "cfg-if",
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -1193,14 +1296,14 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.0.4"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
+checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
 dependencies = [
  "libc",
  "log",
  "wasi 0.11.1+wasi-snapshot-preview1",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1222,9 +1325,9 @@ dependencies = [
 
 [[package]]
 name = "num-conv"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
 
 [[package]]
 name = "num-traits"
@@ -1249,15 +1352,14 @@ checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
 
 [[package]]
 name = "openssl"
-version = "0.10.73"
+version = "0.10.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8"
+checksum = "a45fa2aa886c42762255da344f0a0d313e254066c46aad76f300c3d3da62d967"
 dependencies = [
  "bitflags",
  "cfg-if",
  "foreign-types",
  "libc",
- "once_cell",
  "openssl-macros",
  "openssl-sys",
 ]
@@ -1290,9 +1392,9 @@ dependencies = [
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.109"
+version = "0.9.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571"
+checksum = "f28a22dc7140cda5f096e5e7724a6962ca81a7f8bfd2979f9b18c11af56318c4"
 dependencies = [
  "cc",
  "libc",
@@ -1406,7 +1508,7 @@ dependencies = [
  "hmac",
  "md-5",
  "memchr",
- "rand",
+ "rand 0.9.4",
  "sha2",
  "stringprep",
 ]
@@ -1457,6 +1559,16 @@ dependencies = [
  "yansi",
 ]
 
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.95"
@@ -1483,12 +1595,23 @@ checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
 [[package]]
 name = "rand"
-version = "0.9.1"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
  "rand_chacha",
- "rand_core",
+ "rand_core 0.9.3",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.1",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -1498,7 +1621,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.9.3",
 ]
 
 [[package]]
@@ -1507,9 +1630,15 @@ version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
 dependencies = [
- "getrandom",
+ "getrandom 0.3.3",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.13"
@@ -1556,9 +1685,9 @@ checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
 
 [[package]]
 name = "rusqlite"
-version = "0.32.1"
+version = "0.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
+checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f"
 dependencies = [
  "bitflags",
  "fallible-iterator 0.3.0",
@@ -1570,15 +1699,15 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.0.7"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
  "bitflags",
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1632,19 +1761,35 @@ dependencies = [
 ]
 
 [[package]]
-name = "serde"
-version = "1.0.219"
+name = "semver"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.219"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1677,13 +1822,13 @@ dependencies = [
 
 [[package]]
 name = "sha1"
-version = "0.10.6"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
 dependencies = [
  "cfg-if",
- "cpufeatures",
- "digest",
+ "cpufeatures 0.3.0",
+ "digest 0.11.2",
 ]
 
 [[package]]
@@ -1693,8 +1838,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures",
- "digest",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -1742,12 +1887,12 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.6.0"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807"
+checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1781,9 +1926,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.104"
+version = "2.0.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
+checksum = "3df424c70518695237746f84cede799c9c58fcb37450d7b23716568cc8bc69cb"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1890,15 +2035,15 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.23.0"
+version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom",
+ "getrandom 0.4.1",
  "once_cell",
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1923,30 +2068,30 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.41"
+version = "0.3.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
 dependencies = [
  "deranged",
  "itoa",
  "num-conv",
  "powerfmt",
- "serde",
+ "serde_core",
  "time-core",
  "time-macros",
 ]
 
 [[package]]
 name = "time-core"
-version = "0.1.4"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
 
 [[package]]
 name = "time-macros"
-version = "0.2.22"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
 dependencies = [
  "num-conv",
  "time-core",
@@ -1979,9 +2124,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.48.0"
+version = "1.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff360e02eab121e0bc37a2d3b4d4dc622e6eda3a8e5253d5435ecf5bd4c68408"
+checksum = "a91135f59b1cbf38c91e73cf3386fca9bb77915c45ce2771460c9d92f0f3d776"
 dependencies = [
  "bytes",
  "libc",
@@ -1989,16 +2134,16 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.6.0",
+ "socket2 0.6.3",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.6.0"
+version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2034,7 +2179,7 @@ dependencies = [
  "pin-project-lite",
  "postgres-protocol",
  "postgres-types",
- "rand",
+ "rand 0.9.4",
  "socket2 0.5.10",
  "tokio",
  "tokio-util",
@@ -2150,13 +2295,13 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.18.0"
+version = "1.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f33196643e165781c20a5ead5582283a7dacbb87855d867fbc2df3f81eddc1be"
+checksum = "5ac8b6f42ead25368cf5b098aeb3dc8a1a2c05a3eee8a9a1a68c640edbfc79d9"
 dependencies = [
- "getrandom",
+ "getrandom 0.4.1",
  "js-sys",
- "serde",
+ "serde_core",
  "wasm-bindgen",
 ]
 
@@ -2187,6 +2332,24 @@ dependencies = [
  "wit-bindgen-rt",
 ]
 
+[[package]]
+name = "wasip2"
+version = "1.0.2+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen",
+]
+
 [[package]]
 name = "wasite"
 version = "0.1.0"
@@ -2251,6 +2414,40 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown",
+ "indexmap",
+ "semver",
+]
+
 [[package]]
 name = "web-sys"
 version = "0.3.77"
@@ -2428,6 +2625,26 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
 [[package]]
 name = "wit-bindgen-rt"
 version = "0.39.0"
@@ -2437,6 +2654,74 @@ dependencies = [
  "bitflags",
 ]
 
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
 [[package]]
 name = "writeable"
 version = "0.6.1"

Cargo.toml

@@ -6,30 +6,30 @@ members = [
   "sqlite",
   "postgres",
 ]
-rust-version = "1.85.0" # MSRV
+rust-version = "1.88.0" # MSRV
 
 [workspace.dependencies]
 async-trait = "0.1.88"
-uuid = { version = "^1.18.0", features = ["serde", "v4"] }
-actix-web = "^4.11.0"
+uuid = { version = "^1.23.0", features = ["serde", "v4"] }
+actix-web = "^4.13.0"
 anyhow = "1.0"
 thiserror = "2.0"
 futures = "^0.3.25"
 serde_json = "^1.0"
 serde = { version = "^1.0.147", features = ["derive"] }
-clap = { version = "^4.5.6", features = ["string", "env"] }
+clap = { version = "^4.5.60", features = ["string", "env"] }
 log = "^0.4.17"
 env_logger = "^0.11.7"
-rusqlite = { version = "0.32", features = ["bundled"] }
+rusqlite = { version = "0.37", features = ["bundled"] }
 chrono = { version = "^0.4.38", features = ["serde"] }
 actix-rt = "2"
 tempfile = "3"
 pretty_assertions = "1"
 temp-env = "0.3"
-tokio = { version = "1.48", features = ["rt", "macros"] }
+tokio = { version = "1.52", features = ["rt", "macros"] }
 tokio-postgres = { version = "0.7.13", features = ["with-uuid-1"] }
 bb8 = "0.9.0"
 bb8-postgres = { version = "0.9.0", features = ["with-uuid-1"] }
-openssl = { version = "0.10.73", default-features = false, features = ["vendored"] }
+openssl = { version = "0.10.80", default-features = false, features = ["vendored"] }
 native-tls = { version = "0.2.14", default-features = false, features = ["vendored"] }
 postgres-native-tls = "0.5.1"

Dockerfile-postgres

@@ -1,6 +1,7 @@
 # Versions must be major.minor
 # Default versions are as below
-ARG RUST_VERSION=1.85
+# RUST_VERSION should match the MSRV in Cargo.toml.
+ARG RUST_VERSION=1.88
 ARG ALPINE_VERSION=3.20
 
 FROM docker.io/rust:${RUST_VERSION}-alpine${ALPINE_VERSION} AS builder

Dockerfile-sqlite

@@ -1,6 +1,7 @@
 # Versions must be major.minor
 # Default versions are as below
-ARG RUST_VERSION=1.85
+# RUST_VERSION should match the MSRV in Cargo.toml.
+ARG RUST_VERSION=1.88
 ARG ALPINE_VERSION=3.20
 
 FROM docker.io/rust:${RUST_VERSION}-alpine${ALPINE_VERSION} AS builder

README.md

@@ -74,20 +74,17 @@ To build the images, execute the following commands.
 
 SQLite:
 ```sh
-source .env
 docker build \
-  --build-arg RUST_VERSION=${RUST_VERSION} \
-  --build-arg ALPINE_VERSION=${ALPINE_VERSION} \
-  -t taskchampion-sync-server docker/sqlite
+  -t taskchampion-sync-server \
+  -f Dockerfile-sqlite .
 ```
 
 Postgres:
 ```sh
 source .env
 docker build \
-  --build-arg RUST_VERSION=${RUST_VERSION} \
-  --build-arg ALPINE_VERSION=${ALPINE_VERSION} \
-  -t taskchampion-sync-server-postgres docker/postgres
+  -t taskchampion-sync-server-postgres \
+  -f Dockerfile-postgres .
 ```
 
 Now to run it, simply exec.

docs/src/SUMMARY.md

@@ -2,9 +2,10 @@
 
 - [Introduction](./introduction.md)
 - [Usage](./usage.md)
-  - [Docker Compose](./usage/docker-compose.md)
-  - [Docker Images](./usage/docker-images.md)
   - [Binaries](./usage/binaries.md)
+  - [Docker Images](./usage/docker-images.md)
+  - [Docker Compose](./usage/docker-compose.md)
+  - [Helm](./usage/helm.md)
 - [Integration](./integration.md)
   - [Pre-built Images](./integration/pre-built.md)
   - [Rust Crates](./integration/crates.md)

docs/src/usage/helm.md

@@ -0,0 +1,60 @@
+# Helm
+
+A Helm chart is available for deploying taskchampion-sync-server on Kubernetes.
+
+## Adding the Repository
+
+```sh
+helm repo add taskchampion https://gothenburgbitfactory.org/taskchampion-sync-server/helm-chart
+helm repo update
+```
+
+## Installing the Chart
+
+The chart requires exactly one storage backend to be enabled. To install with
+the SQLite backend:
+
+```sh
+helm install taskchampion-sync-server taskchampion/taskchampion-sync-server \
+  --set sqlite.enabled=true
+```
+
+To install with the Postgres backend, provide the connection details:
+
+```sh
+helm install taskchampion-sync-server taskchampion/taskchampion-sync-server \
+  --set postgres.enabled=true \
+  --set postgres.host=my-postgres \
+  --set postgres.database=taskchampion \
+  --set postgres.username=myuser \
+  --set postgres.password=mypassword
+```
+
+Alternatively, pass an existing Secret name via `postgres.existingSecret`. The
+secret must contain a `connection` key holding a [LibPQ-style connection
+URI](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING-URIS).
+
+## Configuration
+
+The chart does not implement TLS. The expectation is that a Kubernetes ingress
+or gateway will terminate TLS and proxy HTTP traffic to the server container.
+Enable one of the built-in options or configure your own:
+
+```sh
+# NGINX ingress
+--set ingress.enabled=true --set ingress.hosts[0]=taskchampion.example.com
+
+# Gateway API HTTPRoute
+--set httpRoute.enabled=true \
+--set httpRoute.gateway=my-gateway \
+--set httpRoute.host=taskchampion.example.com
+```
+
+To restrict which client IDs the server accepts, create a Secret containing a
+newline-separated list of UUIDs and reference it:
+
+```sh
+--set clientIdSecret=my-client-ids-secret
+```
+
+See the chart's `values.yaml` for the full set of configuration options.

helm/taskchampion-sync-server/.helmignore

@@ -0,0 +1,5 @@
+# Patterns to ignore when building the Helm chart
+.git
+.gitignore
+*.md
+examples/

helm/taskchampion-sync-server/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: taskchampion-sync-server
+description: A Helm chart for deploying TaskChampion Sync Server on Kubernetes
+type: application
+version: 0.1.1
+appVersion: "0.7.0"
+keywords:
+  - taskchampion
+  - taskwarrior
+  - sync
+  - task-management
+home: https://github.com/GothenburgBitFactory/taskchampion-sync-server
+sources:
+  - https://github.com/GothenburgBitFactory/taskchampion-sync-server
+maintainers: 
+  - name: Jansen Fuller
+    email: jansendfuller@mailfence.com

helm/taskchampion-sync-server/README.md

@@ -0,0 +1,60 @@
+# TaskChampion Sync Server Helm Chart
+
+Deploy the [TaskChampion Sync Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server) on Kubernetes.
+
+## Prerequisites
+
+- Kubernetes 1.23+
+- Helm 3+
+
+## Storage Backends
+
+Exactly one storage backend must be enabled. The chart will fail validation if both or neither are enabled.
+
+### SQLite
+
+```console
+helm install my-release ./helm/taskchampion-sync-server -f helm/taskchampion-sync-server/examples/sqlite-values.yaml
+```
+
+### PostgreSQL
+
+```console
+helm install my-release ./helm/taskchampion-sync-server -f helm/taskchampion-sync-server/examples/postgres-values.yaml
+```
+
+## Secrets
+
+The chart expects pre-created secrets referenced by name:
+
+### Client ID Secret
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: my-client-ids
+type: Opaque
+data:
+  client-ids: <base64-encoded comma-separated UUIDs>
+```
+
+Reference it via `clientIdSecret: "my-client-ids"`.
+
+### PostgreSQL Secret
+
+For PostgreSQL, the chart can automatically create a secret with the connection string, or use an existing secret. 
+
+**Automatic Secret Creation**:
+- When `postgres.existingSecret` is empty (default), the chart automatically creates a secret
+- Secret is named using Helm naming convention: `release-name-taskchampion-sync-server`
+- Secret contains only a `connection` key with the built connection string
+
+**Existing Secret Usage**:
+- When `postgres.existingSecret` is provided, the chart uses that secret
+- The secret **must** contain a `connection` key with the PostgreSQL connection string
+- If the secret doesn't have a `connection` key, the deployment will fail with a clear error
+
+## Configuration
+
+See [values.yaml](values.yaml) for all configurable options.

helm/taskchampion-sync-server/examples/postgres-values.yaml

@@ -0,0 +1,30 @@
+sqlite:
+  enabled: false
+
+postgres:
+  enabled: true
+  database: taskchampion
+  host: postgres-primary
+  username: taskchampion-user
+
+clientIdSecret: "taskchampion-client-ids"
+
+env:
+  RUST_LOG: debug
+  LISTEN: "0.0.0.0:8080"
+  CREATE_CLIENTS: "false"
+
+replicas:
+  enabled: true
+  count: 3
+
+image:
+  pullSecrets:
+    - my-registry-secret
+
+httpRoute:
+  enabled: true
+  gateway: "my-gateway"
+  host: "taskchampion.example.com"
+  path: "/"
+  port: 8080

helm/taskchampion-sync-server/examples/sqlite-values.yaml

@@ -0,0 +1,22 @@
+sqlite:
+  enabled: true
+  existingPV: ""
+  emptyDir:
+    sizeLimit: 1Gi
+  persistence:
+    enabled: false
+
+postgres:
+  enabled: false
+
+clientIdSecret: "taskchampion-client-ids"
+
+env:
+  RUST_LOG: info
+  LISTEN: "0.0.0.0:8080"
+  CREATE_CLIENTS: "false"
+
+ingress:
+  enabled: true
+  hosts:
+    - taskchampion.example.com

helm/taskchampion-sync-server/templates/_helpers.tpl

@@ -0,0 +1,102 @@
+{{- /*
+taskchampion-sync-server helpers
+*/ -}}
+
+{{- define "taskchampion-sync-server.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "taskchampion-sync-server.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "taskchampion-sync-server.labels" -}}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+app.kubernetes.io/name: {{ include "taskchampion-sync-server.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{- define "taskchampion-sync-server.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "taskchampion-sync-server.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{- define "taskchampion-sync-server.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "taskchampion-sync-server.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "taskchampion-sync-server.postgres-connection" -}}
+  {{- $host := .Values.postgres.host -}}
+  {{- $port := .Values.postgres.port | toString -}}
+  {{- $username := .Values.postgres.username -}}
+  {{- $password := .Values.postgres.password -}}
+  {{- $database := .Values.postgres.database -}}
+
+  {{- /* Override individual fields from existingSecret where present */ -}}
+  {{- if .Values.postgres.existingSecret -}}
+    {{- $secret := lookup "v1" "Secret" .Release.Namespace .Values.postgres.existingSecret -}}
+    {{- if $secret -}}
+      {{- if index $secret.data "host" -}}
+        {{- $host = index $secret.data "host" | b64dec -}}
+      {{- end -}}
+      {{- if index $secret.data "port" -}}
+        {{- $port = index $secret.data "port" | b64dec -}}
+      {{- end -}}
+      {{- if index $secret.data "username" -}}
+        {{- $username = index $secret.data "username" | b64dec -}}
+      {{- end -}}
+      {{- if index $secret.data "password" -}}
+        {{- $password = index $secret.data "password" | b64dec -}}
+      {{- end -}}
+      {{- if index $secret.data "database" -}}
+        {{- $database = index $secret.data "database" | b64dec -}}
+      {{- end -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- /* Build URI */ -}}
+  {{- $uri := "postgresql://" -}}
+  {{- if ne $username "" -}}
+    {{- $uri = printf "%s%s" $uri $username -}}
+    {{- if ne $password "" -}}
+      {{- $uri = printf "%s:%s" $uri $password -}}
+    {{- end -}}
+    {{- $uri = printf "%s@" $uri -}}
+  {{- end -}}
+  {{- $uri = printf "%s%s" $uri $host -}}
+  {{- if ne $port "5432" -}}
+    {{- $uri = printf "%s:%s" $uri $port -}}
+  {{- end -}}
+  {{- $uri = printf "%s/%s" $uri $database -}}
+  {{- if .Values.postgres.sslMode -}}
+    {{- $uri = printf "%s?sslmode=%s" $uri .Values.postgres.sslMode -}}
+  {{- end -}}
+  {{- $uri -}}
+{{- end -}}
+
+{{- define "taskchampion-sync-server.schema-url" -}}
+{{- if .Values.postgres.initContainer.schemaUrl -}}
+{{- .Values.postgres.initContainer.schemaUrl -}}
+{{- else -}}
+{{- printf "https://raw.githubusercontent.com/GothenburgBitFactory/taskchampion-sync-server/v%s/postgres/schema.sql" .Chart.AppVersion -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "taskchampion-sync-server.postgres-secret-name" -}}
+{{- printf "%s-connection" .Release.Name -}}
+{{- end -}}

helm/taskchampion-sync-server/templates/deployment.yaml

@@ -0,0 +1,145 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+spec:
+  {{- if and (eq .Values.postgres.enabled true) .Values.replicas.enabled }}
+  replicas: {{ .Values.replicas.count }}
+  {{- else }}
+  replicas: 1
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "taskchampion-sync-server.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "taskchampion-sync-server.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- if .Values.serviceAccount.create }}
+      serviceAccountName: {{ include "taskchampion-sync-server.fullname" . }}
+      {{- else if .Values.serviceAccount.name }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+      {{- if and .Values.postgres.enabled .Values.postgres.initContainer.enabled }}
+      initContainers:
+        - name: postgres-init
+          image: "{{ .Values.postgres.initContainer.image }}"
+          imagePullPolicy: {{ .Values.postgres.initContainer.imagePullPolicy }}
+          env:
+            - name: PGURI
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
+                  key: connection
+            - name: SCHEMA_URL
+              value: {{ include "taskchampion-sync-server.schema-url" . | quote }}
+            {{- if .Values.clientIdSecret }}
+            - name: CLIENT_IDS
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.clientIdSecret }}
+                  key: client-ids
+            {{- end }}
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              until pg_isready -d "$PGURI"; do
+                echo 'Waiting for PostgreSQL...'
+                sleep 2
+              done
+              echo "Downloading schema from ${SCHEMA_URL}..."
+              wget -qO /tmp/schema.sql "$SCHEMA_URL" || {
+                echo 'Failed to download schema - continuing with main container'
+                exit 0
+              }
+              psql "$PGURI" -f /tmp/schema.sql || {
+                echo 'Schema execution failed (SQL error) - continuing with main container'
+                exit 0
+              }
+              echo 'Schema executed successfully'
+              if [ -n "$CLIENT_IDS" ]; then
+                echo "Inserting client IDs..."
+                IFS=','
+                for client_id in $CLIENT_IDS; do
+                  client_id=$(echo "$client_id" | tr -d ' ')
+                  [ -z "$client_id" ] && continue
+                  psql "$PGURI" -c "INSERT INTO clients (client_id) VALUES ('$client_id') ON CONFLICT (client_id) DO NOTHING;" || {
+                    echo "Failed to insert client $client_id - continuing"
+                  }
+                done
+                unset IFS
+                echo "Client ID insertion complete"
+              fi
+      {{- end }}
+      containers:
+        - name: taskchampion-sync-server
+          {{- if eq .Values.postgres.enabled true }}
+          image: "{{ .Values.image.repository }}-postgres:{{ .Values.image.tag }}"
+          {{- else }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          {{- end }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+            {{- range $name, $value := .Values.env }}
+            - name: {{ $name }}
+              value: {{ $value | quote }}
+            {{- end }}
+            {{- if .Values.clientIdSecret }}
+            - name: CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.clientIdSecret }}
+                  key: client-ids
+            {{- end }}
+            {{- if eq .Values.sqlite.enabled true }}
+            - name: DATA_DIR
+              value: {{ .Values.sqlite.dataDir }}
+            {{- end }}
+            {{- if eq .Values.postgres.enabled true }}
+            - name: CONNECTION
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
+                  key: connection
+            {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.targetPort }}
+              protocol: TCP
+          {{- with .Values.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if eq .Values.sqlite.enabled true }}
+          volumeMounts:
+            - name: data
+              mountPath: {{ .Values.sqlite.dataDir }}
+          {{- end }}
+      {{- if eq .Values.sqlite.enabled true }}
+      volumes:
+        {{- if .Values.sqlite.existingPV }}
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ .Values.sqlite.existingPV }}
+        {{- else if .Values.sqlite.persistence.enabled }}
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "taskchampion-sync-server.fullname" . }}-pvc
+        {{- else }}
+        - name: data
+          emptyDir:
+            {{- if .Values.sqlite.emptyDir.sizeLimit }}
+            sizeLimit: {{ .Values.sqlite.emptyDir.sizeLimit }}
+            {{- end }}
+            {{- if .Values.sqlite.emptyDir.medium }}
+            medium: {{ .Values.sqlite.emptyDir.medium }}
+            {{- end }}
+        {{- end }}
+      {{- end }}

helm/taskchampion-sync-server/templates/httproute.yaml

@@ -0,0 +1,57 @@
+{{- if .Values.httpRoute.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+  {{- with .Values.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  parentRefs:
+    {{- if .Values.httpRoute.parentRefs }}
+    {{- range .Values.httpRoute.parentRefs }}
+    - name: {{ .name }}
+      {{- if .namespace }}
+      namespace: {{ .namespace }}
+      {{- end }}
+      {{- if .sectionName }}
+      sectionName: {{ .sectionName }}
+      {{- end }}
+    {{- end }}
+    {{- else if .Values.httpRoute.gateway }}
+    - name: {{ .Values.httpRoute.gateway }}
+    {{- end }}
+  {{- $hostnames := .Values.httpRoute.hostnames }}
+  {{- if and (not $hostnames) .Values.httpRoute.host }}
+  {{- $hostnames = list .Values.httpRoute.host }}
+  {{- end }}
+  {{- if $hostnames }}
+  hostnames:
+    {{- range $hostnames }}
+    - {{ . | quote }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- if .Values.httpRoute.rules }}
+    {{- range .Values.httpRoute.rules }}
+    - matches:
+        - path:
+            type: {{ .path.type | default "PathPrefix" }}
+            value: {{ .path.value | default "/" }}
+      backendRefs:
+        - name: {{ include "taskchampion-sync-server.fullname" $ }}
+          port: {{ .backendPort | default 8080 }}
+    {{- end }}
+    {{- else }}
+    - matches:
+        - path:
+            type: PathPrefix
+            value: {{ .Values.httpRoute.path | default "/" }}
+      backendRefs:
+        - name: {{ include "taskchampion-sync-server.fullname" . }}
+          port: {{ .Values.httpRoute.port | default 8080 }}
+    {{- end }}
+{{- end }}

helm/taskchampion-sync-server/templates/ingress.yaml

@@ -0,0 +1,33 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- toYaml .Values.ingress.tls | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ . | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "taskchampion-sync-server.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+    {{- end }}
+{{- end }}

helm/taskchampion-sync-server/templates/pvc.yaml

@@ -0,0 +1,17 @@
+{{- if and (eq .Values.sqlite.enabled true) .Values.sqlite.persistence.enabled (not .Values.sqlite.existingPV) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}-pvc
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.sqlite.persistence.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.sqlite.persistence.size }}
+  {{- if .Values.sqlite.persistence.storageClass }}
+  storageClassName: {{ .Values.sqlite.persistence.storageClass }}
+  {{- end }}
+{{- end }}

helm/taskchampion-sync-server/templates/secrets/postgres-secret.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.postgres.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+type: Opaque
+data:
+  connection: {{ include "taskchampion-sync-server.postgres-connection" . | b64enc }}
+{{- end }}

helm/taskchampion-sync-server/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: {{ .Values.service.targetPort }}
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "taskchampion-sync-server.selectorLabels" . | nindent 4 }}

helm/taskchampion-sync-server/templates/serviceaccount.yaml

@@ -0,0 +1,38 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}-secret-manager
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["create", "get", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}-secret-binding
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "taskchampion-sync-server.fullname" . }}-secret-manager
+subjects:
+- kind: ServiceAccount
+  name: {{ include "taskchampion-sync-server.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end -}}

helm/taskchampion-sync-server/templates/validation-config.yaml

@@ -0,0 +1,7 @@
+{{- if and (eq .Values.sqlite.enabled false) (eq .Values.postgres.enabled false) -}}
+{{- fail "ERROR: Exactly one storage backend must be enabled. Either sqlite.enabled or postgres.enabled must be true." -}}
+{{- end -}}
+
+{{- if and (eq .Values.sqlite.enabled true) (eq .Values.postgres.enabled true) -}}
+{{- fail "ERROR: Only one storage backend can be enabled. Both sqlite.enabled and postgres.enabled cannot be true at the same time." -}}
+{{- end -}}

helm/taskchampion-sync-server/values.yaml

@@ -0,0 +1,136 @@
+# Override the chart name used in resource names
+nameOverride: ""
+# Override the full resource name (takes precedence over nameOverride)
+fullnameOverride: ""
+
+# Image configuration
+image:
+  repository: ghcr.io/gothenburgbitfactory/taskchampion-sync-server
+  tag: "0.7.0"
+  pullPolicy: IfNotPresent
+  pullSecrets: []
+
+# Existing secret containing client IDs (comma-separated UUIDs)
+# Expected key: client-ids
+clientIdSecret: ""
+
+# Environment variables passed directly to the container
+# NOTE: DATA_DIR and CONNECTION are set automatically based on backend
+env:
+  RUST_LOG: info
+  LISTEN: "0.0.0.0:8080"
+  CREATE_CLIENTS: "true"
+
+# Service configuration
+service:
+  type: ClusterIP
+  port: 8080
+  targetPort: 8080
+
+# Ingress configuration
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  hosts: []
+  tls: []
+
+# HTTPRoute configuration (Kubernetes Gateway API)
+httpRoute:
+  enabled: false
+  annotations: {}
+
+  # List of parent gateway references.
+  # name is required; namespace and sectionName are optional.
+  parentRefs: []
+  # parentRefs:
+  #   - name: my-gateway
+  #     namespace: gateway-system  # optional — cross-namespace gateway reference
+  #     sectionName: https         # optional — targets a specific listener on the gateway
+
+  # List of hostnames the route applies to.
+  hostnames: []
+  # hostnames:
+  #   - tasks.example.com
+  #   - tasks.internal.example.com
+
+  # List of routing rules. Each rule matches a path and forwards to this chart's Service.
+  # When empty, falls back to the deprecated path/port fields below.
+  rules: []
+  # rules:
+  #   - path:
+  #       type: PathPrefix   # PathPrefix or Exact
+  #       value: /
+  #     backendPort: 8080
+
+  # Deprecated: use parentRefs instead
+  gateway: ""
+  # Deprecated: use hostnames instead
+  host: ""
+  # Deprecated: use rules instead
+  path: "/"
+  port: 8080
+
+# Resource limits and requests
+resources: {}
+  # limits:
+  #   memory: 128Mi
+  #   cpu: 100m
+  # requests:
+  #   memory: 64Mi
+  #   cpu: 50m
+
+# Replica configuration (only applies when postgres is enabled)
+replicas:
+  enabled: false
+  count: 1
+
+# Security context for the pod
+# NOTE: runAsUser and runAsGroup are intentionally unset.
+# The Docker entrypoint requires root to chown the data directory and then
+# drops privileges via su-exec to the taskchampion user (uid 1092).
+securityContext:
+  fsGroup: 100
+
+# SQLite backend configuration (mutually exclusive with postgres)
+sqlite:
+  enabled: false
+  dataDir: /var/lib/taskchampion-sync-server/data
+  existingPV: ""
+  emptyDir:
+    sizeLimit: ""
+    medium: ""
+  persistence:
+    enabled: true
+    size: 1Gi
+    accessMode: ReadWriteOnce
+    storageClass: ""
+    existingClaim: ""
+
+# Service account configuration
+serviceAccount:
+  create: true  # Default: automatically create service account
+  name: ""      # Optional: use existing service account
+  annotations: {}
+
+# PostgreSQL configuration
+postgres:
+  enabled: false
+  existingSecret: ""  # If empty, auto-create secret; if provided, use existing
+  # Individual connection components for building connection string
+  database: taskchampion
+  host: postgres
+  port: 5432
+  username: user
+  password: ""
+  # SSL mode for the PostgreSQL connection.
+  # Use 'disable' for internal cluster connections (no TLS).
+  # Options: disable, allow, prefer, require, verify-ca, verify-full
+  sslMode: disable
+  initContainer:
+    enabled: true
+    image: postgres:17-alpine
+    imagePullPolicy: IfNotPresent
+    # Override the schema URL. Defaults to the official schema for this chart's appVersion.
+    # e.g. https://raw.githubusercontent.com/GothenburgBitFactory/taskchampion-sync-server/v0.7.0/postgres/schema.sql
+    schemaUrl: ""