Bump uuid from 1.23.0 to 1.24.0 in the cargo group

Bumps the cargo group with 1 update: [uuid](https://github.com/uuid-rs/uuid).


Updates `uuid` from 1.23.0 to 1.24.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](https://github.com/uuid-rs/uuid/compare/v1.23.0...v1.24.0)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/add-to-project.yml

@@ -12,7 +12,7 @@ jobs:
     name: Add issue to project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v2.0.0
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
         with:
           project-url: https://github.com/orgs/GothenburgBitFactory/projects/4
           github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/checks.yml

@@ -13,31 +13,31 @@ jobs:
     name: "Check & Clippy"
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Cache cargo registry
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cargo/registry
           key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Cache cargo build
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: target
           key: ${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}
 
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
         with:
           toolchain: "stable"
           override: true
           components: clippy
 
-      - uses: actions-rs/cargo@v1.0.3
+      - uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: check
 
-      - uses: actions-rs/clippy-check@v1
+      - uses: actions-rs/clippy-check@b5b5f21f4797c02da247df37026fcd0a5024aa4d # v1.0.7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           args: --all-features --no-deps -- -D warnings
@@ -48,46 +48,46 @@ jobs:
     name: "Rustdoc"
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Cache cargo registry
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cargo/registry
           key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
 
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
         with:
           toolchain: nightly
           override: true
           minimal: true
 
       - name: taskchampion-sync-server
-        uses: actions-rs/cargo@v1.0.3
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: rustdoc
           args: -p taskchampion-sync-server --bin taskchampion-sync-server --all-features -- -Z unstable-options  --check -Dwarnings
 
       - name: taskchampion-sync-server-postgres
-        uses: actions-rs/cargo@v1.0.3
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: rustdoc
           args: -p taskchampion-sync-server --bin taskchampion-sync-server-postgres --all-features -- -Z unstable-options  --check -Dwarnings
 
       - name: taskchampion-sync-server-core
-        uses: actions-rs/cargo@v1.0.3
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: rustdoc
           args: -p taskchampion-sync-server-core --all-features -- -Z unstable-options  --check -Dwarnings
 
       - name: taskchampion-sync-server-storage-sqlite
-        uses: actions-rs/cargo@v1.0.3
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: rustdoc
           args: -p taskchampion-sync-server-storage-sqlite --all-features -- -Z unstable-options  --check -Dwarnings
 
       - name: taskchampion-sync-server-storage-postgres
-        uses: actions-rs/cargo@v1.0.3
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: rustdoc
           args: -p taskchampion-sync-server-storage-postgres --all-features -- -Z unstable-options  --check -Dwarnings
@@ -96,16 +96,16 @@ jobs:
     runs-on: ubuntu-latest
     name: "Formatting"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
         with:
           profile: minimal
           components: rustfmt
           toolchain: stable
           override: true
 
-      - uses: actions-rs/cargo@v1.0.3
+      - uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           command: fmt
           args: --all -- --check
@@ -114,8 +114,8 @@ jobs:
     runs-on: ubuntu-latest
     name: "Cargo Semver Checks"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: obi1kenobi/cargo-semver-checks-action@v2
+      - uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2.9
         with:
           # exclude the binary package from semver checks, since it is not published as a crate.
           exclude: taskchampion-sync-server
@@ -125,10 +125,10 @@ jobs:
     name: "mdBook Documentation"
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup mdBook
-        uses: peaceiris/actions-mdbook@v2
+        uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0
         with:
           # if this changes, change it in .github/workflows/publish-docs.yml as well
           mdbook-version: '0.4.48'

.github/workflows/docker.yml

@@ -10,18 +10,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
       - name: Login to ghcr.io
-        uses: docker/login-action@v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Docker meta
         id: meta-sqlite
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ghcr.io/gothenburgbitfactory/taskchampion-sync-server
@@ -31,7 +31,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=match,pattern=\d.\d.\d,value=latest
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           file: "./Dockerfile-sqlite"
           platforms: linux/amd64,linux/arm64
@@ -42,16 +42,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: Login to ghcr.io
-        uses: docker/login-action@v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Docker meta
         id: meta-postgres
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ghcr.io/gothenburgbitfactory/taskchampion-sync-server-postgres
@@ -61,7 +61,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=match,pattern=\d.\d.\d,value=latest
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           file: "./Dockerfile-postgres"
           platforms: linux/amd64,linux/arm64

.github/workflows/helm-test.yml

@@ -16,10 +16,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Helm
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           version: latest
 
@@ -49,7 +49,6 @@ jobs:
           grep -q 'kind: Deployment' /tmp/helm-sqlite.yaml
           grep -q 'kind: Service' /tmp/helm-sqlite.yaml
           grep -q 'kind: Ingress' /tmp/helm-sqlite.yaml
-          grep -q 'kind: ServiceAccount' /tmp/helm-sqlite.yaml
 
           # Verify SQLite-specific rendering
           grep -q 'emptyDir' /tmp/helm-sqlite.yaml
@@ -82,7 +81,6 @@ jobs:
           grep -q 'kind: Deployment' /tmp/helm-postgres.yaml
           grep -q 'kind: Service' /tmp/helm-postgres.yaml
           grep -q 'kind: Secret' /tmp/helm-postgres.yaml
-          grep -q 'kind: ServiceAccount' /tmp/helm-postgres.yaml
 
           # Verify PostgreSQL-specific rendering
           grep -q 'kind: HTTPRoute' /tmp/helm-postgres.yaml
@@ -141,10 +139,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install Helm
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           version: latest
 

.github/workflows/publish-docs.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup mdBook
-        uses: peaceiris/actions-mdbook@v2
+        uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0
         with:
           # if this changes, change it in .github/workflows/checks.yml as well
           mdbook-version: '0.4.48'
@@ -24,7 +24,7 @@ jobs:
       - run: mdbook build docs
 
       - name: Deploy
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./docs/book

.github/workflows/publish-helm.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
@@ -25,10 +25,10 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Install Helm
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.7.0
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         with:

.github/workflows/rust-tests.yml

@@ -39,21 +39,21 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Cache cargo registry
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cargo/registry
           key: ${{ runner.os }}-${{ matrix.rust }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Cache cargo build
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: target
           key: ${{ runner.os }}-${{ matrix.rust }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}
 
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
         with:
           toolchain: "${{ matrix.rust }}"
           override: true

.github/workflows/security.yml

@@ -14,7 +14,7 @@ jobs:
     permissions: write-all
     name: "Audit Rust Dependencies"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: rustsec/audit-check@v2.0.0
+      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

Cargo.lock

@@ -21,9 +21,9 @@ dependencies = [
 
 [[package]]
 name = "actix-http"
-version = "3.12.1"
+version = "3.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93acb4a42f64936f9b8cae4a433b237599dd6eb6ed06124eb67132ef8cc90662"
+checksum = "48e2faa3e7418ed780cca54829d32782a4008a077230f67457caa063415e99c2"
 dependencies = [
  "actix-codec",
  "actix-rt",
@@ -37,7 +37,7 @@ dependencies = [
  "derive_more",
  "encoding_rs",
  "flate2",
- "foldhash",
+ "foldhash 0.2.0",
  "futures-core",
  "h2",
  "http",
@@ -49,7 +49,7 @@ dependencies = [
  "mime",
  "percent-encoding",
  "pin-project-lite",
- "rand 0.10.1",
+ "rand",
  "sha1",
  "smallvec",
  "tokio",
@@ -133,9 +133,9 @@ dependencies = [
 
 [[package]]
 name = "actix-web"
-version = "4.13.0"
+version = "4.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff87453bc3b56e9b2b23c1cc0b1be8797184accf51d2abe0f8a33ec275d316bf"
+checksum = "df09e2d9239703dd64056359c920c7f3fba6535ec61a0059e0f44e095ffe02b4"
 dependencies = [
  "actix-codec",
  "actix-http",
@@ -152,7 +152,7 @@ dependencies = [
  "cookie",
  "derive_more",
  "encoding_rs",
- "foldhash",
+ "foldhash 0.2.0",
  "futures-core",
  "futures-util",
  "impl-more",
@@ -362,15 +362,6 @@ version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
 
-[[package]]
-name = "block-buffer"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
-
 [[package]]
 name = "block-buffer"
 version = "0.12.0"
@@ -452,8 +443,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
+ "cpufeatures",
- "rand_core 0.10.1",
+ "rand_core",
 ]
 
 [[package]]
@@ -498,6 +489,12 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
 [[package]]
 name = "colorchoice"
 version = "1.0.4"
@@ -537,15 +534,6 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "cpufeatures"
 version = "0.3.0"
@@ -564,16 +552,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "crypto-common"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
 [[package]]
 name = "crypto-common"
 version = "0.2.1"
@@ -583,6 +561,15 @@ dependencies = [
  "hybrid-array",
 ]
 
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
 [[package]]
 name = "deranged"
 version = "0.5.5"
@@ -619,26 +606,16 @@ version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
 
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer 0.10.4",
- "crypto-common 0.1.6",
- "subtle",
-]
-
 [[package]]
 name = "digest"
 version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4850db49bf08e663084f7fb5c87d202ef91a3907271aff24a94eb97ff039153c"
 dependencies = [
- "block-buffer 0.12.0",
+ "block-buffer",
  "const-oid",
- "crypto-common 0.2.1",
+ "crypto-common",
+ "ctutils",
 ]
 
 [[package]]
@@ -746,6 +723,12 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -859,16 +842,6 @@ dependencies = [
  "slab",
 ]
 
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.3.3"
@@ -890,7 +863,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "r-efi",
- "rand_core 0.10.1",
+ "rand_core",
  "wasip2",
  "wasip3",
 ]
@@ -920,7 +893,7 @@ version = "0.15.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
 dependencies = [
- "foldhash",
+ "foldhash 0.1.5",
 ]
 
 [[package]]
@@ -940,11 +913,11 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "hmac"
-version = "0.12.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
 dependencies = [
- "digest 0.10.7",
+ "digest",
 ]
 
 [[package]]
@@ -1118,9 +1091,9 @@ dependencies = [
 
 [[package]]
 name = "impl-more"
-version = "0.1.9"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8a5a9a0ff0086c7a148acb942baaabeadf9504d10400b5a05645853729b9cd2"
+checksum = "35a84fd5aa25fae5c0f4a33d9cac2ca017fc622cbd089be2229993514990f870"
 
 [[package]]
 name = "indexmap"
@@ -1181,11 +1154,12 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.77"
+version = "0.3.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
+checksum = "03d04c30968dffe80775bd4d7fb676131cd04a1fb46d2686dbffbaec2d9dfd31"
 dependencies = [
- "once_cell",
+ "cfg-if",
+ "futures-util",
  "wasm-bindgen",
 ]
 
@@ -1207,6 +1181,15 @@ version = "0.2.184"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48f5d2a454e16a5ea0f4ced81bd44e4cfc7bd3a507b61887c99fd3538b28e4af"
 
+[[package]]
+name = "libredox"
+version = "0.1.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "libsqlite3-sys"
 version = "0.35.0"
@@ -1265,12 +1248,12 @@ checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
 
 [[package]]
 name = "md-5"
-version = "0.10.6"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
 dependencies = [
  "cfg-if",
- "digest 0.10.7",
+ "digest",
 ]
 
 [[package]]
@@ -1338,6 +1321,24 @@ dependencies = [
  "autocfg",
 ]
 
+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "objc2-system-configuration"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7216bd11cbda54ccabcab84d523dc93b858ec75ecfb3a7d89513fa22464da396"
+dependencies = [
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.3"
@@ -1434,18 +1435,19 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "phf"
-version = "0.11.3"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
 dependencies = [
  "phf_shared",
+ "serde",
 ]
 
 [[package]]
 name = "phf_shared"
-version = "0.11.3"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
 dependencies = [
  "siphasher",
 ]
@@ -1497,9 +1499,9 @@ dependencies = [
 
 [[package]]
 name = "postgres-protocol"
-version = "0.6.8"
+version = "0.6.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76ff0abab4a9b844b93ef7b81f1efc0a366062aaef2cd702c76256b5dc075c54"
+checksum = "08808e3c483c46e999108051c78334f473d5adb59d78bb80a1268c7e6aa6c514"
 dependencies = [
  "base64",
  "byteorder",
@@ -1508,16 +1510,16 @@ dependencies = [
  "hmac",
  "md-5",
  "memchr",
- "rand 0.9.4",
+ "rand",
  "sha2",
  "stringprep",
 ]
 
 [[package]]
 name = "postgres-types"
-version = "0.2.9"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613283563cd90e1dfc3518d548caee47e0e725455ed619881f5cf21f36de4b48"
+checksum = "851ca9db4932932d69f3ea811b1abe63087a0f740a47692619dd40d4899b68be"
 dependencies = [
  "bytes",
  "fallible-iterator 0.2.0",
@@ -1540,15 +1542,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
-[[package]]
-name = "ppv-lite86"
-version = "0.2.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
-dependencies = [
- "zerocopy",
-]
-
 [[package]]
 name = "pretty_assertions"
 version = "1.4.1"
@@ -1593,16 +1586,6 @@ version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
-[[package]]
-name = "rand"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
-dependencies = [
- "rand_chacha",
- "rand_core 0.9.3",
-]
-
 [[package]]
 name = "rand"
 version = "0.10.1"
@@ -1611,26 +1594,7 @@ checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
  "chacha20",
  "getrandom 0.4.1",
- "rand_core 0.10.1",
+ "rand_core",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.9.3",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
-dependencies = [
- "getrandom 0.3.3",
 ]
 
 [[package]]
@@ -1707,7 +1671,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1827,19 +1791,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
+ "cpufeatures",
- "digest 0.11.2",
+ "digest",
 ]
 
 [[package]]
 name = "sha2"
-version = "0.10.9"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
- "digest 0.10.7",
+ "digest",
 ]
 
 [[package]]
@@ -1918,12 +1882,6 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
-[[package]]
-name = "subtle"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
-
 [[package]]
 name = "syn"
 version = "2.0.116"
@@ -2040,10 +1998,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.1",
+ "getrandom 0.3.3",
  "once_cell",
  "rustix",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2162,9 +2120,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-postgres"
-version = "0.7.13"
+version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c95d533c83082bb6490e0189acaa0bbeef9084e60471b696ca6988cd0541fb0"
+checksum = "a528f7d280f6d5b9cd149635c8705b0dd049754bc67d81d31fa25169a93809d3"
 dependencies = [
  "async-trait",
  "byteorder",
@@ -2179,8 +2137,8 @@ dependencies = [
  "pin-project-lite",
  "postgres-protocol",
  "postgres-types",
- "rand 0.9.4",
+ "rand",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "tokio",
  "tokio-util",
  "whoami",
@@ -2295,9 +2253,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.23.0"
+version = "1.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ac8b6f42ead25368cf5b098aeb3dc8a1a2c05a3eee8a9a1a68c640edbfc79d9"
+checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
 dependencies = [
  "getrandom 0.4.1",
  "js-sys",
@@ -2352,41 +2310,31 @@ dependencies = [
 
 [[package]]
 name = "wasite"
-version = "0.1.0"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+checksum = "66fe902b4a6b8028a753d5424909b764ccf79b7a209eac9bf97e59cda9f71a42"
+dependencies = [
+ "wasi 0.14.2+wasi-0.2.4",
+]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.100"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
+checksum = "8ddb3f79143bced6de84270411622a2699cee572fc0875aeaf1e7867cf9fca1a"
 dependencies = [
  "cfg-if",
  "once_cell",
  "rustversion",
  "wasm-bindgen-macro",
-]
-
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
-dependencies = [
- "bumpalo",
- "log",
- "proc-macro2",
- "quote",
- "syn",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.100"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
+checksum = "4e21a184b13fb19e157296e2c46056aec9092264fab83e4ba59e68c61b323c3d"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2394,22 +2342,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.100"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
+checksum = "fecefd9c35bd935a20fc3fc344b5f29138961e4f47fb03297d88f2587afb5ebd"
 dependencies = [
+ "bumpalo",
  "proc-macro2",
  "quote",
  "syn",
- "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.100"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
+checksum = "23939e44bb9a5d7576fa2b563dc2e136628f1224e88a8deed09e04858b77871f"
 dependencies = [
  "unicode-ident",
 ]
@@ -2450,9 +2398,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.77"
+version = "0.3.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33b6dd2ef9186f1f2072e409e99cd22a975331a6b3591b12c764e0e55c60d5d2"
+checksum = "a6430a72df5eb332242960fe84b3002a241163998241eb596d4f739b9757061d"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -2460,11 +2408,13 @@ dependencies = [
 
 [[package]]
 name = "whoami"
-version = "1.6.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6994d13118ab492c3c80c1f81928718159254c53c472bf9ce36f8dae4add02a7"
+checksum = "d6a5b12f9df4f978d2cfdb1bd3bac52433f44393342d7ee9c25f5a1c14c0f45d"
 dependencies = [
- "redox_syscall",
+ "libc",
+ "libredox",
+ "objc2-system-configuration",
  "wasite",
  "web-sys",
 ]
@@ -2758,26 +2708,6 @@ dependencies = [
  "synstructure",
 ]
 
-[[package]]
-name = "zerocopy"
-version = "0.8.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1039dd0d3c310cf05de012d8a39ff557cb0d23087fd44cad61df08fc31907a2f"
-dependencies = [
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.8.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ecf5b4cc5364572d7f4c329661bcc82724222973f2cab6f050a4e5c22f75181"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "zerofrom"
 version = "0.1.6"

docs/src/usage/helm.md

@@ -5,56 +5,127 @@ A Helm chart is available for deploying taskchampion-sync-server on Kubernetes.
 ## Adding the Repository
 
 ```sh
-helm repo add taskchampion https://gothenburgbitfactory.org/taskchampion-sync-server/helm-chart
+helm repo add taskchampion https://gothenburgbitfactory.org/taskchampion-sync-server
 helm repo update
 ```
 
-## Installing the Chart
+## Installing
-
-The chart requires exactly one storage backend to be enabled. To install with
-the SQLite backend:
 
 ```sh
+# SQLite backend
 helm install taskchampion-sync-server taskchampion/taskchampion-sync-server \
   --set sqlite.enabled=true
-```
 
-To install with the Postgres backend, provide the connection details:
+# PostgreSQL backend
-
-```sh
 helm install taskchampion-sync-server taskchampion/taskchampion-sync-server \
   --set postgres.enabled=true \
   --set postgres.host=my-postgres \
-  --set postgres.database=taskchampion \
+  --set postgres.db=taskchampion \
   --set postgres.username=myuser \
   --set postgres.password=mypassword
 ```
 
-Alternatively, pass an existing Secret name via `postgres.existingSecret`. The
+## Storage Backends
-secret must contain a `connection` key holding a [LibPQ-style connection
-URI](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING-URIS).
 
-## Configuration
+Exactly one storage backend must be enabled. The chart fails validation if
+neither or both are enabled.
 
-The chart does not implement TLS. The expectation is that a Kubernetes ingress
+### SQLite
-or gateway will terminate TLS and proxy HTTP traffic to the server container.
-Enable one of the built-in options or configure your own:
 
-```sh
+Mounts a volume at `sqlite.dataDir` (default `/var/lib/taskchampion-sync-server/data`).
-# NGINX ingress
+The volume defaults to `emptyDir` but can be backed by a PVC or
---set ingress.enabled=true --set ingress.hosts[0]=taskchampion.example.com
+existing PersistentVolumeClaim:
 
-# Gateway API HTTPRoute
+| Value | Description |
---set httpRoute.enabled=true \
+|-------|-------------|
---set httpRoute.gateway=my-gateway \
+| `sqlite.persistence.enabled` | Create a PVC (default: `false`) |
---set httpRoute.host=taskchampion.example.com
+| `sqlite.existingPV` | Use an existing PVC by name |
+| `sqlite.emptyDir` | emptyDir volume settings (default fallback) |
+
+### PostgreSQL
+
+Creates a Deployment with optional replicas, an auto-generated or existing
+secret for the connection string, and an init container that waits for
+PostgreSQL, applies the schema, and optionally seeds client IDs.
+
+**Secret handling** — When `postgres.existingSecret` is empty (default), the
+chart creates a secret named `{release-name}-connection` with a `conn` key.
+When set, the chart reads the named secret. It accepts either a `conn` key
+with a full [LibPQ-style URI](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING-URIS)
+or individual fields (`host`, `port`, `username`, `password`, `database`) that
+override the corresponding `postgres.*` values.
+
+**Init container** — Enabled by default. Waits for PG readiness, downloads
+the schema from `https://raw.githubusercontent.com/GothenburgBitFactory/taskchampion-sync-server/v0.7.0/postgres/schema.sql`,
+applies it, and seeds client IDs if `clientIdSecret` is set. Override the
+schema URL with `postgres.initContainer.schemaUrl`.
+
+**Replicas** — Replicas only apply with PostgreSQL:
+`replicas.enabled=true`, `replicas.count=N`. SQLite is always single-replica.
+
+## Secrets
+
+### Client ID Secret
+
+Optional. Restrict which client IDs the server accepts. Create a Secret with
+comma-separated UUIDs (base64-encoded) under a `client-ids` key:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: my-client-ids
+type: Opaque
+data:
+  client-ids: <base64-encoded comma-separated UUIDs>
 ```
 
-To restrict which client IDs the server accepts, create a Secret containing a
+Reference it via `clientIdSecret: "my-client-ids"`. The value is available to
-newline-separated list of UUIDs and reference it:
+the server as `CLIENT_ID` and to the init container as `CLIENT_IDS`.
 
-```sh
+## Networking
---set clientIdSecret=my-client-ids-secret
+
+The chart does not implement TLS. Terminate TLS at the ingress or gateway and
+proxy HTTP to port 8080.
+
+### Ingress (NGINX)
+
+```yaml
+ingress:
+  enabled: true
+  hosts:
+    - taskchampion.example.com
 ```
 
-See the chart's `values.yaml` for the full set of configuration options.
+### HTTPRoute (Kubernetes Gateway API)
+
+Use `parentRefs`, `hostnames`, and `rules`:
+
+```yaml
+httpRoute:
+  enabled: true
+  parentRefs:
+    - name: my-gateway
+  hostnames:
+    - tasks.example.com
+  rules:
+    - path:
+        type: PathPrefix
+        value: /
+      backendPort: 8080
+```
+
+The deprecated fields `httpRoute.gateway`, `httpRoute.host`,
+`httpRoute.path`, and `httpRoute.port` are used as a fallback when the
+structured arrays are empty.
+
+### ServiceAccount and RBAC
+
+When `serviceAccount.create` is `true` (default), the chart creates a
+ServiceAccount, a Role with `get`/`create`/`update`/`patch` on secrets, and
+a RoleBinding. Set `serviceAccount.name` to use an existing SA.
+
+## Reference
+
+See the chart's [values.yaml](https://github.com/GothenburgBitFactory/taskchampion-sync-server/blob/main/helm/taskchampion-sync-server/values.yaml)
+for all configurable options.

helm/taskchampion-sync-server/.helmignore

@@ -1,5 +1,5 @@
 # Patterns to ignore when building the Helm chart
 .git
-.gitignore
-*.md
 examples/
+.DS_Store
+*.tgz

helm/taskchampion-sync-server/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: taskchampion-sync-server
 description: A Helm chart for deploying TaskChampion Sync Server on Kubernetes
 type: application
-version: 0.1.2
+version: 0.2.1
 appVersion: "0.7.0"
 keywords:
   - taskchampion

helm/taskchampion-sync-server/README.md

@@ -7,28 +7,55 @@ Deploy the [TaskChampion Sync Server](https://github.com/GothenburgBitFactory/ta
 - Kubernetes 1.23+
 - Helm 3+
 
+## Installing
+
+```console
+helm repo add taskchampion https://gothenburgbitfactory.org/taskchampion-sync-server
+helm repo update
+helm install my-release taskchampion/taskchampion-sync-server --set sqlite.enabled=true
+```
+
 ## Storage Backends
 
-Exactly one storage backend must be enabled. The chart will fail validation if both or neither are enabled.
+Exactly one storage backend must be enabled. The chart fails validation if neither or both are enabled.
 
 ### SQLite
 
-```console
+| Parameter | Default | Description |
-helm install my-release ./helm/taskchampion-sync-server -f helm/taskchampion-sync-server/examples/sqlite-values.yaml
+|-----------|---------|-------------|
-```
+| `sqlite.enabled` | `false` | Enable SQLite backend |
+| `sqlite.dataDir` | `/var/lib/taskchampion-sync-server/data` | Data directory path |
+| `sqlite.existingPV` | `""` | Use an existing PVC name |
+| `sqlite.persistence.enabled` | `false` | Create a PVC |
+| `sqlite.persistence.size` | `1Gi` | PVC size |
+| `sqlite.persistence.accessMode` | `ReadWriteOnce` | PVC access mode |
+| `sqlite.emptyDir` | — | emptyDir volume settings |
 
 ### PostgreSQL
 
-```console
+| Parameter | Default | Description |
-helm install my-release ./helm/taskchampion-sync-server -f helm/taskchampion-sync-server/examples/postgres-values.yaml
+|-----------|---------|-------------|
-```
+| `postgres.enabled` | `false` | Enable PostgreSQL backend |
+| `postgres.host` | `""` | PostgreSQL host |
+| `postgres.port` | `5432` | PostgreSQL port |
+| `postgres.db` | `taskchampion` | Database name |
+| `postgres.username` | `""` | Database user |
+| `postgres.password` | `""` | Database password |
+| `postgres.sslMode` | `disable` | SSL mode |
+| `postgres.existingSecret` | `""` | Use existing secret by name |
+
+**Secret** — When `existingSecret` is empty (default), a secret named `{release-name}-connection` is created with a `conn` key. When set, the chart reads that secret. It accepts either a `conn` key with a full URI or individual keys (`host`, `port`, `username`, `password`, `database`) that override `postgres.*` values.
+
+**Init container** — Enabled by default. Waits for PG readiness, downloads and applies the schema (from the chart's `appVersion` URL), and seeds client IDs if `clientIdSecret` is set. Override with `postgres.initContainer.schemaUrl`.
+
+**Replicas** — Only apply with PostgreSQL (`replicas.enabled=true`, `replicas.count=N`). SQLite is single-replica.
 
 ## Secrets
 
-The chart expects pre-created secrets referenced by name:
-
 ### Client ID Secret
 
+Restrict which client IDs the server accepts. Create a Secret with comma-separated UUIDs (base64-encoded) under a `client-ids` key:
+
 ```yaml
 apiVersion: v1
 kind: Secret
@@ -39,22 +66,73 @@ data:
   client-ids: <base64-encoded comma-separated UUIDs>
 ```
 
-Reference it via `clientIdSecret: "my-client-ids"`.
+Reference via `clientIdSecret: "my-client-ids"`.
 
-### PostgreSQL Secret
+## Networking
 
-For PostgreSQL, the chart can automatically create a secret with the connection string, or use an existing secret. 
+The chart does not implement TLS. Terminate TLS at the ingress or gateway.
 
-**Automatic Secret Creation**:
+### Service
-- When `postgres.existingSecret` is empty (default), the chart automatically creates a secret
-- Secret is named using Helm naming convention: `release-name-taskchampion-sync-server`
-- Secret contains only a `connection` key with the built connection string
 
-**Existing Secret Usage**:
+| Parameter | Default | Description |
-- When `postgres.existingSecret` is provided, the chart uses that secret
+|-----------|---------|-------------|
-- The secret **must** contain a `connection` key with the PostgreSQL connection string
+| `service.type` | `ClusterIP` | Service type |
-- If the secret doesn't have a `connection` key, the deployment will fail with a clear error
+| `service.port` | `8080` | Service port |
+| `service.targetPort` | `8080` | Container port |
 
-## Configuration
+### Ingress (NGINX)
 
-See [values.yaml](values.yaml) for all configurable options.
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `ingress.enabled` | `false` | Enable NGINX ingress |
+| `ingress.className` | `""` | Ingress class name |
+| `ingress.annotations` | `{}` | Ingress annotations |
+| `ingress.hosts` | `[]` | Host list |
+| `ingress.tls` | `[]` | TLS configuration |
+
+### HTTPRoute (Kubernetes Gateway API)
+
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `httpRoute.enabled` | `false` | Enable HTTPRoute |
+| `httpRoute.parentRefs` | `[]` | Parent gateway references (primary) |
+| `httpRoute.hostnames` | `[]` | Hostnames |
+| `httpRoute.rules` | `[]` | Routing rules |
+| `httpRoute.gateway` | `""` | (Deprecated) Single gateway name |
+| `httpRoute.host` | `""` | (Deprecated) Single hostname |
+| `httpRoute.path` | `"/"` | (Deprecated) Single path |
+| `httpRoute.port` | `8080` | (Deprecated) Single port |
+
+**Recommended** — use `parentRefs`, `hostnames`, `rules`. The deprecated
+single-value fields (`gateway`, `host`, `path`, `port`) are used as a fallback
+when the arrays are empty.
+
+## ServiceAccount and RBAC
+
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `serviceAccount.create` | `true` | Create SA, Role, and RoleBinding |
+| `serviceAccount.name` | `""` | Use existing SA name |
+
+When created, the chart provisions a ServiceAccount, a Role with
+`get`/`create`/`update`/`patch` on secrets, and a RoleBinding.
+
+## Image Configuration
+
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `image.repo` | `ghcr.io/gothenburgbitfactory/taskchampion-sync-server` | Image repository |
+| `image.tag` | `"0.7.0"` | Image tag |
+| `image.pullPolicy` | `IfNotPresent` | Pull policy |
+| `image.pullSecrets` | `[]` | Pull secrets |
+
+PostgreSQL appends `-postgres` to the image repo automatically.
+
+## Environment Variables
+
+Custom env vars are passed via `env`. `DATA_DIR` (SQLite) and `conn`
+(PostgreSQL) are set automatically and must not be set manually.
+
+## Full Configuration
+
+See [values.yaml](values.yaml).

helm/taskchampion-sync-server/examples/postgres-values.yaml

@@ -10,9 +10,12 @@ postgres:
 clientIdSecret: "taskchampion-client-ids"
 
 env:
-  RUST_LOG: debug
+  - name: RUST_LOG
-  LISTEN: "0.0.0.0:8080"
+    value: debug
-  CREATE_CLIENTS: "false"
+  - name: LISTEN
+    value: "0.0.0.0:8080"
+  - name: CREATE_CLIENTS
+    value: "false"
 
 replicas:
   enabled: true
@@ -20,7 +23,7 @@ replicas:
 
 image:
   pullSecrets:
-    - my-registry-secret
+    - name: my-registry-secret
 
 httpRoute:
   enabled: true

helm/taskchampion-sync-server/examples/sqlite-values.yaml

@@ -12,9 +12,12 @@ postgres:
 clientIdSecret: "taskchampion-client-ids"
 
 env:
-  RUST_LOG: info
+  - name: RUST_LOG
-  LISTEN: "0.0.0.0:8080"
+    value: info
-  CREATE_CLIENTS: "false"
+  - name: LISTEN
+    value: "0.0.0.0:8080"
+  - name: CREATE_CLIENTS
+    value: "false"
 
 ingress:
   enabled: true

helm/taskchampion-sync-server/templates/NOTES.txt

@@ -0,0 +1,46 @@
+Thank you for installing {{ .Chart.Name }} — version {{ .Chart.Version }} (app: {{ .Chart.AppVersion }}).
+
+## Storage Backend
+
+{{- if eq .Values.sqlite.enabled true }}
+**SQLite** — Data is stored at `{{ .Values.sqlite.dataDir }}`.
+{{- if .Values.sqlite.persistence.enabled }}
+  PersistentVolumeClaim: `{{ include "taskchampion-sync-server.fullname" . }}-pvc`
+{{- else if .Values.sqlite.existingPV }}
+  Using existing PVC: `{{ .Values.sqlite.existingPV }}`
+{{- else }}
+  Using an emptyDir volume (ephemeral — data is lost on pod restart).
+  Set `sqlite.persistence.enabled=true` for persistent storage.
+{{- end }}
+{{- end }}
+
+{{- if eq .Values.postgres.enabled true }}
+**PostgreSQL** — Connection URI stored in Secret `{{ include "taskchampion-sync-server.postgres-secret-name" . }}`.
+  Host: {{ .Values.postgres.host }}:{{ .Values.postgres.port }}
+  Database: {{ .Values.postgres.database }}
+{{- end }}
+
+## Verify the Deployment
+
+  kubectl get pods -l {{ include "taskchampion-sync-server.selectorLabels" . | replace ": " "=" | replace "\n" "," | trimSuffix "," }}
+
+## Check Pod Logs
+
+  kubectl logs -l {{ include "taskchampion-sync-server.selectorLabels" . | replace ": " "=" | replace "\n" "," | trimSuffix "," }}
+
+## Test the API
+
+  kubectl port-forward svc/{{ include "taskchampion-sync-server.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }}
+  curl http://localhost:{{ .Values.service.port }}/
+
+## View Connection Secret (PostgreSQL only)
+
+{{- if eq .Values.postgres.enabled true }}
+  kubectl get secret {{ include "taskchampion-sync-server.postgres-secret-name" . }} -o jsonpath="{.data.connection}" | base64 -d
+{{- end }}
+
+## Configuration
+
+For full configuration options, see:
+
+  https://github.com/GothenburgBitFactory/taskchampion-sync-server

helm/taskchampion-sync-server/templates/_helpers.tpl

@@ -23,6 +23,7 @@ taskchampion-sync-server helpers
 helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 app.kubernetes.io/name: {{ include "taskchampion-sync-server.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/component: server
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
@@ -32,13 +33,6 @@ app.kubernetes.io/name: {{ include "taskchampion-sync-server.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
-{{- define "taskchampion-sync-server.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create }}
-{{- default (include "taskchampion-sync-server.fullname" .) .Values.serviceAccount.name }}
-{{- else }}
-{{- default "default" .Values.serviceAccount.name }}
-{{- end }}
-{{- end }}
 
 {{- define "taskchampion-sync-server.postgres-connection" -}}
   {{- $host := .Values.postgres.host -}}
@@ -100,3 +94,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- define "taskchampion-sync-server.postgres-secret-name" -}}
 {{- printf "%s-connection" .Release.Name -}}
 {{- end -}}
+
+{{- define "taskchampion-sync-server.serviceAccountName" -}}
+{{- default (include "taskchampion-sync-server.fullname" .) .Values.serviceAccount.name -}}
+{{- end -}}

helm/taskchampion-sync-server/templates/deployment.yaml

@@ -18,10 +18,13 @@ spec:
       labels:
         {{- include "taskchampion-sync-server.selectorLabels" . | nindent 8 }}
     spec:
+
+      {{- with .Values.image.pullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if .Values.serviceAccount.create }}
-      serviceAccountName: {{ include "taskchampion-sync-server.fullname" . }}
+      serviceAccountName: {{ include "taskchampion-sync-server.serviceAccountName" . }}
-      {{- else if .Values.serviceAccount.name }}
-      serviceAccountName: {{ .Values.serviceAccount.name }}
       {{- end }}
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
@@ -32,6 +35,8 @@ spec:
           imagePullPolicy: {{ .Values.postgres.initContainer.imagePullPolicy }}
           securityContext:
             allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 999
           env:
             - name: PGURI
               valueFrom:
@@ -90,11 +95,18 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           securityContext:
             allowPrivilegeEscalation: false
-          env:
+            runAsNonRoot: true
-            {{- range $name, $value := .Values.env }}
+            runAsUser: 1092
-            - name: {{ $name }}
+            readOnlyRootFilesystem: true
-              value: {{ $value | quote }}
+          {{- if eq .Values.postgres.enabled true }}
+          command:
+            - /bin/taskchampion-sync-server-postgres
+          {{- else }}
+          command:
+            - /bin/taskchampion-sync-server
           {{- end }}
+          env:
+            {{- toYaml .Values.env | nindent 12 }}
             {{- if .Values.clientIdSecret }}
             - name: CLIENT_ID
               valueFrom:
@@ -117,9 +129,24 @@ spec:
             - name: http
               containerPort: {{ .Values.service.targetPort }}
               protocol: TCP
-          {{- with .Values.resources }}
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          {{- if eq .Values.postgres.enabled true }}
           resources:
-            {{- toYaml . | nindent 12 }}
+            {{- toYaml .Values.postgres.resources | nindent 12 }}
+          {{- else }}
+          resources:
+            {{- toYaml .Values.sqlite.resources | nindent 12 }}
           {{- end }}
           {{- if eq .Values.sqlite.enabled true }}
           volumeMounts:

helm/taskchampion-sync-server/templates/ingress.yaml

@@ -18,7 +18,10 @@ spec:
     {{- toYaml .Values.ingress.tls | nindent 4 }}
   {{- end }}
   rules:
+    {{- $svcName := include "taskchampion-sync-server.fullname" . -}}
+    {{- $svcPort := $.Values.service.port -}}
     {{- range .Values.ingress.hosts }}
+    {{- if kindIs "string" . }}
     - host: {{ . | quote }}
       http:
         paths:
@@ -26,8 +29,30 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: {{ include "taskchampion-sync-server.fullname" $ }}
+                name: {{ $svcName }}
                 port:
-                  number: {{ $.Values.service.port }}
+                  number: {{ $svcPort }}
+    {{- else }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path | default "/" | quote }}
+            pathType: {{ .pathType | default "Prefix" }}
+            backend:
+              service:
+                name: {{ $svcName }}
+                port:
+                  number: {{ $svcPort }}
+          {{- else }}
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ $svcName }}
+                port:
+                  number: {{ $svcPort }}
+          {{- end }}
+    {{- end }}
     {{- end }}
 {{- end }}

helm/taskchampion-sync-server/templates/serviceaccount.yaml

@@ -2,37 +2,8 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "taskchampion-sync-server.fullname" . }}
+  name: {{ include "taskchampion-sync-server.serviceAccountName" . }}
-  labels:
-    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "taskchampion-sync-server.fullname" . }}-secret-manager
-  labels:
-    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["create", "get", "update", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "taskchampion-sync-server.fullname" . }}-secret-binding
-  labels:
-    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ include "taskchampion-sync-server.fullname" . }}-secret-manager
-subjects:
-- kind: ServiceAccount
-  name: {{ include "taskchampion-sync-server.fullname" . }}
   namespace: {{ .Release.Namespace }}
-{{- end -}}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+{{- end }}

helm/taskchampion-sync-server/templates/validation-config.yaml

@@ -1,3 +1,10 @@
+{{- /* Validate imagePullSecrets entries are objects (not plain strings) */ -}}
+{{- range $i, $secret := .Values.image.pullSecrets -}}
+  {{- if not (kindIs "map" $secret) -}}
+    {{- fail (printf "ERROR: image.pullSecrets[%d] is a string (%q). Each entry must be an object with a 'name' key, e.g.\n  image:\n    pullSecrets:\n      - name: %s" $i $secret $secret) -}}
+  {{- end -}}
+{{- end -}}
+
 {{- if and (eq .Values.sqlite.enabled false) (eq .Values.postgres.enabled false) -}}
 {{- fail "ERROR: Exactly one storage backend must be enabled. Either sqlite.enabled or postgres.enabled must be true." -}}
 {{- end -}}

helm/taskchampion-sync-server/values.yaml

@@ -9,6 +9,9 @@ image:
   tag: "0.7.0"
   pullPolicy: IfNotPresent
   pullSecrets: []
+  # pullSecrets expects a list of objects with a "name" key:
+  # pullSecrets:
+  #   - name: my-registry-cred
 
 # Existing secret containing client IDs (comma-separated UUIDs)
 # Expected key: client-ids
@@ -16,10 +19,19 @@ clientIdSecret: ""
 
 # Environment variables passed directly to the container
 # NOTE: DATA_DIR and CONNECTION are set automatically based on backend
+# To add secret/configMap references, use valueFrom:
+#   - name: MY_SECRET_VAR
+#     valueFrom:
+#       secretKeyRef:
+#         name: my-secret
+#         key: my-key
 env:
-  RUST_LOG: info
+  - name: RUST_LOG
-  LISTEN: "0.0.0.0:8080"
+    value: info
-  CREATE_CLIENTS: "true"
+  - name: LISTEN
+    value: "0.0.0.0:8080"
+  - name: CREATE_CLIENTS
+    value: "true"
 
 # Service configuration
 service:
@@ -28,6 +40,14 @@ service:
   targetPort: 8080
 
 # Ingress configuration
+# Each host can be a string (simple) or a map with path rules:
+#   hosts:
+#     - host: app.example.com
+#       paths:
+#         - path: /
+#           pathType: Prefix
+#         - path: /api
+#           pathType: Exact
 ingress:
   enabled: false
   className: ""
@@ -71,20 +91,21 @@ httpRoute:
   path: "/"
   port: 8080
 
-# Resource limits and requests
-resources: {}
-  # limits:
-  #   memory: 128Mi
-  #   cpu: 100m
-  # requests:
-  #   memory: 64Mi
-  #   cpu: 50m
-
 # Replica configuration (only applies when postgres is enabled)
 replicas:
   enabled: false
   count: 1
 
+# ServiceAccount configuration
+# The app does not access the Kubernetes API, so no RBAC permissions are needed.
+# A dedicated ServiceAccount is created to give the pod a stable identity
+# for network policies, pod security, or future RBAC.
+serviceAccount:
+  # create specifies whether a ServiceAccount should be created
+  create: true
+  # name sets the ServiceAccount name
+  name: taskchampion-sync-server
+
 # Security context for the pod
 # NOTE: runAsUser and runAsGroup are intentionally unset.
 # The Docker entrypoint requires root to chown the data directory and then
@@ -96,6 +117,15 @@ securityContext:
 sqlite:
   enabled: false
   dataDir: /var/lib/taskchampion-sync-server/data
+  # Resource limits and requests
+  resources:
+    limits:
+      memory: 25Mi
+      cpu: 100m
+    requests:
+      # 5Mi is sufficient for the SQLite image
+      memory: 5Mi
+      cpu: 10m
   existingPV: ""
   emptyDir:
     sizeLimit: ""
@@ -107,12 +137,6 @@ sqlite:
     storageClass: ""
     existingClaim: ""
 
-# Service account configuration
-serviceAccount:
-  create: true  # Default: automatically create service account
-  name: ""      # Optional: use existing service account
-  annotations: {}
-
 # PostgreSQL configuration
 postgres:
   enabled: false
@@ -134,3 +158,12 @@ postgres:
     # Override the schema URL. Defaults to the official schema for this chart's appVersion.
     # e.g. https://raw.githubusercontent.com/GothenburgBitFactory/taskchampion-sync-server/v0.7.0/postgres/schema.sql
     schemaUrl: ""
+  # Resource limits and requests
+  resources:
+    limits:
+      memory: 100Mi
+      cpu: 100m
+    requests:
+      # 20Mi is the minimum for the Postgres image
+      memory: 20Mi
+      cpu: 10m