Bump uuid from 1.23.0 to 1.24.0 in the cargo group

Bumps the cargo group with 1 update: [uuid](https://github.com/uuid-rs/uuid).


Updates `uuid` from 1.23.0 to 1.24.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](https://github.com/uuid-rs/uuid/compare/v1.23.0...v1.24.0)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -5,6 +5,9 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns: ["*"]
   # Enable updates for Rust packages
   - package-ecosystem: "cargo"
     directory: "/" # Location of package manifests
@@ -16,3 +19,8 @@ updates:
       # behind
       - dependency-name: "*"
         update-types: ["version-update:semver-patch"]
+    groups:
+      cargo:
+        patterns: ["*"]
+        # leave major changes in their own PRs
+        update-types: ["minor", "patch"]

.github/workflows/add-to-project.yml

@@ -0,0 +1,18 @@
+# This adds all new issues to the Taskwarrior project, for better tracking.
+# It uses a PAT that belongs to @taskwarrior.
+name: Add issues to Taskwarrior Project
+
+on:
+  issues:
+    types:
+      - opened
+
+jobs:
+  add-to-project:
+    name: Add issue to project
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
+        with:
+          project-url: https://github.com/orgs/GothenburgBitFactory/projects/4
+          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/checks.yml

@@ -13,31 +13,31 @@ jobs:
     name: "Check & Clippy"
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Cache cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cargo/registry
           key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Cache cargo build
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: target
           key: ${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}
 
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
         with:
           toolchain: "stable"
           override: true
           components: clippy
 
-      - uses: actions-rs/cargo@v1.0.3
+      - uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: check
 
-      - uses: actions-rs/clippy-check@v1
+      - uses: actions-rs/clippy-check@b5b5f21f4797c02da247df37026fcd0a5024aa4d # v1.0.7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           args: --all-features --no-deps -- -D warnings
@@ -48,46 +48,46 @@ jobs:
     name: "Rustdoc"
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Cache cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cargo/registry
           key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
 
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
         with:
           toolchain: nightly
           override: true
           minimal: true
 
       - name: taskchampion-sync-server
-        uses: actions-rs/cargo@v1.0.3
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: rustdoc
           args: -p taskchampion-sync-server --bin taskchampion-sync-server --all-features -- -Z unstable-options  --check -Dwarnings
 
       - name: taskchampion-sync-server-postgres
-        uses: actions-rs/cargo@v1.0.3
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: rustdoc
           args: -p taskchampion-sync-server --bin taskchampion-sync-server-postgres --all-features -- -Z unstable-options  --check -Dwarnings
 
       - name: taskchampion-sync-server-core
-        uses: actions-rs/cargo@v1.0.3
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: rustdoc
           args: -p taskchampion-sync-server-core --all-features -- -Z unstable-options  --check -Dwarnings
 
       - name: taskchampion-sync-server-storage-sqlite
-        uses: actions-rs/cargo@v1.0.3
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: rustdoc
           args: -p taskchampion-sync-server-storage-sqlite --all-features -- -Z unstable-options  --check -Dwarnings
 
       - name: taskchampion-sync-server-storage-postgres
-        uses: actions-rs/cargo@v1.0.3
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: rustdoc
           args: -p taskchampion-sync-server-storage-postgres --all-features -- -Z unstable-options  --check -Dwarnings
@@ -96,16 +96,16 @@ jobs:
     runs-on: ubuntu-latest
     name: "Formatting"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
         with:
           profile: minimal
           components: rustfmt
           toolchain: stable
           override: true
 
-      - uses: actions-rs/cargo@v1.0.3
+      - uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: fmt
           args: --all -- --check
@@ -114,8 +114,8 @@ jobs:
     runs-on: ubuntu-latest
     name: "Cargo Semver Checks"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: obi1kenobi/cargo-semver-checks-action@v2
+      - uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2.9
         with:
           # exclude the binary package from semver checks, since it is not published as a crate.
           exclude: taskchampion-sync-server
@@ -125,10 +125,10 @@ jobs:
     name: "mdBook Documentation"
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup mdBook
-        uses: peaceiris/actions-mdbook@v2
+        uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0
         with:
           # if this changes, change it in .github/workflows/publish-docs.yml as well
           mdbook-version: '0.4.48'

.github/workflows/docker.yml

@@ -10,18 +10,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
       - name: Login to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Docker meta
         id: meta-sqlite
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ghcr.io/gothenburgbitfactory/taskchampion-sync-server
@@ -31,7 +31,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=match,pattern=\d.\d.\d,value=latest
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           file: "./Dockerfile-sqlite"
           platforms: linux/amd64,linux/arm64
@@ -42,16 +42,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: Login to ghcr.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Docker meta
         id: meta-postgres
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ghcr.io/gothenburgbitfactory/taskchampion-sync-server-postgres
@@ -61,7 +61,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=match,pattern=\d.\d.\d,value=latest
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           file: "./Dockerfile-postgres"
           platforms: linux/amd64,linux/arm64

.github/workflows/helm-test.yml

@@ -0,0 +1,169 @@
+name: Helm Chart Tests
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'helm/**'
+  pull_request:
+    paths:
+      - 'helm/**'
+
+jobs:
+  helm-test:
+    runs-on: ubuntu-latest
+    name: "Helm Lint & Template"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install Helm
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+        with:
+          version: latest
+
+      - name: Helm lint (default values — expects failure, no backend enabled)
+        run: |
+          helm lint helm/taskchampion-sync-server \
+            --strict 2>&1 || true
+
+      - name: Template default values — must fail validation
+        run: |
+          if helm template test-release helm/taskchampion-sync-server 2>/dev/null; then
+            echo "❌ Expected chart to fail validation (no backend enabled) but it succeeded"
+            exit 1
+          fi
+          echo "✓ Correctly rejects chart with no backend enabled"
+
+      - name: Template with SQLite values
+        run: |
+          helm template test-release helm/taskchampion-sync-server \
+            -f helm/taskchampion-sync-server/examples/sqlite-values.yaml \
+            --debug > /tmp/helm-sqlite.yaml
+
+          echo "=== Generated resources (SQLite) ==="
+          grep -E '^# Source:' /tmp/helm-sqlite.yaml
+
+          # Verify key resources exist
+          grep -q 'kind: Deployment' /tmp/helm-sqlite.yaml
+          grep -q 'kind: Service' /tmp/helm-sqlite.yaml
+          grep -q 'kind: Ingress' /tmp/helm-sqlite.yaml
+
+          # Verify SQLite-specific rendering
+          grep -q 'emptyDir' /tmp/helm-sqlite.yaml
+          grep -q 'DATA_DIR' /tmp/helm-sqlite.yaml
+
+          # Verify PostgreSQL-specific rendering is absent
+          if grep -q 'initContainers' /tmp/helm-sqlite.yaml; then
+            echo "❌ initContainers should not appear in SQLite mode"
+            exit 1
+          fi
+          if grep -q 'CONNECTION' /tmp/helm-sqlite.yaml; then
+            echo "❌ CONNECTION env var should not appear in SQLite mode"
+            exit 1
+          fi
+
+          # Verify correct image tag (no -postgres suffix)
+          grep -q 'image:.*taskchampion-sync-server:0.7.0' /tmp/helm-sqlite.yaml
+          echo "✓ SQLite template generated successfully"
+
+      - name: Template with PostgreSQL values
+        run: |
+          helm template test-release helm/taskchampion-sync-server \
+            -f helm/taskchampion-sync-server/examples/postgres-values.yaml \
+            --debug > /tmp/helm-postgres.yaml
+
+          echo "=== Generated resources (PostgreSQL) ==="
+          grep -E '^# Source:' /tmp/helm-postgres.yaml
+
+          # Verify key resources exist
+          grep -q 'kind: Deployment' /tmp/helm-postgres.yaml
+          grep -q 'kind: Service' /tmp/helm-postgres.yaml
+          grep -q 'kind: Secret' /tmp/helm-postgres.yaml
+
+          # Verify PostgreSQL-specific rendering
+          grep -q 'kind: HTTPRoute' /tmp/helm-postgres.yaml
+          grep -q 'initContainers' /tmp/helm-postgres.yaml
+          grep -q 'CONNECTION' /tmp/helm-postgres.yaml
+          grep -q 'replicas: 3' /tmp/helm-postgres.yaml
+
+          # Verify correct image tag (with -postgres suffix)
+          grep -q 'image:.*taskchampion-sync-server-postgres:0.7.0' /tmp/helm-postgres.yaml
+
+          # Verify SQLite-specific rendering is absent
+          if grep -q 'DATA_DIR' /tmp/helm-postgres.yaml; then
+            echo "❌ DATA_DIR env var should not appear in PostgreSQL mode"
+            exit 1
+          fi
+          echo "✓ PostgreSQL template generated successfully"
+
+      - name: Template with both backends enabled — must fail validation
+        run: |
+          if helm template test-release helm/taskchampion-sync-server \
+            --set sqlite.enabled=true \
+            --set postgres.enabled=true 2>/dev/null; then
+            echo "❌ Expected chart to fail validation (both backends enabled) but it succeeded"
+            exit 1
+          fi
+          echo "✓ Correctly rejects chart with both backends enabled"
+
+      - name: Template with custom overrides
+        run: |
+          helm template test-release helm/taskchampion-sync-server \
+            --set sqlite.enabled=true \
+            --set postgres.enabled=false \
+            --set nameOverride=custom-name \
+            --set image.tag=latest \
+            --debug > /tmp/helm-custom.yaml
+
+          # Verify custom name override
+          grep -q 'custom-name' /tmp/helm-custom.yaml
+          grep -q 'custom-name-pvc' /tmp/helm-custom.yaml
+
+          # Verify custom image tag
+          grep -q 'image:.*taskchampion-sync-server:latest' /tmp/helm-custom.yaml
+          echo "✓ Custom overrides template generated successfully"
+
+      - name: Helm install dry-run (SQLite)
+        run: |
+          helm install test-release helm/taskchampion-sync-server \
+            -f helm/taskchampion-sync-server/examples/sqlite-values.yaml \
+            --dry-run 2>&1 | head -5
+          echo "✓ Helm install dry-run (SQLite) succeeded"
+
+  helm-kubeconform:
+    runs-on: ubuntu-latest
+    name: "Kubeconform Validation"
+    needs: helm-test
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install Helm
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+        with:
+          version: latest
+
+      - name: Download kubeconform
+        run: |
+          wget -q -O /tmp/kubeconform.tar.gz \
+            https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz
+          tar -xzf /tmp/kubeconform.tar.gz -C /usr/local/bin/ kubeconform
+          kubeconform -v
+
+      - name: Validate SQLite output against Kubernetes schemas
+        run: |
+          helm template test-release helm/taskchampion-sync-server \
+            -f helm/taskchampion-sync-server/examples/sqlite-values.yaml > /tmp/helm-sqlite.yaml
+          kubeconform -strict /tmp/helm-sqlite.yaml
+          echo "✓ SQLite resources are valid Kubernetes manifests"
+
+      - name: Validate PostgreSQL output against Kubernetes schemas
+        run: |
+          helm template test-release helm/taskchampion-sync-server \
+            -f helm/taskchampion-sync-server/examples/postgres-values.yaml > /tmp/helm-postgres.yaml
+          # Skip kubeconform on HTTPRoute since Gateway API CRDs aren't bundled
+          kubeconform -strict -ignore-missing-schemas /tmp/helm-postgres.yaml
+          echo "✓ PostgreSQL resources are valid Kubernetes manifests"

.github/workflows/publish-docs.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup mdBook
-        uses: peaceiris/actions-mdbook@v2
+        uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0
         with:
           # if this changes, change it in .github/workflows/checks.yml as well
           mdbook-version: '0.4.48'
@@ -24,7 +24,8 @@ jobs:
       - run: mdbook build docs
 
       - name: Deploy
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./docs/book
+          keep_files: true

.github/workflows/publish-helm.yml

@@ -0,0 +1,36 @@
+name: Publish Helm Charts
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'helm/**'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Install Helm
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
+        env:
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        with:
+          charts_dir: helm
+          install_dir: helm-chart

.github/workflows/rust-tests.yml

@@ -15,7 +15,7 @@ jobs:
           - "17"
         rust:
           # MSRV
-          - "1.85.0"
+          - "1.88.0"
           - "stable"
 
     runs-on: ubuntu-latest
@@ -39,21 +39,21 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Cache cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cargo/registry
           key: ${{ runner.os }}-${{ matrix.rust }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Cache cargo build
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: target
           key: ${{ runner.os }}-${{ matrix.rust }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}
 
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
         with:
           toolchain: "${{ matrix.rust }}"
           override: true

.github/workflows/security.yml

@@ -14,7 +14,7 @@ jobs:
     permissions: write-all
     name: "Audit Rust Dependencies"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: rustsec/audit-check@v2.0.0
+      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

Cargo.toml

@@ -6,30 +6,30 @@ members = [
   "sqlite",
   "postgres",
 ]
-rust-version = "1.85.0" # MSRV
+rust-version = "1.88.0" # MSRV
 
 [workspace.dependencies]
 async-trait = "0.1.88"
-uuid = { version = "^1.18.0", features = ["serde", "v4"] }
+uuid = { version = "^1.23.0", features = ["serde", "v4"] }
-actix-web = "^4.11.0"
+actix-web = "^4.13.0"
 anyhow = "1.0"
 thiserror = "2.0"
 futures = "^0.3.25"
 serde_json = "^1.0"
 serde = { version = "^1.0.147", features = ["derive"] }
-clap = { version = "^4.5.6", features = ["string", "env"] }
+clap = { version = "^4.5.60", features = ["string", "env"] }
 log = "^0.4.17"
 env_logger = "^0.11.7"
-rusqlite = { version = "0.32", features = ["bundled"] }
+rusqlite = { version = "0.37", features = ["bundled"] }
 chrono = { version = "^0.4.38", features = ["serde"] }
 actix-rt = "2"
 tempfile = "3"
 pretty_assertions = "1"
 temp-env = "0.3"
-tokio = { version = "1.48", features = ["rt", "macros"] }
+tokio = { version = "1.52", features = ["rt", "macros"] }
 tokio-postgres = { version = "0.7.13", features = ["with-uuid-1"] }
 bb8 = "0.9.0"
 bb8-postgres = { version = "0.9.0", features = ["with-uuid-1"] }
-openssl = { version = "0.10.73", default-features = false, features = ["vendored"] }
+openssl = { version = "0.10.80", default-features = false, features = ["vendored"] }
 native-tls = { version = "0.2.14", default-features = false, features = ["vendored"] }
 postgres-native-tls = "0.5.1"

Dockerfile-postgres

@@ -1,6 +1,7 @@
 # Versions must be major.minor
 # Default versions are as below
-ARG RUST_VERSION=1.85
+# RUST_VERSION should match the MSRV in Cargo.toml.
+ARG RUST_VERSION=1.88
 ARG ALPINE_VERSION=3.20
 
 FROM docker.io/rust:${RUST_VERSION}-alpine${ALPINE_VERSION} AS builder

Dockerfile-sqlite

@@ -1,6 +1,7 @@
 # Versions must be major.minor
 # Default versions are as below
-ARG RUST_VERSION=1.85
+# RUST_VERSION should match the MSRV in Cargo.toml.
+ARG RUST_VERSION=1.88
 ARG ALPINE_VERSION=3.20
 
 FROM docker.io/rust:${RUST_VERSION}-alpine${ALPINE_VERSION} AS builder

README.md

@@ -76,7 +76,7 @@ SQLite:
 ```sh
 docker build \
   -t taskchampion-sync-server \
-  -f Dockerfile-sqlite
+  -f Dockerfile-sqlite .
 ```
 
 Postgres:
@@ -84,7 +84,7 @@ Postgres:
 source .env
 docker build \
   -t taskchampion-sync-server-postgres \
-  -f Dockerfile-postgres
+  -f Dockerfile-postgres .
 ```
 
 Now to run it, simply exec.

docs/src/SUMMARY.md

@@ -2,9 +2,10 @@
 
 - [Introduction](./introduction.md)
 - [Usage](./usage.md)
-  - [Docker Compose](./usage/docker-compose.md)
-  - [Docker Images](./usage/docker-images.md)
   - [Binaries](./usage/binaries.md)
+  - [Docker Images](./usage/docker-images.md)
+  - [Docker Compose](./usage/docker-compose.md)
+  - [Helm](./usage/helm.md)
 - [Integration](./integration.md)
   - [Pre-built Images](./integration/pre-built.md)
   - [Rust Crates](./integration/crates.md)

docs/src/usage/helm.md

@@ -0,0 +1,131 @@
+# Helm
+
+A Helm chart is available for deploying taskchampion-sync-server on Kubernetes.
+
+## Adding the Repository
+
+```sh
+helm repo add taskchampion https://gothenburgbitfactory.org/taskchampion-sync-server
+helm repo update
+```
+
+## Installing
+
+```sh
+# SQLite backend
+helm install taskchampion-sync-server taskchampion/taskchampion-sync-server \
+  --set sqlite.enabled=true
+
+# PostgreSQL backend
+helm install taskchampion-sync-server taskchampion/taskchampion-sync-server \
+  --set postgres.enabled=true \
+  --set postgres.host=my-postgres \
+  --set postgres.db=taskchampion \
+  --set postgres.username=myuser \
+  --set postgres.password=mypassword
+```
+
+## Storage Backends
+
+Exactly one storage backend must be enabled. The chart fails validation if
+neither or both are enabled.
+
+### SQLite
+
+Mounts a volume at `sqlite.dataDir` (default `/var/lib/taskchampion-sync-server/data`).
+The volume defaults to `emptyDir` but can be backed by a PVC or
+existing PersistentVolumeClaim:
+
+| Value | Description |
+|-------|-------------|
+| `sqlite.persistence.enabled` | Create a PVC (default: `false`) |
+| `sqlite.existingPV` | Use an existing PVC by name |
+| `sqlite.emptyDir` | emptyDir volume settings (default fallback) |
+
+### PostgreSQL
+
+Creates a Deployment with optional replicas, an auto-generated or existing
+secret for the connection string, and an init container that waits for
+PostgreSQL, applies the schema, and optionally seeds client IDs.
+
+**Secret handling** — When `postgres.existingSecret` is empty (default), the
+chart creates a secret named `{release-name}-connection` with a `conn` key.
+When set, the chart reads the named secret. It accepts either a `conn` key
+with a full [LibPQ-style URI](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING-URIS)
+or individual fields (`host`, `port`, `username`, `password`, `database`) that
+override the corresponding `postgres.*` values.
+
+**Init container** — Enabled by default. Waits for PG readiness, downloads
+the schema from `https://raw.githubusercontent.com/GothenburgBitFactory/taskchampion-sync-server/v0.7.0/postgres/schema.sql`,
+applies it, and seeds client IDs if `clientIdSecret` is set. Override the
+schema URL with `postgres.initContainer.schemaUrl`.
+
+**Replicas** — Replicas only apply with PostgreSQL:
+`replicas.enabled=true`, `replicas.count=N`. SQLite is always single-replica.
+
+## Secrets
+
+### Client ID Secret
+
+Optional. Restrict which client IDs the server accepts. Create a Secret with
+comma-separated UUIDs (base64-encoded) under a `client-ids` key:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: my-client-ids
+type: Opaque
+data:
+  client-ids: <base64-encoded comma-separated UUIDs>
+```
+
+Reference it via `clientIdSecret: "my-client-ids"`. The value is available to
+the server as `CLIENT_ID` and to the init container as `CLIENT_IDS`.
+
+## Networking
+
+The chart does not implement TLS. Terminate TLS at the ingress or gateway and
+proxy HTTP to port 8080.
+
+### Ingress (NGINX)
+
+```yaml
+ingress:
+  enabled: true
+  hosts:
+    - taskchampion.example.com
+```
+
+### HTTPRoute (Kubernetes Gateway API)
+
+Use `parentRefs`, `hostnames`, and `rules`:
+
+```yaml
+httpRoute:
+  enabled: true
+  parentRefs:
+    - name: my-gateway
+  hostnames:
+    - tasks.example.com
+  rules:
+    - path:
+        type: PathPrefix
+        value: /
+      backendPort: 8080
+```
+
+The deprecated fields `httpRoute.gateway`, `httpRoute.host`,
+`httpRoute.path`, and `httpRoute.port` are used as a fallback when the
+structured arrays are empty.
+
+### ServiceAccount and RBAC
+
+When `serviceAccount.create` is `true` (default), the chart creates a
+ServiceAccount, a Role with `get`/`create`/`update`/`patch` on secrets, and
+a RoleBinding. Set `serviceAccount.name` to use an existing SA.
+
+## Reference
+
+See the chart's [values.yaml](https://github.com/GothenburgBitFactory/taskchampion-sync-server/blob/main/helm/taskchampion-sync-server/values.yaml)
+for all configurable options.

helm/taskchampion-sync-server/.helmignore

@@ -0,0 +1,5 @@
+# Patterns to ignore when building the Helm chart
+.git
+examples/
+.DS_Store
+*.tgz

helm/taskchampion-sync-server/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: taskchampion-sync-server
+description: A Helm chart for deploying TaskChampion Sync Server on Kubernetes
+type: application
+version: 0.2.1
+appVersion: "0.7.0"
+keywords:
+  - taskchampion
+  - taskwarrior
+  - sync
+  - task-management
+home: https://github.com/GothenburgBitFactory/taskchampion-sync-server
+sources:
+  - https://github.com/GothenburgBitFactory/taskchampion-sync-server
+maintainers: 
+  - name: Jansen Fuller
+    email: jansendfuller@mailfence.com

helm/taskchampion-sync-server/README.md

@@ -0,0 +1,138 @@
+# TaskChampion Sync Server Helm Chart
+
+Deploy the [TaskChampion Sync Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server) on Kubernetes.
+
+## Prerequisites
+
+- Kubernetes 1.23+
+- Helm 3+
+
+## Installing
+
+```console
+helm repo add taskchampion https://gothenburgbitfactory.org/taskchampion-sync-server
+helm repo update
+helm install my-release taskchampion/taskchampion-sync-server --set sqlite.enabled=true
+```
+
+## Storage Backends
+
+Exactly one storage backend must be enabled. The chart fails validation if neither or both are enabled.
+
+### SQLite
+
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `sqlite.enabled` | `false` | Enable SQLite backend |
+| `sqlite.dataDir` | `/var/lib/taskchampion-sync-server/data` | Data directory path |
+| `sqlite.existingPV` | `""` | Use an existing PVC name |
+| `sqlite.persistence.enabled` | `false` | Create a PVC |
+| `sqlite.persistence.size` | `1Gi` | PVC size |
+| `sqlite.persistence.accessMode` | `ReadWriteOnce` | PVC access mode |
+| `sqlite.emptyDir` | — | emptyDir volume settings |
+
+### PostgreSQL
+
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `postgres.enabled` | `false` | Enable PostgreSQL backend |
+| `postgres.host` | `""` | PostgreSQL host |
+| `postgres.port` | `5432` | PostgreSQL port |
+| `postgres.db` | `taskchampion` | Database name |
+| `postgres.username` | `""` | Database user |
+| `postgres.password` | `""` | Database password |
+| `postgres.sslMode` | `disable` | SSL mode |
+| `postgres.existingSecret` | `""` | Use existing secret by name |
+
+**Secret** — When `existingSecret` is empty (default), a secret named `{release-name}-connection` is created with a `conn` key. When set, the chart reads that secret. It accepts either a `conn` key with a full URI or individual keys (`host`, `port`, `username`, `password`, `database`) that override `postgres.*` values.
+
+**Init container** — Enabled by default. Waits for PG readiness, downloads and applies the schema (from the chart's `appVersion` URL), and seeds client IDs if `clientIdSecret` is set. Override with `postgres.initContainer.schemaUrl`.
+
+**Replicas** — Only apply with PostgreSQL (`replicas.enabled=true`, `replicas.count=N`). SQLite is single-replica.
+
+## Secrets
+
+### Client ID Secret
+
+Restrict which client IDs the server accepts. Create a Secret with comma-separated UUIDs (base64-encoded) under a `client-ids` key:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: my-client-ids
+type: Opaque
+data:
+  client-ids: <base64-encoded comma-separated UUIDs>
+```
+
+Reference via `clientIdSecret: "my-client-ids"`.
+
+## Networking
+
+The chart does not implement TLS. Terminate TLS at the ingress or gateway.
+
+### Service
+
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `service.type` | `ClusterIP` | Service type |
+| `service.port` | `8080` | Service port |
+| `service.targetPort` | `8080` | Container port |
+
+### Ingress (NGINX)
+
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `ingress.enabled` | `false` | Enable NGINX ingress |
+| `ingress.className` | `""` | Ingress class name |
+| `ingress.annotations` | `{}` | Ingress annotations |
+| `ingress.hosts` | `[]` | Host list |
+| `ingress.tls` | `[]` | TLS configuration |
+
+### HTTPRoute (Kubernetes Gateway API)
+
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `httpRoute.enabled` | `false` | Enable HTTPRoute |
+| `httpRoute.parentRefs` | `[]` | Parent gateway references (primary) |
+| `httpRoute.hostnames` | `[]` | Hostnames |
+| `httpRoute.rules` | `[]` | Routing rules |
+| `httpRoute.gateway` | `""` | (Deprecated) Single gateway name |
+| `httpRoute.host` | `""` | (Deprecated) Single hostname |
+| `httpRoute.path` | `"/"` | (Deprecated) Single path |
+| `httpRoute.port` | `8080` | (Deprecated) Single port |
+
+**Recommended** — use `parentRefs`, `hostnames`, `rules`. The deprecated
+single-value fields (`gateway`, `host`, `path`, `port`) are used as a fallback
+when the arrays are empty.
+
+## ServiceAccount and RBAC
+
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `serviceAccount.create` | `true` | Create SA, Role, and RoleBinding |
+| `serviceAccount.name` | `""` | Use existing SA name |
+
+When created, the chart provisions a ServiceAccount, a Role with
+`get`/`create`/`update`/`patch` on secrets, and a RoleBinding.
+
+## Image Configuration
+
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `image.repo` | `ghcr.io/gothenburgbitfactory/taskchampion-sync-server` | Image repository |
+| `image.tag` | `"0.7.0"` | Image tag |
+| `image.pullPolicy` | `IfNotPresent` | Pull policy |
+| `image.pullSecrets` | `[]` | Pull secrets |
+
+PostgreSQL appends `-postgres` to the image repo automatically.
+
+## Environment Variables
+
+Custom env vars are passed via `env`. `DATA_DIR` (SQLite) and `conn`
+(PostgreSQL) are set automatically and must not be set manually.
+
+## Full Configuration
+
+See [values.yaml](values.yaml).

helm/taskchampion-sync-server/examples/postgres-values.yaml

@@ -0,0 +1,33 @@
+sqlite:
+  enabled: false
+
+postgres:
+  enabled: true
+  database: taskchampion
+  host: postgres-primary
+  username: taskchampion-user
+
+clientIdSecret: "taskchampion-client-ids"
+
+env:
+  - name: RUST_LOG
+    value: debug
+  - name: LISTEN
+    value: "0.0.0.0:8080"
+  - name: CREATE_CLIENTS
+    value: "false"
+
+replicas:
+  enabled: true
+  count: 3
+
+image:
+  pullSecrets:
+    - name: my-registry-secret
+
+httpRoute:
+  enabled: true
+  gateway: "my-gateway"
+  host: "taskchampion.example.com"
+  path: "/"
+  port: 8080

helm/taskchampion-sync-server/examples/sqlite-values.yaml

@@ -0,0 +1,25 @@
+sqlite:
+  enabled: true
+  existingPV: ""
+  emptyDir:
+    sizeLimit: 1Gi
+  persistence:
+    enabled: false
+
+postgres:
+  enabled: false
+
+clientIdSecret: "taskchampion-client-ids"
+
+env:
+  - name: RUST_LOG
+    value: info
+  - name: LISTEN
+    value: "0.0.0.0:8080"
+  - name: CREATE_CLIENTS
+    value: "false"
+
+ingress:
+  enabled: true
+  hosts:
+    - taskchampion.example.com

helm/taskchampion-sync-server/templates/NOTES.txt

@@ -0,0 +1,46 @@
+Thank you for installing {{ .Chart.Name }} — version {{ .Chart.Version }} (app: {{ .Chart.AppVersion }}).
+
+## Storage Backend
+
+{{- if eq .Values.sqlite.enabled true }}
+**SQLite** — Data is stored at `{{ .Values.sqlite.dataDir }}`.
+{{- if .Values.sqlite.persistence.enabled }}
+  PersistentVolumeClaim: `{{ include "taskchampion-sync-server.fullname" . }}-pvc`
+{{- else if .Values.sqlite.existingPV }}
+  Using existing PVC: `{{ .Values.sqlite.existingPV }}`
+{{- else }}
+  Using an emptyDir volume (ephemeral — data is lost on pod restart).
+  Set `sqlite.persistence.enabled=true` for persistent storage.
+{{- end }}
+{{- end }}
+
+{{- if eq .Values.postgres.enabled true }}
+**PostgreSQL** — Connection URI stored in Secret `{{ include "taskchampion-sync-server.postgres-secret-name" . }}`.
+  Host: {{ .Values.postgres.host }}:{{ .Values.postgres.port }}
+  Database: {{ .Values.postgres.database }}
+{{- end }}
+
+## Verify the Deployment
+
+  kubectl get pods -l {{ include "taskchampion-sync-server.selectorLabels" . | replace ": " "=" | replace "\n" "," | trimSuffix "," }}
+
+## Check Pod Logs
+
+  kubectl logs -l {{ include "taskchampion-sync-server.selectorLabels" . | replace ": " "=" | replace "\n" "," | trimSuffix "," }}
+
+## Test the API
+
+  kubectl port-forward svc/{{ include "taskchampion-sync-server.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }}
+  curl http://localhost:{{ .Values.service.port }}/
+
+## View Connection Secret (PostgreSQL only)
+
+{{- if eq .Values.postgres.enabled true }}
+  kubectl get secret {{ include "taskchampion-sync-server.postgres-secret-name" . }} -o jsonpath="{.data.connection}" | base64 -d
+{{- end }}
+
+## Configuration
+
+For full configuration options, see:
+
+  https://github.com/GothenburgBitFactory/taskchampion-sync-server

helm/taskchampion-sync-server/templates/_helpers.tpl

@@ -0,0 +1,100 @@
+{{- /*
+taskchampion-sync-server helpers
+*/ -}}
+
+{{- define "taskchampion-sync-server.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "taskchampion-sync-server.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "taskchampion-sync-server.labels" -}}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+app.kubernetes.io/name: {{ include "taskchampion-sync-server.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/component: server
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{- define "taskchampion-sync-server.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "taskchampion-sync-server.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+
+{{- define "taskchampion-sync-server.postgres-connection" -}}
+  {{- $host := .Values.postgres.host -}}
+  {{- $port := .Values.postgres.port | toString -}}
+  {{- $username := .Values.postgres.username -}}
+  {{- $password := .Values.postgres.password -}}
+  {{- $database := .Values.postgres.database -}}
+
+  {{- /* Override individual fields from existingSecret where present */ -}}
+  {{- if .Values.postgres.existingSecret -}}
+    {{- $secret := lookup "v1" "Secret" .Release.Namespace .Values.postgres.existingSecret -}}
+    {{- if $secret -}}
+      {{- if index $secret.data "host" -}}
+        {{- $host = index $secret.data "host" | b64dec -}}
+      {{- end -}}
+      {{- if index $secret.data "port" -}}
+        {{- $port = index $secret.data "port" | b64dec -}}
+      {{- end -}}
+      {{- if index $secret.data "username" -}}
+        {{- $username = index $secret.data "username" | b64dec -}}
+      {{- end -}}
+      {{- if index $secret.data "password" -}}
+        {{- $password = index $secret.data "password" | b64dec -}}
+      {{- end -}}
+      {{- if index $secret.data "database" -}}
+        {{- $database = index $secret.data "database" | b64dec -}}
+      {{- end -}}
+    {{- end -}}
+  {{- end -}}
+
+  {{- /* Build URI */ -}}
+  {{- $uri := "postgresql://" -}}
+  {{- if ne $username "" -}}
+    {{- $uri = printf "%s%s" $uri $username -}}
+    {{- if ne $password "" -}}
+      {{- $uri = printf "%s:%s" $uri $password -}}
+    {{- end -}}
+    {{- $uri = printf "%s@" $uri -}}
+  {{- end -}}
+  {{- $uri = printf "%s%s" $uri $host -}}
+  {{- if ne $port "5432" -}}
+    {{- $uri = printf "%s:%s" $uri $port -}}
+  {{- end -}}
+  {{- $uri = printf "%s/%s" $uri $database -}}
+  {{- if .Values.postgres.sslMode -}}
+    {{- $uri = printf "%s?sslmode=%s" $uri .Values.postgres.sslMode -}}
+  {{- end -}}
+  {{- $uri -}}
+{{- end -}}
+
+{{- define "taskchampion-sync-server.schema-url" -}}
+{{- if .Values.postgres.initContainer.schemaUrl -}}
+{{- .Values.postgres.initContainer.schemaUrl -}}
+{{- else -}}
+{{- printf "https://raw.githubusercontent.com/GothenburgBitFactory/taskchampion-sync-server/v%s/postgres/schema.sql" .Chart.AppVersion -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "taskchampion-sync-server.postgres-secret-name" -}}
+{{- printf "%s-connection" .Release.Name -}}
+{{- end -}}
+
+{{- define "taskchampion-sync-server.serviceAccountName" -}}
+{{- default (include "taskchampion-sync-server.fullname" .) .Values.serviceAccount.name -}}
+{{- end -}}

helm/taskchampion-sync-server/templates/deployment.yaml

@@ -0,0 +1,176 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+spec:
+  {{- if and (eq .Values.postgres.enabled true) .Values.replicas.enabled }}
+  replicas: {{ .Values.replicas.count }}
+  {{- else }}
+  replicas: 1
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "taskchampion-sync-server.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "taskchampion-sync-server.selectorLabels" . | nindent 8 }}
+    spec:
+
+      {{- with .Values.image.pullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.serviceAccount.create }}
+      serviceAccountName: {{ include "taskchampion-sync-server.serviceAccountName" . }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+      {{- if and .Values.postgres.enabled .Values.postgres.initContainer.enabled }}
+      initContainers:
+        - name: postgres-init
+          image: "{{ .Values.postgres.initContainer.image }}"
+          imagePullPolicy: {{ .Values.postgres.initContainer.imagePullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 999
+          env:
+            - name: PGURI
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
+                  key: connection
+            - name: SCHEMA_URL
+              value: {{ include "taskchampion-sync-server.schema-url" . | quote }}
+            {{- if .Values.clientIdSecret }}
+            - name: CLIENT_IDS
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.clientIdSecret }}
+                  key: client-ids
+            {{- end }}
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              until pg_isready -d "$PGURI"; do
+                echo 'Waiting for PostgreSQL...'
+                sleep 2
+              done
+              echo "Downloading schema from ${SCHEMA_URL}..."
+              wget -qO /tmp/schema.sql "$SCHEMA_URL" || {
+                echo 'Failed to download schema - continuing with main container'
+                exit 0
+              }
+              psql "$PGURI" -f /tmp/schema.sql || {
+                echo 'Schema execution failed (SQL error) - continuing with main container'
+                exit 0
+              }
+              echo 'Schema executed successfully'
+              if [ -n "$CLIENT_IDS" ]; then
+                echo "Inserting client IDs..."
+                IFS=','
+                for client_id in $CLIENT_IDS; do
+                  client_id=$(echo "$client_id" | tr -d ' ')
+                  [ -z "$client_id" ] && continue
+                  psql "$PGURI" -c "INSERT INTO clients (client_id) VALUES ('$client_id') ON CONFLICT (client_id) DO NOTHING;" || {
+                    echo "Failed to insert client $client_id - continuing"
+                  }
+                done
+                unset IFS
+                echo "Client ID insertion complete"
+              fi
+      {{- end }}
+      containers:
+        - name: taskchampion-sync-server
+          {{- if eq .Values.postgres.enabled true }}
+          image: "{{ .Values.image.repository }}-postgres:{{ .Values.image.tag }}"
+          {{- else }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          {{- end }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1092
+            readOnlyRootFilesystem: true
+          {{- if eq .Values.postgres.enabled true }}
+          command:
+            - /bin/taskchampion-sync-server-postgres
+          {{- else }}
+          command:
+            - /bin/taskchampion-sync-server
+          {{- end }}
+          env:
+            {{- toYaml .Values.env | nindent 12 }}
+            {{- if .Values.clientIdSecret }}
+            - name: CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.clientIdSecret }}
+                  key: client-ids
+            {{- end }}
+            {{- if eq .Values.sqlite.enabled true }}
+            - name: DATA_DIR
+              value: {{ .Values.sqlite.dataDir }}
+            {{- end }}
+            {{- if eq .Values.postgres.enabled true }}
+            - name: CONNECTION
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
+                  key: connection
+            {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.targetPort }}
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          {{- if eq .Values.postgres.enabled true }}
+          resources:
+            {{- toYaml .Values.postgres.resources | nindent 12 }}
+          {{- else }}
+          resources:
+            {{- toYaml .Values.sqlite.resources | nindent 12 }}
+          {{- end }}
+          {{- if eq .Values.sqlite.enabled true }}
+          volumeMounts:
+            - name: data
+              mountPath: {{ .Values.sqlite.dataDir }}
+          {{- end }}
+      {{- if eq .Values.sqlite.enabled true }}
+      volumes:
+        {{- if .Values.sqlite.existingPV }}
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ .Values.sqlite.existingPV }}
+        {{- else if .Values.sqlite.persistence.enabled }}
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "taskchampion-sync-server.fullname" . }}-pvc
+        {{- else }}
+        - name: data
+          emptyDir:
+            {{- if .Values.sqlite.emptyDir.sizeLimit }}
+            sizeLimit: {{ .Values.sqlite.emptyDir.sizeLimit }}
+            {{- end }}
+            {{- if .Values.sqlite.emptyDir.medium }}
+            medium: {{ .Values.sqlite.emptyDir.medium }}
+            {{- end }}
+        {{- end }}
+      {{- end }}

helm/taskchampion-sync-server/templates/httproute.yaml

@@ -0,0 +1,57 @@
+{{- if .Values.httpRoute.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+  {{- with .Values.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  parentRefs:
+    {{- if .Values.httpRoute.parentRefs }}
+    {{- range .Values.httpRoute.parentRefs }}
+    - name: {{ .name }}
+      {{- if .namespace }}
+      namespace: {{ .namespace }}
+      {{- end }}
+      {{- if .sectionName }}
+      sectionName: {{ .sectionName }}
+      {{- end }}
+    {{- end }}
+    {{- else if .Values.httpRoute.gateway }}
+    - name: {{ .Values.httpRoute.gateway }}
+    {{- end }}
+  {{- $hostnames := .Values.httpRoute.hostnames }}
+  {{- if and (not $hostnames) .Values.httpRoute.host }}
+  {{- $hostnames = list .Values.httpRoute.host }}
+  {{- end }}
+  {{- if $hostnames }}
+  hostnames:
+    {{- range $hostnames }}
+    - {{ . | quote }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- if .Values.httpRoute.rules }}
+    {{- range .Values.httpRoute.rules }}
+    - matches:
+        - path:
+            type: {{ .path.type | default "PathPrefix" }}
+            value: {{ .path.value | default "/" }}
+      backendRefs:
+        - name: {{ include "taskchampion-sync-server.fullname" $ }}
+          port: {{ .backendPort | default 8080 }}
+    {{- end }}
+    {{- else }}
+    - matches:
+        - path:
+            type: PathPrefix
+            value: {{ .Values.httpRoute.path | default "/" }}
+      backendRefs:
+        - name: {{ include "taskchampion-sync-server.fullname" . }}
+          port: {{ .Values.httpRoute.port | default 8080 }}
+    {{- end }}
+{{- end }}

helm/taskchampion-sync-server/templates/ingress.yaml

@@ -0,0 +1,58 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- toYaml .Values.ingress.tls | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- $svcName := include "taskchampion-sync-server.fullname" . -}}
+    {{- $svcPort := $.Values.service.port -}}
+    {{- range .Values.ingress.hosts }}
+    {{- if kindIs "string" . }}
+    - host: {{ . | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ $svcName }}
+                port:
+                  number: {{ $svcPort }}
+    {{- else }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path | default "/" | quote }}
+            pathType: {{ .pathType | default "Prefix" }}
+            backend:
+              service:
+                name: {{ $svcName }}
+                port:
+                  number: {{ $svcPort }}
+          {{- else }}
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ $svcName }}
+                port:
+                  number: {{ $svcPort }}
+          {{- end }}
+    {{- end }}
+    {{- end }}
+{{- end }}

helm/taskchampion-sync-server/templates/pvc.yaml

@@ -0,0 +1,17 @@
+{{- if and (eq .Values.sqlite.enabled true) .Values.sqlite.persistence.enabled (not .Values.sqlite.existingPV) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}-pvc
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.sqlite.persistence.accessMode }}
+  resources:
+    requests:
+      storage: {{ .Values.sqlite.persistence.size }}
+  {{- if .Values.sqlite.persistence.storageClass }}
+  storageClassName: {{ .Values.sqlite.persistence.storageClass }}
+  {{- end }}
+{{- end }}

helm/taskchampion-sync-server/templates/secrets/postgres-secret.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.postgres.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+type: Opaque
+data:
+  connection: {{ include "taskchampion-sync-server.postgres-connection" . | b64enc }}
+{{- end }}

helm/taskchampion-sync-server/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "taskchampion-sync-server.fullname" . }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: {{ .Values.service.targetPort }}
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "taskchampion-sync-server.selectorLabels" . | nindent 4 }}

helm/taskchampion-sync-server/templates/serviceaccount.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "taskchampion-sync-server.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+{{- end }}

helm/taskchampion-sync-server/templates/validation-config.yaml

@@ -0,0 +1,14 @@
+{{- /* Validate imagePullSecrets entries are objects (not plain strings) */ -}}
+{{- range $i, $secret := .Values.image.pullSecrets -}}
+  {{- if not (kindIs "map" $secret) -}}
+    {{- fail (printf "ERROR: image.pullSecrets[%d] is a string (%q). Each entry must be an object with a 'name' key, e.g.\n  image:\n    pullSecrets:\n      - name: %s" $i $secret $secret) -}}
+  {{- end -}}
+{{- end -}}
+
+{{- if and (eq .Values.sqlite.enabled false) (eq .Values.postgres.enabled false) -}}
+{{- fail "ERROR: Exactly one storage backend must be enabled. Either sqlite.enabled or postgres.enabled must be true." -}}
+{{- end -}}
+
+{{- if and (eq .Values.sqlite.enabled true) (eq .Values.postgres.enabled true) -}}
+{{- fail "ERROR: Only one storage backend can be enabled. Both sqlite.enabled and postgres.enabled cannot be true at the same time." -}}
+{{- end -}}

helm/taskchampion-sync-server/values.yaml

@@ -0,0 +1,169 @@
+# Override the chart name used in resource names
+nameOverride: ""
+# Override the full resource name (takes precedence over nameOverride)
+fullnameOverride: ""
+
+# Image configuration
+image:
+  repository: ghcr.io/gothenburgbitfactory/taskchampion-sync-server
+  tag: "0.7.0"
+  pullPolicy: IfNotPresent
+  pullSecrets: []
+  # pullSecrets expects a list of objects with a "name" key:
+  # pullSecrets:
+  #   - name: my-registry-cred
+
+# Existing secret containing client IDs (comma-separated UUIDs)
+# Expected key: client-ids
+clientIdSecret: ""
+
+# Environment variables passed directly to the container
+# NOTE: DATA_DIR and CONNECTION are set automatically based on backend
+# To add secret/configMap references, use valueFrom:
+#   - name: MY_SECRET_VAR
+#     valueFrom:
+#       secretKeyRef:
+#         name: my-secret
+#         key: my-key
+env:
+  - name: RUST_LOG
+    value: info
+  - name: LISTEN
+    value: "0.0.0.0:8080"
+  - name: CREATE_CLIENTS
+    value: "true"
+
+# Service configuration
+service:
+  type: ClusterIP
+  port: 8080
+  targetPort: 8080
+
+# Ingress configuration
+# Each host can be a string (simple) or a map with path rules:
+#   hosts:
+#     - host: app.example.com
+#       paths:
+#         - path: /
+#           pathType: Prefix
+#         - path: /api
+#           pathType: Exact
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  hosts: []
+  tls: []
+
+# HTTPRoute configuration (Kubernetes Gateway API)
+httpRoute:
+  enabled: false
+  annotations: {}
+
+  # List of parent gateway references.
+  # name is required; namespace and sectionName are optional.
+  parentRefs: []
+  # parentRefs:
+  #   - name: my-gateway
+  #     namespace: gateway-system  # optional — cross-namespace gateway reference
+  #     sectionName: https         # optional — targets a specific listener on the gateway
+
+  # List of hostnames the route applies to.
+  hostnames: []
+  # hostnames:
+  #   - tasks.example.com
+  #   - tasks.internal.example.com
+
+  # List of routing rules. Each rule matches a path and forwards to this chart's Service.
+  # When empty, falls back to the deprecated path/port fields below.
+  rules: []
+  # rules:
+  #   - path:
+  #       type: PathPrefix   # PathPrefix or Exact
+  #       value: /
+  #     backendPort: 8080
+
+  # Deprecated: use parentRefs instead
+  gateway: ""
+  # Deprecated: use hostnames instead
+  host: ""
+  # Deprecated: use rules instead
+  path: "/"
+  port: 8080
+
+# Replica configuration (only applies when postgres is enabled)
+replicas:
+  enabled: false
+  count: 1
+
+# ServiceAccount configuration
+# The app does not access the Kubernetes API, so no RBAC permissions are needed.
+# A dedicated ServiceAccount is created to give the pod a stable identity
+# for network policies, pod security, or future RBAC.
+serviceAccount:
+  # create specifies whether a ServiceAccount should be created
+  create: true
+  # name sets the ServiceAccount name
+  name: taskchampion-sync-server
+
+# Security context for the pod
+# NOTE: runAsUser and runAsGroup are intentionally unset.
+# The Docker entrypoint requires root to chown the data directory and then
+# drops privileges via su-exec to the taskchampion user (uid 1092).
+securityContext:
+  fsGroup: 100
+
+# SQLite backend configuration (mutually exclusive with postgres)
+sqlite:
+  enabled: false
+  dataDir: /var/lib/taskchampion-sync-server/data
+  # Resource limits and requests
+  resources:
+    limits:
+      memory: 25Mi
+      cpu: 100m
+    requests:
+      # 5Mi is sufficient for the SQLite image
+      memory: 5Mi
+      cpu: 10m
+  existingPV: ""
+  emptyDir:
+    sizeLimit: ""
+    medium: ""
+  persistence:
+    enabled: true
+    size: 1Gi
+    accessMode: ReadWriteOnce
+    storageClass: ""
+    existingClaim: ""
+
+# PostgreSQL configuration
+postgres:
+  enabled: false
+  existingSecret: ""  # If empty, auto-create secret; if provided, use existing
+  # Individual connection components for building connection string
+  database: taskchampion
+  host: postgres
+  port: 5432
+  username: user
+  password: ""
+  # SSL mode for the PostgreSQL connection.
+  # Use 'disable' for internal cluster connections (no TLS).
+  # Options: disable, allow, prefer, require, verify-ca, verify-full
+  sslMode: disable
+  initContainer:
+    enabled: true
+    image: postgres:17-alpine
+    imagePullPolicy: IfNotPresent
+    # Override the schema URL. Defaults to the official schema for this chart's appVersion.
+    # e.g. https://raw.githubusercontent.com/GothenburgBitFactory/taskchampion-sync-server/v0.7.0/postgres/schema.sql
+    schemaUrl: ""
+  # Resource limits and requests
+  resources:
+    limits:
+      memory: 100Mi
+      cpu: 100m
+    requests:
+      # 20Mi is the minimum for the Postgres image
+      memory: 20Mi
+      cpu: 10m