add gitea docker publish workflow

allow running with custom PUID and PGID
2026-07-16 08:24:45 +00:00 · 2026-01-02 14:54:11 +01:00 · 2026-01-02 14:42:07 +01:00
33 changed files with 173 additions and 1645 deletions
--- a/.gitea/workflows/docker.yaml
+++ b/.gitea/workflows/docker.yaml
@ -0,0 +1,57 @@
+---
+name: docker-publish
+on: [push, workflow_dispatch]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Set up docker
+        uses: docker/setup-buildx-action@v3
+      - name: Log in to the Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ gitea.server_url }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.PACKAGES_TOKEN }}
+      - name: Extract metadata for SQLite image
+        id: meta-sqlite
+        uses: docker/metadata-action@v5
+        with:
+          images: gitea.bp99.eu/${{ gitea.repository }}
+          tags: |
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=raw,value=latest
+      - name: Extract metadata for PostgreSQL image
+        id: meta-postgres
+        uses: docker/metadata-action@v5
+        with:
+          images: gitea.bp99.eu/${{ gitea.repository }}-postgres
+          tags: |
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=raw,value=latest
+      - name: Build and push SQLite docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: ./
+          file: Dockerfile-sqlite
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.meta-sqlite.outputs.tags }}
+          labels: ${{ steps.meta-sqlite.outputs.labels }}
+      - name: Build and push PostgreSQL docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: ./
+          file: Dockerfile-postgres
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.meta-postgres.outputs.tags }}
+          labels: ${{ steps.meta-postgres.outputs.labels }}
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@ -5,9 +5,6 @@ updates:
    directory: "/"
    schedule:
      interval: "weekly"
-    groups:
-      github-actions:
-        patterns: ["*"]
  # Enable updates for Rust packages
  - package-ecosystem: "cargo"
    directory: "/" # Location of package manifests
@ -19,8 +16,3 @@ updates:
      # behind
      - dependency-name: "*"
        update-types: ["version-update:semver-patch"]
-    groups:
-      cargo:
-        patterns: ["*"]
-        # leave major changes in their own PRs
-        update-types: ["minor", "patch"]
--- a/.github/workflows/add-to-project.yml
+++ b/.github/workflows/add-to-project.yml
@ -12,7 +12,7 @@ jobs:
    name: Add issue to project
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/add-to-project@v2.0.0
+      - uses: actions/add-to-project@v1.0.2
        with:
          project-url: https://github.com/orgs/GothenburgBitFactory/projects/4
          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@ -10,18 +10,18 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
      - name: Login to ghcr.io
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Docker meta
        id: meta-sqlite
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/gothenburgbitfactory/taskchampion-sync-server
@ -31,7 +31,7 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
            type=match,pattern=\d.\d.\d,value=latest
      - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
        with:
          file: "./Dockerfile-sqlite"
          platforms: linux/amd64,linux/arm64
@ -42,16 +42,16 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3
      - name: Login to ghcr.io
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Docker meta
        id: meta-postgres
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/gothenburgbitfactory/taskchampion-sync-server-postgres
@ -61,7 +61,7 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
            type=match,pattern=\d.\d.\d,value=latest
      - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
        with:
          file: "./Dockerfile-postgres"
          platforms: linux/amd64,linux/arm64
--- a/.github/workflows/helm-test.yml
+++ b/.github/workflows/helm-test.yml
@ -1,169 +0,0 @@
-name: Helm Chart Tests
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'helm/**'
-  pull_request:
-    paths:
-      - 'helm/**'
-
-jobs:
-  helm-test:
-    runs-on: ubuntu-latest
-    name: "Helm Lint & Template"
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Install Helm
-        uses: azure/setup-helm@v5
-        with:
-          version: latest
-
-      - name: Helm lint (default values — expects failure, no backend enabled)
-        run: |
-          helm lint helm/taskchampion-sync-server \
-            --strict 2>&1 || true
-
-      - name: Template default values — must fail validation
-        run: |
-          if helm template test-release helm/taskchampion-sync-server 2>/dev/null; then
-            echo "❌ Expected chart to fail validation (no backend enabled) but it succeeded"
-            exit 1
-          fi
-          echo "✓ Correctly rejects chart with no backend enabled"
-
-      - name: Template with SQLite values
-        run: |
-          helm template test-release helm/taskchampion-sync-server \
-            -f helm/taskchampion-sync-server/examples/sqlite-values.yaml \
-            --debug > /tmp/helm-sqlite.yaml
-
-          echo "=== Generated resources (SQLite) ==="
-          grep -E '^# Source:' /tmp/helm-sqlite.yaml
-
-          # Verify key resources exist
-          grep -q 'kind: Deployment' /tmp/helm-sqlite.yaml
-          grep -q 'kind: Service' /tmp/helm-sqlite.yaml
-          grep -q 'kind: Ingress' /tmp/helm-sqlite.yaml
-
-          # Verify SQLite-specific rendering
-          grep -q 'emptyDir' /tmp/helm-sqlite.yaml
-          grep -q 'DATA_DIR' /tmp/helm-sqlite.yaml
-
-          # Verify PostgreSQL-specific rendering is absent
-          if grep -q 'initContainers' /tmp/helm-sqlite.yaml; then
-            echo "❌ initContainers should not appear in SQLite mode"
-            exit 1
-          fi
-          if grep -q 'CONNECTION' /tmp/helm-sqlite.yaml; then
-            echo "❌ CONNECTION env var should not appear in SQLite mode"
-            exit 1
-          fi
-
-          # Verify correct image tag (no -postgres suffix)
-          grep -q 'image:.*taskchampion-sync-server:0.7.0' /tmp/helm-sqlite.yaml
-          echo "✓ SQLite template generated successfully"
-
-      - name: Template with PostgreSQL values
-        run: |
-          helm template test-release helm/taskchampion-sync-server \
-            -f helm/taskchampion-sync-server/examples/postgres-values.yaml \
-            --debug > /tmp/helm-postgres.yaml
-
-          echo "=== Generated resources (PostgreSQL) ==="
-          grep -E '^# Source:' /tmp/helm-postgres.yaml
-
-          # Verify key resources exist
-          grep -q 'kind: Deployment' /tmp/helm-postgres.yaml
-          grep -q 'kind: Service' /tmp/helm-postgres.yaml
-          grep -q 'kind: Secret' /tmp/helm-postgres.yaml
-
-          # Verify PostgreSQL-specific rendering
-          grep -q 'kind: HTTPRoute' /tmp/helm-postgres.yaml
-          grep -q 'initContainers' /tmp/helm-postgres.yaml
-          grep -q 'CONNECTION' /tmp/helm-postgres.yaml
-          grep -q 'replicas: 3' /tmp/helm-postgres.yaml
-
-          # Verify correct image tag (with -postgres suffix)
-          grep -q 'image:.*taskchampion-sync-server-postgres:0.7.0' /tmp/helm-postgres.yaml
-
-          # Verify SQLite-specific rendering is absent
-          if grep -q 'DATA_DIR' /tmp/helm-postgres.yaml; then
-            echo "❌ DATA_DIR env var should not appear in PostgreSQL mode"
-            exit 1
-          fi
-          echo "✓ PostgreSQL template generated successfully"
-
-      - name: Template with both backends enabled — must fail validation
-        run: |
-          if helm template test-release helm/taskchampion-sync-server \
-            --set sqlite.enabled=true \
-            --set postgres.enabled=true 2>/dev/null; then
-            echo "❌ Expected chart to fail validation (both backends enabled) but it succeeded"
-            exit 1
-          fi
-          echo "✓ Correctly rejects chart with both backends enabled"
-
-      - name: Template with custom overrides
-        run: |
-          helm template test-release helm/taskchampion-sync-server \
-            --set sqlite.enabled=true \
-            --set postgres.enabled=false \
-            --set nameOverride=custom-name \
-            --set image.tag=latest \
-            --debug > /tmp/helm-custom.yaml
-
-          # Verify custom name override
-          grep -q 'custom-name' /tmp/helm-custom.yaml
-          grep -q 'custom-name-pvc' /tmp/helm-custom.yaml
-
-          # Verify custom image tag
-          grep -q 'image:.*taskchampion-sync-server:latest' /tmp/helm-custom.yaml
-          echo "✓ Custom overrides template generated successfully"
-
-      - name: Helm install dry-run (SQLite)
-        run: |
-          helm install test-release helm/taskchampion-sync-server \
-            -f helm/taskchampion-sync-server/examples/sqlite-values.yaml \
-            --dry-run 2>&1 | head -5
-          echo "✓ Helm install dry-run (SQLite) succeeded"
-
-  helm-kubeconform:
-    runs-on: ubuntu-latest
-    name: "Kubeconform Validation"
-    needs: helm-test
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Install Helm
-        uses: azure/setup-helm@v5
-        with:
-          version: latest
-
-      - name: Download kubeconform
-        run: |
-          wget -q -O /tmp/kubeconform.tar.gz \
-            https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz
-          tar -xzf /tmp/kubeconform.tar.gz -C /usr/local/bin/ kubeconform
-          kubeconform -v
-
-      - name: Validate SQLite output against Kubernetes schemas
-        run: |
-          helm template test-release helm/taskchampion-sync-server \
-            -f helm/taskchampion-sync-server/examples/sqlite-values.yaml > /tmp/helm-sqlite.yaml
-          kubeconform -strict /tmp/helm-sqlite.yaml
-          echo "✓ SQLite resources are valid Kubernetes manifests"
-
-      - name: Validate PostgreSQL output against Kubernetes schemas
-        run: |
-          helm template test-release helm/taskchampion-sync-server \
-            -f helm/taskchampion-sync-server/examples/postgres-values.yaml > /tmp/helm-postgres.yaml
-          # Skip kubeconform on HTTPRoute since Gateway API CRDs aren't bundled
-          kubeconform -strict -ignore-missing-schemas /tmp/helm-postgres.yaml
-          echo "✓ PostgreSQL resources are valid Kubernetes manifests"
--- a/.github/workflows/publish-docs.yml
+++ b/.github/workflows/publish-docs.yml
@ -28,4 +28,3 @@ jobs:
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: ./docs/book
-          keep_files: true
--- a/.github/workflows/publish-helm.yml
+++ b/.github/workflows/publish-helm.yml
@ -1,36 +0,0 @@
-name: Publish Helm Charts
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'helm/**'
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Configure Git
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-
-      - name: Install Helm
-        uses: azure/setup-helm@v5
-
-      - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.7.0
-        env:
-          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-        with:
-          charts_dir: helm
-          install_dir: helm-chart
--- a/.github/workflows/rust-tests.yml
+++ b/.github/workflows/rust-tests.yml
@ -15,7 +15,7 @@ jobs:
          - "17"
        rust:
          # MSRV
-          - "1.88.0"
+          - "1.85.0"
          - "stable"

    runs-on: ubuntu-latest
--- a/Cargo.lock
+++ b/Cargo.lock
@ -21,9 +21,9 @@ dependencies = [

 [[package]]
 name = "actix-http"
-version = "3.12.1"
+version = "3.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93acb4a42f64936f9b8cae4a433b237599dd6eb6ed06124eb67132ef8cc90662"
+checksum = "7926860314cbe2fb5d1f13731e387ab43bd32bca224e82e6e2db85de0a3dba49"
 dependencies = [
 "actix-codec",
 "actix-rt",
@ -49,7 +49,7 @@ dependencies = [
 "mime",
 "percent-encoding",
 "pin-project-lite",
- "rand 0.10.1",
+ "rand",
 "sha1",
 "smallvec",
 "tokio",
@ -70,9 +70,9 @@ dependencies = [

 [[package]]
 name = "actix-router"
-version = "0.5.4"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14f8c75c51892f18d9c46150c5ac7beb81c95f78c8b83a634d49f4ca32551fe7"
+checksum = "13d324164c51f63867b57e73ba5936ea151b8a41a1d23d1031eeb9f70d0236f8"
 dependencies = [
 "bytestring",
 "cfg-if",
@ -133,9 +133,9 @@ dependencies = [

 [[package]]
 name = "actix-web"
-version = "4.13.0"
+version = "4.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff87453bc3b56e9b2b23c1cc0b1be8797184accf51d2abe0f8a33ec275d316bf"
+checksum = "2233f53f6cb18ae038ce1f0713ca0c72ca0c4b71fe9aaeb59924ce2c89c6dd85"
 dependencies = [
 "actix-codec",
 "actix-http",
@ -168,7 +168,7 @@ dependencies = [
 "serde_json",
 "serde_urlencoded",
 "smallvec",
- "socket2 0.6.3",
+ "socket2 0.6.0",
 "time",
 "tracing",
 "url",
@ -238,22 +238,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "301af1932e46185686725e0fad2f8f2aa7da69dd70bf6ecc44d6b703844a3933"
 dependencies = [
 "anstyle",
- "anstyle-parse 0.2.7",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is_terminal_polyfill",
- "utf8parse",
-]
-
-[[package]]
-name = "anstream"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
-dependencies = [
- "anstyle",
- "anstyle-parse 1.0.0",
+ "anstyle-parse",
 "anstyle-query",
 "anstyle-wincon",
 "colorchoice",
@ -263,9 +248,9 @@ dependencies = [

 [[package]]
 name = "anstyle"
-version = "1.0.13"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"

 [[package]]
 name = "anstyle-parse"
@ -276,15 +261,6 @@ dependencies = [
 "utf8parse",
 ]

-[[package]]
-name = "anstyle-parse"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
-dependencies = [
- "utf8parse",
-]
-
 [[package]]
 name = "anstyle-query"
 version = "1.1.3"
@ -371,15 +347,6 @@ dependencies = [
 "generic-array",
 ]

-[[package]]
-name = "block-buffer"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "brotli"
 version = "8.0.1"
@ -415,9 +382,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"

 [[package]]
 name = "bytes"
-version = "1.11.1"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"

 [[package]]
 name = "bytestring"
@ -445,17 +412,6 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"

-[[package]]
-name = "chacha20"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "rand_core 0.10.1",
-]
-
 [[package]]
 name = "chrono"
 version = "0.4.41"
@ -473,20 +429,20 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.6.0"
+version = "4.5.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b193af5b67834b676abd72466a96c1024e6a6ad978a1f484bd90b85c94041351"
+checksum = "be92d32e80243a54711e5d7ce823c35c41c9d929dc4ab58e1276f625841aadf9"
 dependencies = [
 "clap_builder",
 ]

 [[package]]
 name = "clap_builder"
-version = "4.6.0"
+version = "4.5.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+checksum = "707eab41e9622f9139419d573eca0900137718000c517d47da73045f54331c3d"
 dependencies = [
- "anstream 1.0.0",
+ "anstream",
 "anstyle",
 "clap_lex",
 "strsim",
@ -494,9 +450,9 @@ dependencies = [

 [[package]]
 name = "clap_lex"
-version = "1.1.0"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+checksum = "b94f61472cee1439c0b966b47e3aca9ae07e45d070759512cd390ea2bebc6675"

 [[package]]
 name = "colorchoice"
@ -504,12 +460,6 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"

-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
 [[package]]
 name = "cookie"
 version = "0.16.2"
@ -546,15 +496,6 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "cpufeatures"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "crc32fast"
 version = "1.4.2"
@ -574,20 +515,11 @@ dependencies = [
 "typenum",
 ]

-[[package]]
-name = "crypto-common"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "deranged"
-version = "0.5.5"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ececcb659e7ba858fb4f10388c250a7252eb0a27373f1a72b8748afdd248e587"
+checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
 dependencies = [
 "powerfmt",
 ]
@ -625,22 +557,11 @@ version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer 0.10.4",
- "crypto-common 0.1.6",
+ "block-buffer",
+ "crypto-common",
 "subtle",
 ]

-[[package]]
-name = "digest"
-version = "0.11.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4850db49bf08e663084f7fb5c87d202ef91a3907271aff24a94eb97ff039153c"
-dependencies = [
- "block-buffer 0.12.0",
- "const-oid",
- "crypto-common 0.2.1",
-]
-
 [[package]]
 name = "displaydoc"
 version = "0.2.5"
@ -677,7 +598,7 @@ version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13c863f0904021b108aa8b2f55046443e6b1ebde8fd4a15c399893aae4fa069f"
 dependencies = [
- "anstream 0.6.19",
+ "anstream",
 "anstyle",
 "env_filter",
 "jiff",
@ -881,20 +802,6 @@ dependencies = [
 "wasi 0.14.2+wasi-0.2.4",
 ]

-[[package]]
-name = "getrandom"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "139ef39800118c7683f2fd3c98c1b23c09ae076556b435f8e9064ae108aaeeec"
-dependencies = [
- "cfg-if",
- "libc",
- "r-efi",
- "rand_core 0.10.1",
- "wasip2",
- "wasip3",
-]
-
 [[package]]
 name = "h2"
 version = "0.3.27"
@ -932,19 +839,13 @@ dependencies = [
 "hashbrown",
 ]

-[[package]]
-name = "heck"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
-
 [[package]]
 name = "hmac"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "digest 0.10.7",
+ "digest",
 ]

 [[package]]
@ -970,15 +871,6 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"

-[[package]]
-name = "hybrid-array"
-version = "0.4.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3944cf8cf766b40e2a1a333ee5e9b563f854d5fa49d6a8ca2764e97c6eddb214"
-dependencies = [
- "typenum",
-]
-
 [[package]]
 name = "iana-time-zone"
 version = "0.1.63"
@ -1089,12 +981,6 @@ dependencies = [
 "zerovec",
 ]

-[[package]]
-name = "id-arena"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
-
 [[package]]
 name = "idna"
 version = "1.0.3"
@ -1130,7 +1016,6 @@ checksum = "fe4cd85333e22411419a0bcae1297d25e58c9443848b11dc6a86fefe8c78a661"
 dependencies = [
 "equivalent",
 "hashbrown",
- "serde",
 ]

 [[package]]
@ -1175,7 +1060,7 @@ version = "0.1.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "38f262f097c174adebe41eb73d66ae9c06b2844fb0da69969647bbddd9b0538a"
 dependencies = [
- "getrandom 0.3.3",
+ "getrandom",
 "libc",
 ]

@ -1195,17 +1080,11 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d4345964bb142484797b161f473a503a434de77149dd8c7427788c6e13379388"

-[[package]]
-name = "leb128fmt"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
-
 [[package]]
 name = "libc"
-version = "0.2.184"
+version = "0.2.174"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48f5d2a454e16a5ea0f4ced81bd44e4cfc7bd3a507b61887c99fd3538b28e4af"
+checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"

 [[package]]
 name = "libsqlite3-sys"
@ -1220,9 +1099,9 @@ dependencies = [

 [[package]]
 name = "linux-raw-sys"
-version = "0.12.1"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"

 [[package]]
 name = "litemap"
@ -1270,7 +1149,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
 dependencies = [
 "cfg-if",
- "digest 0.10.7",
+ "digest",
 ]

 [[package]]
@ -1296,14 +1175,14 @@ dependencies = [

 [[package]]
 name = "mio"
-version = "1.2.0"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
+checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
 dependencies = [
 "libc",
 "log",
 "wasi 0.11.1+wasi-snapshot-preview1",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@ -1325,9 +1204,9 @@ dependencies = [

 [[package]]
 name = "num-conv"
-version = "0.2.0"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"

 [[package]]
 name = "num-traits"
@ -1352,14 +1231,15 @@ checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"

 [[package]]
 name = "openssl"
-version = "0.10.80"
+version = "0.10.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a45fa2aa886c42762255da344f0a0d313e254066c46aad76f300c3d3da62d967"
+checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8"
 dependencies = [
 "bitflags",
 "cfg-if",
 "foreign-types",
 "libc",
+ "once_cell",
 "openssl-macros",
 "openssl-sys",
 ]
@ -1392,9 +1272,9 @@ dependencies = [

 [[package]]
 name = "openssl-sys"
-version = "0.9.116"
+version = "0.9.109"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f28a22dc7140cda5f096e5e7724a6962ca81a7f8bfd2979f9b18c11af56318c4"
+checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571"
 dependencies = [
 "cc",
 "libc",
@ -1508,7 +1388,7 @@ dependencies = [
 "hmac",
 "md-5",
 "memchr",
- "rand 0.9.4",
+ "rand",
 "sha2",
 "stringprep",
 ]
@ -1559,16 +1439,6 @@ dependencies = [
 "yansi",
 ]

-[[package]]
-name = "prettyplease"
-version = "0.2.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
-dependencies = [
- "proc-macro2",
- "syn",
-]
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.95"
@ -1595,23 +1465,12 @@ checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"

 [[package]]
 name = "rand"
-version = "0.9.4"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
 dependencies = [
 "rand_chacha",
- "rand_core 0.9.3",
-]
-
-[[package]]
-name = "rand"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
-dependencies = [
- "chacha20",
- "getrandom 0.4.1",
- "rand_core 0.10.1",
+ "rand_core",
 ]

 [[package]]
@ -1621,7 +1480,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
 "ppv-lite86",
- "rand_core 0.9.3",
+ "rand_core",
 ]

 [[package]]
@ -1630,15 +1489,9 @@ version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
 dependencies = [
- "getrandom 0.3.3",
+ "getrandom",
 ]

-[[package]]
-name = "rand_core"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
-
 [[package]]
 name = "redox_syscall"
 version = "0.5.13"
@ -1699,15 +1552,15 @@ dependencies = [

 [[package]]
 name = "rustix"
-version = "1.1.4"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266"
 dependencies = [
 "bitflags",
 "errno",
 "libc",
 "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@ -1760,12 +1613,6 @@ dependencies = [
 "libc",
 ]

-[[package]]
-name = "semver"
-version = "1.0.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
-
 [[package]]
 name = "serde"
 version = "1.0.228"
@ -1822,13 +1669,13 @@ dependencies = [

 [[package]]
 name = "sha1"
-version = "0.11.0"
+version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
 "cfg-if",
- "cpufeatures 0.3.0",
- "digest 0.11.2",
+ "cpufeatures",
+ "digest",
 ]

 [[package]]
@ -1838,8 +1685,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
 "cfg-if",
- "cpufeatures 0.2.17",
- "digest 0.10.7",
+ "cpufeatures",
+ "digest",
 ]

 [[package]]
@ -1887,12 +1734,12 @@ dependencies = [

 [[package]]
 name = "socket2"
-version = "0.6.3"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807"
 dependencies = [
 "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@ -1926,9 +1773,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"

 [[package]]
 name = "syn"
-version = "2.0.116"
+version = "2.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3df424c70518695237746f84cede799c9c58fcb37450d7b23716568cc8bc69cb"
+checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
 dependencies = [
 "proc-macro2",
 "quote",
@ -2035,12 +1882,12 @@ dependencies = [

 [[package]]
 name = "tempfile"
-version = "3.27.0"
+version = "3.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
 dependencies = [
 "fastrand",
- "getrandom 0.4.1",
+ "getrandom",
 "once_cell",
 "rustix",
 "windows-sys 0.61.2",
@ -2068,30 +1915,30 @@ dependencies = [

 [[package]]
 name = "time"
-version = "0.3.47"
+version = "0.3.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
 dependencies = [
 "deranged",
 "itoa",
 "num-conv",
 "powerfmt",
- "serde_core",
+ "serde",
 "time-core",
 "time-macros",
 ]

 [[package]]
 name = "time-core"
-version = "0.1.8"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"

 [[package]]
 name = "time-macros"
-version = "0.2.27"
+version = "0.2.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
 dependencies = [
 "num-conv",
 "time-core",
@ -2124,9 +1971,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"

 [[package]]
 name = "tokio"
-version = "1.52.0"
+version = "1.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a91135f59b1cbf38c91e73cf3386fca9bb77915c45ce2771460c9d92f0f3d776"
+checksum = "ff360e02eab121e0bc37a2d3b4d4dc622e6eda3a8e5253d5435ecf5bd4c68408"
 dependencies = [
 "bytes",
 "libc",
@ -2134,16 +1981,16 @@ dependencies = [
 "parking_lot",
 "pin-project-lite",
 "signal-hook-registry",
- "socket2 0.6.3",
+ "socket2 0.6.0",
 "tokio-macros",
 "windows-sys 0.61.2",
 ]

 [[package]]
 name = "tokio-macros"
-version = "2.7.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
 dependencies = [
 "proc-macro2",
 "quote",
@ -2179,7 +2026,7 @@ dependencies = [
 "pin-project-lite",
 "postgres-protocol",
 "postgres-types",
- "rand 0.9.4",
+ "rand",
 "socket2 0.5.10",
 "tokio",
 "tokio-util",
@ -2295,11 +2142,11 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"

 [[package]]
 name = "uuid"
-version = "1.23.0"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ac8b6f42ead25368cf5b098aeb3dc8a1a2c05a3eee8a9a1a68c640edbfc79d9"
+checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a"
 dependencies = [
- "getrandom 0.4.1",
+ "getrandom",
 "js-sys",
 "serde_core",
 "wasm-bindgen",
@ -2332,24 +2179,6 @@ dependencies = [
 "wit-bindgen-rt",
 ]

-[[package]]
-name = "wasip2"
-version = "1.0.2+wasi-0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
-dependencies = [
- "wit-bindgen",
-]
-
-[[package]]
-name = "wasip3"
-version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
-dependencies = [
- "wit-bindgen",
-]
-
 [[package]]
 name = "wasite"
 version = "0.1.0"
@ -2414,40 +2243,6 @@ dependencies = [
 "unicode-ident",
 ]

-[[package]]
-name = "wasm-encoder"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
-dependencies = [
- "leb128fmt",
- "wasmparser",
-]
-
-[[package]]
-name = "wasm-metadata"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
-dependencies = [
- "anyhow",
- "indexmap",
- "wasm-encoder",
- "wasmparser",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
-dependencies = [
- "bitflags",
- "hashbrown",
- "indexmap",
- "semver",
-]
-
 [[package]]
 name = "web-sys"
 version = "0.3.77"
@ -2625,26 +2420,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

-[[package]]
-name = "wit-bindgen"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
-dependencies = [
- "wit-bindgen-rust-macro",
-]
-
-[[package]]
-name = "wit-bindgen-core"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
-dependencies = [
- "anyhow",
- "heck",
- "wit-parser",
-]
-
 [[package]]
 name = "wit-bindgen-rt"
 version = "0.39.0"
@ -2654,74 +2429,6 @@ dependencies = [
 "bitflags",
 ]

-[[package]]
-name = "wit-bindgen-rust"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
-dependencies = [
- "anyhow",
- "heck",
- "indexmap",
- "prettyplease",
- "syn",
- "wasm-metadata",
- "wit-bindgen-core",
- "wit-component",
-]
-
-[[package]]
-name = "wit-bindgen-rust-macro"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
-dependencies = [
- "anyhow",
- "prettyplease",
- "proc-macro2",
- "quote",
- "syn",
- "wit-bindgen-core",
- "wit-bindgen-rust",
-]
-
-[[package]]
-name = "wit-component"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
-dependencies = [
- "anyhow",
- "bitflags",
- "indexmap",
- "log",
- "serde",
- "serde_derive",
- "serde_json",
- "wasm-encoder",
- "wasm-metadata",
- "wasmparser",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-parser"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
-dependencies = [
- "anyhow",
- "id-arena",
- "indexmap",
- "log",
- "semver",
- "serde",
- "serde_derive",
- "serde_json",
- "unicode-xid",
- "wasmparser",
-]
-
 [[package]]
 name = "writeable"
 version = "0.6.1"
--- a/Cargo.toml
+++ b/Cargo.toml
@ -6,18 +6,18 @@ members = [
  "sqlite",
  "postgres",
 ]
-rust-version = "1.88.0" # MSRV
+rust-version = "1.85.0" # MSRV

 [workspace.dependencies]
 async-trait = "0.1.88"
-uuid = { version = "^1.23.0", features = ["serde", "v4"] }
-actix-web = "^4.13.0"
+uuid = { version = "^1.19.0", features = ["serde", "v4"] }
+actix-web = "^4.11.0"
 anyhow = "1.0"
 thiserror = "2.0"
 futures = "^0.3.25"
 serde_json = "^1.0"
 serde = { version = "^1.0.147", features = ["derive"] }
-clap = { version = "^4.5.60", features = ["string", "env"] }
+clap = { version = "^4.5.6", features = ["string", "env"] }
 log = "^0.4.17"
 env_logger = "^0.11.7"
 rusqlite = { version = "0.37", features = ["bundled"] }
@ -26,10 +26,10 @@ actix-rt = "2"
 tempfile = "3"
 pretty_assertions = "1"
 temp-env = "0.3"
-tokio = { version = "1.52", features = ["rt", "macros"] }
+tokio = { version = "1.48", features = ["rt", "macros"] }
 tokio-postgres = { version = "0.7.13", features = ["with-uuid-1"] }
 bb8 = "0.9.0"
 bb8-postgres = { version = "0.9.0", features = ["with-uuid-1"] }
-openssl = { version = "0.10.80", default-features = false, features = ["vendored"] }
+openssl = { version = "0.10.73", default-features = false, features = ["vendored"] }
 native-tls = { version = "0.2.14", default-features = false, features = ["vendored"] }
 postgres-native-tls = "0.5.1"
--- a/3
+++ b/3
@ -1,7 +1,6 @@
 # Versions must be major.minor
 # Default versions are as below
-# RUST_VERSION should match the MSRV in Cargo.toml.
-ARG RUST_VERSION=1.88
+ARG RUST_VERSION=1.85
 ARG ALPINE_VERSION=3.20

 FROM docker.io/rust:${RUST_VERSION}-alpine${ALPINE_VERSION} AS builder
--- a/3
+++ b/3
@ -1,7 +1,6 @@
 # Versions must be major.minor
 # Default versions are as below
-# RUST_VERSION should match the MSRV in Cargo.toml.
-ARG RUST_VERSION=1.88
+ARG RUST_VERSION=1.85
 ARG ALPINE_VERSION=3.20

 FROM docker.io/rust:${RUST_VERSION}-alpine${ALPINE_VERSION} AS builder
--- a/README.md
+++ b/README.md
@ -76,7 +76,7 @@ SQLite:
 ```sh
 docker build \
  -t taskchampion-sync-server \
-  -f Dockerfile-sqlite .
+  -f Dockerfile-sqlite
 ```

 Postgres:
@ -84,7 +84,7 @@ Postgres:
 source .env
 docker build \
  -t taskchampion-sync-server-postgres \
-  -f Dockerfile-postgres .
+  -f Dockerfile-postgres
 ```

 Now to run it, simply exec.
--- a/docs/src/SUMMARY.md
+++ b/docs/src/SUMMARY.md
@ -2,10 +2,9 @@

 - [Introduction](./introduction.md)
 - [Usage](./usage.md)
-  - [Binaries](./usage/binaries.md)
-  - [Docker Images](./usage/docker-images.md)
  - [Docker Compose](./usage/docker-compose.md)
-  - [Helm](./usage/helm.md)
+  - [Docker Images](./usage/docker-images.md)
+  - [Binaries](./usage/binaries.md)
 - [Integration](./integration.md)
  - [Pre-built Images](./integration/pre-built.md)
  - [Rust Crates](./integration/crates.md)
--- a/docs/src/usage/helm.md
+++ b/docs/src/usage/helm.md
@ -1,131 +0,0 @@
-# Helm
-
-A Helm chart is available for deploying taskchampion-sync-server on Kubernetes.
-
-## Adding the Repository
-
-```sh
-helm repo add taskchampion https://gothenburgbitfactory.org/taskchampion-sync-server
-helm repo update
-```
-
-## Installing
-
-```sh
-# SQLite backend
-helm install taskchampion-sync-server taskchampion/taskchampion-sync-server \
-  --set sqlite.enabled=true
-
-# PostgreSQL backend
-helm install taskchampion-sync-server taskchampion/taskchampion-sync-server \
-  --set postgres.enabled=true \
-  --set postgres.host=my-postgres \
-  --set postgres.db=taskchampion \
-  --set postgres.username=myuser \
-  --set postgres.password=mypassword
-```
-
-## Storage Backends
-
-Exactly one storage backend must be enabled. The chart fails validation if
-neither or both are enabled.
-
-### SQLite
-
-Mounts a volume at `sqlite.dataDir` (default `/var/lib/taskchampion-sync-server/data`).
-The volume defaults to `emptyDir` but can be backed by a PVC or
-existing PersistentVolumeClaim:
-
-| Value | Description |
-|-------|-------------|
-| `sqlite.persistence.enabled` | Create a PVC (default: `false`) |
-| `sqlite.existingPV` | Use an existing PVC by name |
-| `sqlite.emptyDir` | emptyDir volume settings (default fallback) |
-
-### PostgreSQL
-
-Creates a Deployment with optional replicas, an auto-generated or existing
-secret for the connection string, and an init container that waits for
-PostgreSQL, applies the schema, and optionally seeds client IDs.
-
-**Secret handling** — When `postgres.existingSecret` is empty (default), the
-chart creates a secret named `{release-name}-connection` with a `conn` key.
-When set, the chart reads the named secret. It accepts either a `conn` key
-with a full [LibPQ-style URI](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING-URIS)
-or individual fields (`host`, `port`, `username`, `password`, `database`) that
-override the corresponding `postgres.*` values.
-
-**Init container** — Enabled by default. Waits for PG readiness, downloads
-the schema from `https://raw.githubusercontent.com/GothenburgBitFactory/taskchampion-sync-server/v0.7.0/postgres/schema.sql`,
-applies it, and seeds client IDs if `clientIdSecret` is set. Override the
-schema URL with `postgres.initContainer.schemaUrl`.
-
-**Replicas** — Replicas only apply with PostgreSQL:
-`replicas.enabled=true`, `replicas.count=N`. SQLite is always single-replica.
-
-## Secrets
-
-### Client ID Secret
-
-Optional. Restrict which client IDs the server accepts. Create a Secret with
-comma-separated UUIDs (base64-encoded) under a `client-ids` key:
-
-```yaml
-apiVersion: v1
-kind: Secret
-metadata:
-  name: my-client-ids
-type: Opaque
-data:
-  client-ids: <base64-encoded comma-separated UUIDs>
-```
-
-Reference it via `clientIdSecret: "my-client-ids"`. The value is available to
-the server as `CLIENT_ID` and to the init container as `CLIENT_IDS`.
-
-## Networking
-
-The chart does not implement TLS. Terminate TLS at the ingress or gateway and
-proxy HTTP to port 8080.
-
-### Ingress (NGINX)
-
-```yaml
-ingress:
-  enabled: true
-  hosts:
-    - taskchampion.example.com
-```
-
-### HTTPRoute (Kubernetes Gateway API)
-
-Use `parentRefs`, `hostnames`, and `rules`:
-
-```yaml
-httpRoute:
-  enabled: true
-  parentRefs:
-    - name: my-gateway
-  hostnames:
-    - tasks.example.com
-  rules:
-    - path:
-        type: PathPrefix
-        value: /
-      backendPort: 8080
-```
-
-The deprecated fields `httpRoute.gateway`, `httpRoute.host`,
-`httpRoute.path`, and `httpRoute.port` are used as a fallback when the
-structured arrays are empty.
-
-### ServiceAccount and RBAC
-
-When `serviceAccount.create` is `true` (default), the chart creates a
-ServiceAccount, a Role with `get`/`create`/`update`/`patch` on secrets, and
-a RoleBinding. Set `serviceAccount.name` to use an existing SA.
-
-## Reference
-
-See the chart's [values.yaml](https://github.com/GothenburgBitFactory/taskchampion-sync-server/blob/main/helm/taskchampion-sync-server/values.yaml)
-for all configurable options.
--- a/entrypoint-postgres.sh
+++ b/entrypoint-postgres.sh
@ -2,11 +2,14 @@
 set -e
 echo "starting entrypoint script..."
 if [ "$1" = "/bin/taskchampion-sync-server-postgres" ]; then
+    : ${PUID:-1092}
+    : ${PGID:-1092}
+
    : ${DATA_DIR:=/var/lib/taskchampion-sync-server/data}
    export DATA_DIR
    echo "setting up data directory ${DATA_DIR}"
    mkdir -p "${DATA_DIR}"
-    chown -R taskchampion:users "${DATA_DIR}"
+    chown -R "${PUID}:${PGID}" "${DATA_DIR}"
    chmod -R 700 "${DATA_DIR}"

    : ${LISTEN:=0.0.0.0:8080}
@ -20,10 +23,8 @@ if [ "$1" = "/bin/taskchampion-sync-server-postgres" ]; then
        unset CLIENT_ID
    fi

-    if [ "$(id -u)" = "0" ]; then
-        echo "Running server as user 'taskchampion'"
-        exec su-exec taskchampion "$@"
-    fi
+    echo "Running server as user ${PUID} (group ${PGID})"
+    exec su-exec "${PUID}":"${PGID}" "$@"
 else
    eval "${@}"
 fi
--- a/entrypoint-sqlite.sh
+++ b/entrypoint-sqlite.sh
@ -2,11 +2,14 @@
 set -e
 echo "starting entrypoint script..."
 if [ "$1" = "/bin/taskchampion-sync-server" ]; then
+    : ${PUID:-1092}
+    : ${PGID:-1092}
+
    : ${DATA_DIR:=/var/lib/taskchampion-sync-server/data}
    export DATA_DIR
    echo "setting up data directory ${DATA_DIR}"
    mkdir -p "${DATA_DIR}"
-    chown -R taskchampion:users "${DATA_DIR}"
+    chown -R ${PUID}:${PGID} "${DATA_DIR}"
    chmod -R 700 "${DATA_DIR}"

    : ${LISTEN:=0.0.0.0:8080}
@ -20,10 +23,8 @@ if [ "$1" = "/bin/taskchampion-sync-server" ]; then
        unset CLIENT_ID
    fi

-    if [ "$(id -u)" = "0" ]; then
-        echo "Running server as user 'taskchampion'"
-        exec su-exec taskchampion "$@"
-    fi
+    echo "Running server as user ${PUID} (group ${PGID})"
+    exec su-exec "${PUID}":"${PGID}" "$@"
 else
    eval "${@}"
 fi
--- a/helm/taskchampion-sync-server/.helmignore
+++ b/helm/taskchampion-sync-server/.helmignore
@ -1,5 +0,0 @@
-# Patterns to ignore when building the Helm chart
-.git
-examples/
-.DS_Store
-*.tgz
--- a/helm/taskchampion-sync-server/Chart.yaml
+++ b/helm/taskchampion-sync-server/Chart.yaml
@ -1,17 +0,0 @@
-apiVersion: v2
-name: taskchampion-sync-server
-description: A Helm chart for deploying TaskChampion Sync Server on Kubernetes
-type: application
-version: 0.2.1
-appVersion: "0.7.0"
-keywords:
-  - taskchampion
-  - taskwarrior
-  - sync
-  - task-management
-home: https://github.com/GothenburgBitFactory/taskchampion-sync-server
-sources:
-  - https://github.com/GothenburgBitFactory/taskchampion-sync-server
-maintainers: 
-  - name: Jansen Fuller
-    email: jansendfuller@mailfence.com
--- a/helm/taskchampion-sync-server/README.md
+++ b/helm/taskchampion-sync-server/README.md
@ -1,138 +0,0 @@
-# TaskChampion Sync Server Helm Chart
-
-Deploy the [TaskChampion Sync Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server) on Kubernetes.
-
-## Prerequisites
-
- Kubernetes 1.23+
- Helm 3+
-
-## Installing
-
-```console
-helm repo add taskchampion https://gothenburgbitfactory.org/taskchampion-sync-server
-helm repo update
-helm install my-release taskchampion/taskchampion-sync-server --set sqlite.enabled=true
-```
-
-## Storage Backends
-
-Exactly one storage backend must be enabled. The chart fails validation if neither or both are enabled.
-
-### SQLite
-
-| Parameter | Default | Description |
-|-----------|---------|-------------|
-| `sqlite.enabled` | `false` | Enable SQLite backend |
-| `sqlite.dataDir` | `/var/lib/taskchampion-sync-server/data` | Data directory path |
-| `sqlite.existingPV` | `""` | Use an existing PVC name |
-| `sqlite.persistence.enabled` | `false` | Create a PVC |
-| `sqlite.persistence.size` | `1Gi` | PVC size |
-| `sqlite.persistence.accessMode` | `ReadWriteOnce` | PVC access mode |
-| `sqlite.emptyDir` | — | emptyDir volume settings |
-
-### PostgreSQL
-
-| Parameter | Default | Description |
-|-----------|---------|-------------|
-| `postgres.enabled` | `false` | Enable PostgreSQL backend |
-| `postgres.host` | `""` | PostgreSQL host |
-| `postgres.port` | `5432` | PostgreSQL port |
-| `postgres.db` | `taskchampion` | Database name |
-| `postgres.username` | `""` | Database user |
-| `postgres.password` | `""` | Database password |
-| `postgres.sslMode` | `disable` | SSL mode |
-| `postgres.existingSecret` | `""` | Use existing secret by name |
-
-**Secret** — When `existingSecret` is empty (default), a secret named `{release-name}-connection` is created with a `conn` key. When set, the chart reads that secret. It accepts either a `conn` key with a full URI or individual keys (`host`, `port`, `username`, `password`, `database`) that override `postgres.*` values.
-
-**Init container** — Enabled by default. Waits for PG readiness, downloads and applies the schema (from the chart's `appVersion` URL), and seeds client IDs if `clientIdSecret` is set. Override with `postgres.initContainer.schemaUrl`.
-
-**Replicas** — Only apply with PostgreSQL (`replicas.enabled=true`, `replicas.count=N`). SQLite is single-replica.
-
-## Secrets
-
-### Client ID Secret
-
-Restrict which client IDs the server accepts. Create a Secret with comma-separated UUIDs (base64-encoded) under a `client-ids` key:
-
-```yaml
-apiVersion: v1
-kind: Secret
-metadata:
-  name: my-client-ids
-type: Opaque
-data:
-  client-ids: <base64-encoded comma-separated UUIDs>
-```
-
-Reference via `clientIdSecret: "my-client-ids"`.
-
-## Networking
-
-The chart does not implement TLS. Terminate TLS at the ingress or gateway.
-
-### Service
-
-| Parameter | Default | Description |
-|-----------|---------|-------------|
-| `service.type` | `ClusterIP` | Service type |
-| `service.port` | `8080` | Service port |
-| `service.targetPort` | `8080` | Container port |
-
-### Ingress (NGINX)
-
-| Parameter | Default | Description |
-|-----------|---------|-------------|
-| `ingress.enabled` | `false` | Enable NGINX ingress |
-| `ingress.className` | `""` | Ingress class name |
-| `ingress.annotations` | `{}` | Ingress annotations |
-| `ingress.hosts` | `[]` | Host list |
-| `ingress.tls` | `[]` | TLS configuration |
-
-### HTTPRoute (Kubernetes Gateway API)
-
-| Parameter | Default | Description |
-|-----------|---------|-------------|
-| `httpRoute.enabled` | `false` | Enable HTTPRoute |
-| `httpRoute.parentRefs` | `[]` | Parent gateway references (primary) |
-| `httpRoute.hostnames` | `[]` | Hostnames |
-| `httpRoute.rules` | `[]` | Routing rules |
-| `httpRoute.gateway` | `""` | (Deprecated) Single gateway name |
-| `httpRoute.host` | `""` | (Deprecated) Single hostname |
-| `httpRoute.path` | `"/"` | (Deprecated) Single path |
-| `httpRoute.port` | `8080` | (Deprecated) Single port |
-
-**Recommended** — use `parentRefs`, `hostnames`, `rules`. The deprecated
-single-value fields (`gateway`, `host`, `path`, `port`) are used as a fallback
-when the arrays are empty.
-
-## ServiceAccount and RBAC
-
-| Parameter | Default | Description |
-|-----------|---------|-------------|
-| `serviceAccount.create` | `true` | Create SA, Role, and RoleBinding |
-| `serviceAccount.name` | `""` | Use existing SA name |
-
-When created, the chart provisions a ServiceAccount, a Role with
-`get`/`create`/`update`/`patch` on secrets, and a RoleBinding.
-
-## Image Configuration
-
-| Parameter | Default | Description |
-|-----------|---------|-------------|
-| `image.repo` | `ghcr.io/gothenburgbitfactory/taskchampion-sync-server` | Image repository |
-| `image.tag` | `"0.7.0"` | Image tag |
-| `image.pullPolicy` | `IfNotPresent` | Pull policy |
-| `image.pullSecrets` | `[]` | Pull secrets |
-
-PostgreSQL appends `-postgres` to the image repo automatically.
-
-## Environment Variables
-
-Custom env vars are passed via `env`. `DATA_DIR` (SQLite) and `conn`
-(PostgreSQL) are set automatically and must not be set manually.
-
-## Full Configuration
-
-See [values.yaml](values.yaml).
--- a/helm/taskchampion-sync-server/examples/postgres-values.yaml
+++ b/helm/taskchampion-sync-server/examples/postgres-values.yaml
@ -1,33 +0,0 @@
-sqlite:
-  enabled: false
-
-postgres:
-  enabled: true
-  database: taskchampion
-  host: postgres-primary
-  username: taskchampion-user
-
-clientIdSecret: "taskchampion-client-ids"
-
-env:
-  - name: RUST_LOG
-    value: debug
-  - name: LISTEN
-    value: "0.0.0.0:8080"
-  - name: CREATE_CLIENTS
-    value: "false"
-
-replicas:
-  enabled: true
-  count: 3
-
-image:
-  pullSecrets:
-    - name: my-registry-secret
-
-httpRoute:
-  enabled: true
-  gateway: "my-gateway"
-  host: "taskchampion.example.com"
-  path: "/"
-  port: 8080
--- a/helm/taskchampion-sync-server/examples/sqlite-values.yaml
+++ b/helm/taskchampion-sync-server/examples/sqlite-values.yaml
@ -1,25 +0,0 @@
-sqlite:
-  enabled: true
-  existingPV: ""
-  emptyDir:
-    sizeLimit: 1Gi
-  persistence:
-    enabled: false
-
-postgres:
-  enabled: false
-
-clientIdSecret: "taskchampion-client-ids"
-
-env:
-  - name: RUST_LOG
-    value: info
-  - name: LISTEN
-    value: "0.0.0.0:8080"
-  - name: CREATE_CLIENTS
-    value: "false"
-
-ingress:
-  enabled: true
-  hosts:
-    - taskchampion.example.com
--- a/helm/taskchampion-sync-server/templates/NOTES.txt
+++ b/helm/taskchampion-sync-server/templates/NOTES.txt
@ -1,46 +0,0 @@
-Thank you for installing {{ .Chart.Name }} — version {{ .Chart.Version }} (app: {{ .Chart.AppVersion }}).
-
-## Storage Backend
-
-{{- if eq .Values.sqlite.enabled true }}
-**SQLite** — Data is stored at `{{ .Values.sqlite.dataDir }}`.
-{{- if .Values.sqlite.persistence.enabled }}
-  PersistentVolumeClaim: `{{ include "taskchampion-sync-server.fullname" . }}-pvc`
-{{- else if .Values.sqlite.existingPV }}
-  Using existing PVC: `{{ .Values.sqlite.existingPV }}`
-{{- else }}
-  Using an emptyDir volume (ephemeral — data is lost on pod restart).
-  Set `sqlite.persistence.enabled=true` for persistent storage.
-{{- end }}
-{{- end }}
-
-{{- if eq .Values.postgres.enabled true }}
-**PostgreSQL** — Connection URI stored in Secret `{{ include "taskchampion-sync-server.postgres-secret-name" . }}`.
-  Host: {{ .Values.postgres.host }}:{{ .Values.postgres.port }}
-  Database: {{ .Values.postgres.database }}
-{{- end }}
-
-## Verify the Deployment
-
-  kubectl get pods -l {{ include "taskchampion-sync-server.selectorLabels" . | replace ": " "=" | replace "\n" "," | trimSuffix "," }}
-
-## Check Pod Logs
-
-  kubectl logs -l {{ include "taskchampion-sync-server.selectorLabels" . | replace ": " "=" | replace "\n" "," | trimSuffix "," }}
-
-## Test the API
-
-  kubectl port-forward svc/{{ include "taskchampion-sync-server.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }}
-  curl http://localhost:{{ .Values.service.port }}/
-
-## View Connection Secret (PostgreSQL only)
-
-{{- if eq .Values.postgres.enabled true }}
-  kubectl get secret {{ include "taskchampion-sync-server.postgres-secret-name" . }} -o jsonpath="{.data.connection}" | base64 -d
-{{- end }}
-
-## Configuration
-
-For full configuration options, see:
-
-  https://github.com/GothenburgBitFactory/taskchampion-sync-server
--- a/helm/taskchampion-sync-server/templates/_helpers.tpl
+++ b/helm/taskchampion-sync-server/templates/_helpers.tpl
@ -1,100 +0,0 @@
-{{- /*
-taskchampion-sync-server helpers
-*/ -}}
-
-{{- define "taskchampion-sync-server.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- define "taskchampion-sync-server.fullname" -}}
-{{- if .Values.fullnameOverride }}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- $name := default .Chart.Name .Values.nameOverride }}
-{{- if contains $name .Release.Name }}
-{{- .Release.Name | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{- define "taskchampion-sync-server.labels" -}}
-helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-app.kubernetes.io/name: {{ include "taskchampion-sync-server.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/component: server
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{- define "taskchampion-sync-server.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "taskchampion-sync-server.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-
-{{- define "taskchampion-sync-server.postgres-connection" -}}
-  {{- $host := .Values.postgres.host -}}
-  {{- $port := .Values.postgres.port | toString -}}
-  {{- $username := .Values.postgres.username -}}
-  {{- $password := .Values.postgres.password -}}
-  {{- $database := .Values.postgres.database -}}
-
-  {{- /* Override individual fields from existingSecret where present */ -}}
-  {{- if .Values.postgres.existingSecret -}}
-    {{- $secret := lookup "v1" "Secret" .Release.Namespace .Values.postgres.existingSecret -}}
-    {{- if $secret -}}
-      {{- if index $secret.data "host" -}}
-        {{- $host = index $secret.data "host" | b64dec -}}
-      {{- end -}}
-      {{- if index $secret.data "port" -}}
-        {{- $port = index $secret.data "port" | b64dec -}}
-      {{- end -}}
-      {{- if index $secret.data "username" -}}
-        {{- $username = index $secret.data "username" | b64dec -}}
-      {{- end -}}
-      {{- if index $secret.data "password" -}}
-        {{- $password = index $secret.data "password" | b64dec -}}
-      {{- end -}}
-      {{- if index $secret.data "database" -}}
-        {{- $database = index $secret.data "database" | b64dec -}}
-      {{- end -}}
-    {{- end -}}
-  {{- end -}}
-
-  {{- /* Build URI */ -}}
-  {{- $uri := "postgresql://" -}}
-  {{- if ne $username "" -}}
-    {{- $uri = printf "%s%s" $uri $username -}}
-    {{- if ne $password "" -}}
-      {{- $uri = printf "%s:%s" $uri $password -}}
-    {{- end -}}
-    {{- $uri = printf "%s@" $uri -}}
-  {{- end -}}
-  {{- $uri = printf "%s%s" $uri $host -}}
-  {{- if ne $port "5432" -}}
-    {{- $uri = printf "%s:%s" $uri $port -}}
-  {{- end -}}
-  {{- $uri = printf "%s/%s" $uri $database -}}
-  {{- if .Values.postgres.sslMode -}}
-    {{- $uri = printf "%s?sslmode=%s" $uri .Values.postgres.sslMode -}}
-  {{- end -}}
-  {{- $uri -}}
-{{- end -}}
-
-{{- define "taskchampion-sync-server.schema-url" -}}
-{{- if .Values.postgres.initContainer.schemaUrl -}}
-{{- .Values.postgres.initContainer.schemaUrl -}}
-{{- else -}}
-{{- printf "https://raw.githubusercontent.com/GothenburgBitFactory/taskchampion-sync-server/v%s/postgres/schema.sql" .Chart.AppVersion -}}
-{{- end -}}
-{{- end -}}
-
-{{- define "taskchampion-sync-server.postgres-secret-name" -}}
-{{- printf "%s-connection" .Release.Name -}}
-{{- end -}}
-
-{{- define "taskchampion-sync-server.serviceAccountName" -}}
-{{- default (include "taskchampion-sync-server.fullname" .) .Values.serviceAccount.name -}}
-{{- end -}}
--- a/helm/taskchampion-sync-server/templates/deployment.yaml
+++ b/helm/taskchampion-sync-server/templates/deployment.yaml
@ -1,176 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "taskchampion-sync-server.fullname" . }}
-  labels:
-    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
-spec:
-  {{- if and (eq .Values.postgres.enabled true) .Values.replicas.enabled }}
-  replicas: {{ .Values.replicas.count }}
-  {{- else }}
-  replicas: 1
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "taskchampion-sync-server.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      labels:
-        {{- include "taskchampion-sync-server.selectorLabels" . | nindent 8 }}
-    spec:
-
-      {{- with .Values.image.pullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if .Values.serviceAccount.create }}
-      serviceAccountName: {{ include "taskchampion-sync-server.serviceAccountName" . }}
-      {{- end }}
-      securityContext:
-        {{- toYaml .Values.securityContext | nindent 8 }}
-      {{- if and .Values.postgres.enabled .Values.postgres.initContainer.enabled }}
-      initContainers:
-        - name: postgres-init
-          image: "{{ .Values.postgres.initContainer.image }}"
-          imagePullPolicy: {{ .Values.postgres.initContainer.imagePullPolicy }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            runAsNonRoot: true
-            runAsUser: 999
-          env:
-            - name: PGURI
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
-                  key: connection
-            - name: SCHEMA_URL
-              value: {{ include "taskchampion-sync-server.schema-url" . | quote }}
-            {{- if .Values.clientIdSecret }}
-            - name: CLIENT_IDS
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Values.clientIdSecret }}
-                  key: client-ids
-            {{- end }}
-          command:
-            - sh
-            - -c
-            - |
-              set -e
-              until pg_isready -d "$PGURI"; do
-                echo 'Waiting for PostgreSQL...'
-                sleep 2
-              done
-              echo "Downloading schema from ${SCHEMA_URL}..."
-              wget -qO /tmp/schema.sql "$SCHEMA_URL" || {
-                echo 'Failed to download schema - continuing with main container'
-                exit 0
-              }
-              psql "$PGURI" -f /tmp/schema.sql || {
-                echo 'Schema execution failed (SQL error) - continuing with main container'
-                exit 0
-              }
-              echo 'Schema executed successfully'
-              if [ -n "$CLIENT_IDS" ]; then
-                echo "Inserting client IDs..."
-                IFS=','
-                for client_id in $CLIENT_IDS; do
-                  client_id=$(echo "$client_id" | tr -d ' ')
-                  [ -z "$client_id" ] && continue
-                  psql "$PGURI" -c "INSERT INTO clients (client_id) VALUES ('$client_id') ON CONFLICT (client_id) DO NOTHING;" || {
-                    echo "Failed to insert client $client_id - continuing"
-                  }
-                done
-                unset IFS
-                echo "Client ID insertion complete"
-              fi
-      {{- end }}
-      containers:
-        - name: taskchampion-sync-server
-          {{- if eq .Values.postgres.enabled true }}
-          image: "{{ .Values.image.repository }}-postgres:{{ .Values.image.tag }}"
-          {{- else }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-          {{- end }}
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            runAsNonRoot: true
-            runAsUser: 1092
-            readOnlyRootFilesystem: true
-          {{- if eq .Values.postgres.enabled true }}
-          command:
-            - /bin/taskchampion-sync-server-postgres
-          {{- else }}
-          command:
-            - /bin/taskchampion-sync-server
-          {{- end }}
-          env:
-            {{- toYaml .Values.env | nindent 12 }}
-            {{- if .Values.clientIdSecret }}
-            - name: CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Values.clientIdSecret }}
-                  key: client-ids
-            {{- end }}
-            {{- if eq .Values.sqlite.enabled true }}
-            - name: DATA_DIR
-              value: {{ .Values.sqlite.dataDir }}
-            {{- end }}
-            {{- if eq .Values.postgres.enabled true }}
-            - name: CONNECTION
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
-                  key: connection
-            {{- end }}
-          ports:
-            - name: http
-              containerPort: {{ .Values.service.targetPort }}
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          {{- if eq .Values.postgres.enabled true }}
-          resources:
-            {{- toYaml .Values.postgres.resources | nindent 12 }}
-          {{- else }}
-          resources:
-            {{- toYaml .Values.sqlite.resources | nindent 12 }}
-          {{- end }}
-          {{- if eq .Values.sqlite.enabled true }}
-          volumeMounts:
-            - name: data
-              mountPath: {{ .Values.sqlite.dataDir }}
-          {{- end }}
-      {{- if eq .Values.sqlite.enabled true }}
-      volumes:
-        {{- if .Values.sqlite.existingPV }}
-        - name: data
-          persistentVolumeClaim:
-            claimName: {{ .Values.sqlite.existingPV }}
-        {{- else if .Values.sqlite.persistence.enabled }}
-        - name: data
-          persistentVolumeClaim:
-            claimName: {{ include "taskchampion-sync-server.fullname" . }}-pvc
-        {{- else }}
-        - name: data
-          emptyDir:
-            {{- if .Values.sqlite.emptyDir.sizeLimit }}
-            sizeLimit: {{ .Values.sqlite.emptyDir.sizeLimit }}
-            {{- end }}
-            {{- if .Values.sqlite.emptyDir.medium }}
-            medium: {{ .Values.sqlite.emptyDir.medium }}
-            {{- end }}
-        {{- end }}
-      {{- end }}
--- a/helm/taskchampion-sync-server/templates/httproute.yaml
+++ b/helm/taskchampion-sync-server/templates/httproute.yaml
@ -1,57 +0,0 @@
-{{- if .Values.httpRoute.enabled }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ include "taskchampion-sync-server.fullname" . }}
-  labels:
-    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
-  {{- with .Values.httpRoute.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  parentRefs:
-    {{- if .Values.httpRoute.parentRefs }}
-    {{- range .Values.httpRoute.parentRefs }}
-    - name: {{ .name }}
-      {{- if .namespace }}
-      namespace: {{ .namespace }}
-      {{- end }}
-      {{- if .sectionName }}
-      sectionName: {{ .sectionName }}
-      {{- end }}
-    {{- end }}
-    {{- else if .Values.httpRoute.gateway }}
-    - name: {{ .Values.httpRoute.gateway }}
-    {{- end }}
-  {{- $hostnames := .Values.httpRoute.hostnames }}
-  {{- if and (not $hostnames) .Values.httpRoute.host }}
-  {{- $hostnames = list .Values.httpRoute.host }}
-  {{- end }}
-  {{- if $hostnames }}
-  hostnames:
-    {{- range $hostnames }}
-    - {{ . | quote }}
-    {{- end }}
-  {{- end }}
-  rules:
-    {{- if .Values.httpRoute.rules }}
-    {{- range .Values.httpRoute.rules }}
-    - matches:
-        - path:
-            type: {{ .path.type | default "PathPrefix" }}
-            value: {{ .path.value | default "/" }}
-      backendRefs:
-        - name: {{ include "taskchampion-sync-server.fullname" $ }}
-          port: {{ .backendPort | default 8080 }}
-    {{- end }}
-    {{- else }}
-    - matches:
-        - path:
-            type: PathPrefix
-            value: {{ .Values.httpRoute.path | default "/" }}
-      backendRefs:
-        - name: {{ include "taskchampion-sync-server.fullname" . }}
-          port: {{ .Values.httpRoute.port | default 8080 }}
-    {{- end }}
-{{- end }}
--- a/helm/taskchampion-sync-server/templates/ingress.yaml
+++ b/helm/taskchampion-sync-server/templates/ingress.yaml
@ -1,58 +0,0 @@
-{{- if .Values.ingress.enabled }}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ include "taskchampion-sync-server.fullname" . }}
-  labels:
-    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
-  {{- with .Values.ingress.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  {{- if .Values.ingress.className }}
-  ingressClassName: {{ .Values.ingress.className }}
-  {{- end }}
-  {{- if .Values.ingress.tls }}
-  tls:
-    {{- toYaml .Values.ingress.tls | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- $svcName := include "taskchampion-sync-server.fullname" . -}}
-    {{- $svcPort := $.Values.service.port -}}
-    {{- range .Values.ingress.hosts }}
-    {{- if kindIs "string" . }}
-    - host: {{ . | quote }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: {{ $svcName }}
-                port:
-                  number: {{ $svcPort }}
-    {{- else }}
-    - host: {{ .host | quote }}
-      http:
-        paths:
-          {{- range .paths }}
-          - path: {{ .path | default "/" | quote }}
-            pathType: {{ .pathType | default "Prefix" }}
-            backend:
-              service:
-                name: {{ $svcName }}
-                port:
-                  number: {{ $svcPort }}
-          {{- else }}
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: {{ $svcName }}
-                port:
-                  number: {{ $svcPort }}
-          {{- end }}
-    {{- end }}
-    {{- end }}
-{{- end }}
--- a/helm/taskchampion-sync-server/templates/pvc.yaml
+++ b/helm/taskchampion-sync-server/templates/pvc.yaml
@ -1,17 +0,0 @@
-{{- if and (eq .Values.sqlite.enabled true) .Values.sqlite.persistence.enabled (not .Values.sqlite.existingPV) }}
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: {{ include "taskchampion-sync-server.fullname" . }}-pvc
-  labels:
-    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
-spec:
-  accessModes:
-    - {{ .Values.sqlite.persistence.accessMode }}
-  resources:
-    requests:
-      storage: {{ .Values.sqlite.persistence.size }}
-  {{- if .Values.sqlite.persistence.storageClass }}
-  storageClassName: {{ .Values.sqlite.persistence.storageClass }}
-  {{- end }}
-{{- end }}
--- a/helm/taskchampion-sync-server/templates/secrets/postgres-secret.yaml
+++ b/helm/taskchampion-sync-server/templates/secrets/postgres-secret.yaml
@ -1,11 +0,0 @@
-{{- if .Values.postgres.enabled }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "taskchampion-sync-server.postgres-secret-name" . }}
-  labels:
-    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
-type: Opaque
-data:
-  connection: {{ include "taskchampion-sync-server.postgres-connection" . | b64enc }}
-{{- end }}
--- a/helm/taskchampion-sync-server/templates/service.yaml
+++ b/helm/taskchampion-sync-server/templates/service.yaml
@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "taskchampion-sync-server.fullname" . }}
-  labels:
-    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
-spec:
-  type: {{ .Values.service.type }}
-  ports:
-    - port: {{ .Values.service.port }}
-      targetPort: {{ .Values.service.targetPort }}
-      protocol: TCP
-      name: http
-  selector:
-    {{- include "taskchampion-sync-server.selectorLabels" . | nindent 4 }}
--- a/helm/taskchampion-sync-server/templates/serviceaccount.yaml
+++ b/helm/taskchampion-sync-server/templates/serviceaccount.yaml
@ -1,9 +0,0 @@
-{{- if .Values.serviceAccount.create -}}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "taskchampion-sync-server.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
-{{- end }}
--- a/helm/taskchampion-sync-server/templates/validation-config.yaml
+++ b/helm/taskchampion-sync-server/templates/validation-config.yaml
@ -1,14 +0,0 @@
-{{- /* Validate imagePullSecrets entries are objects (not plain strings) */ -}}
-{{- range $i, $secret := .Values.image.pullSecrets -}}
-  {{- if not (kindIs "map" $secret) -}}
-    {{- fail (printf "ERROR: image.pullSecrets[%d] is a string (%q). Each entry must be an object with a 'name' key, e.g.\n  image:\n    pullSecrets:\n      - name: %s" $i $secret $secret) -}}
-  {{- end -}}
-{{- end -}}
-
-{{- if and (eq .Values.sqlite.enabled false) (eq .Values.postgres.enabled false) -}}
-{{- fail "ERROR: Exactly one storage backend must be enabled. Either sqlite.enabled or postgres.enabled must be true." -}}
-{{- end -}}
-
-{{- if and (eq .Values.sqlite.enabled true) (eq .Values.postgres.enabled true) -}}
-{{- fail "ERROR: Only one storage backend can be enabled. Both sqlite.enabled and postgres.enabled cannot be true at the same time." -}}
-{{- end -}}
--- a/helm/taskchampion-sync-server/values.yaml
+++ b/helm/taskchampion-sync-server/values.yaml
@ -1,169 +0,0 @@
-# Override the chart name used in resource names
-nameOverride: ""
-# Override the full resource name (takes precedence over nameOverride)
-fullnameOverride: ""
-
-# Image configuration
-image:
-  repository: ghcr.io/gothenburgbitfactory/taskchampion-sync-server
-  tag: "0.7.0"
-  pullPolicy: IfNotPresent
-  pullSecrets: []
-  # pullSecrets expects a list of objects with a "name" key:
-  # pullSecrets:
-  #   - name: my-registry-cred
-
-# Existing secret containing client IDs (comma-separated UUIDs)
-# Expected key: client-ids
-clientIdSecret: ""
-
-# Environment variables passed directly to the container
-# NOTE: DATA_DIR and CONNECTION are set automatically based on backend
-# To add secret/configMap references, use valueFrom:
-#   - name: MY_SECRET_VAR
-#     valueFrom:
-#       secretKeyRef:
-#         name: my-secret
-#         key: my-key
-env:
-  - name: RUST_LOG
-    value: info
-  - name: LISTEN
-    value: "0.0.0.0:8080"
-  - name: CREATE_CLIENTS
-    value: "true"
-
-# Service configuration
-service:
-  type: ClusterIP
-  port: 8080
-  targetPort: 8080
-
-# Ingress configuration
-# Each host can be a string (simple) or a map with path rules:
-#   hosts:
-#     - host: app.example.com
-#       paths:
-#         - path: /
-#           pathType: Prefix
-#         - path: /api
-#           pathType: Exact
-ingress:
-  enabled: false
-  className: ""
-  annotations: {}
-  hosts: []
-  tls: []
-
-# HTTPRoute configuration (Kubernetes Gateway API)
-httpRoute:
-  enabled: false
-  annotations: {}
-
-  # List of parent gateway references.
-  # name is required; namespace and sectionName are optional.
-  parentRefs: []
-  # parentRefs:
-  #   - name: my-gateway
-  #     namespace: gateway-system  # optional — cross-namespace gateway reference
-  #     sectionName: https         # optional — targets a specific listener on the gateway
-
-  # List of hostnames the route applies to.
-  hostnames: []
-  # hostnames:
-  #   - tasks.example.com
-  #   - tasks.internal.example.com
-
-  # List of routing rules. Each rule matches a path and forwards to this chart's Service.
-  # When empty, falls back to the deprecated path/port fields below.
-  rules: []
-  # rules:
-  #   - path:
-  #       type: PathPrefix   # PathPrefix or Exact
-  #       value: /
-  #     backendPort: 8080
-
-  # Deprecated: use parentRefs instead
-  gateway: ""
-  # Deprecated: use hostnames instead
-  host: ""
-  # Deprecated: use rules instead
-  path: "/"
-  port: 8080
-
-# Replica configuration (only applies when postgres is enabled)
-replicas:
-  enabled: false
-  count: 1
-
-# ServiceAccount configuration
-# The app does not access the Kubernetes API, so no RBAC permissions are needed.
-# A dedicated ServiceAccount is created to give the pod a stable identity
-# for network policies, pod security, or future RBAC.
-serviceAccount:
-  # create specifies whether a ServiceAccount should be created
-  create: true
-  # name sets the ServiceAccount name
-  name: taskchampion-sync-server
-
-# Security context for the pod
-# NOTE: runAsUser and runAsGroup are intentionally unset.
-# The Docker entrypoint requires root to chown the data directory and then
-# drops privileges via su-exec to the taskchampion user (uid 1092).
-securityContext:
-  fsGroup: 100
-
-# SQLite backend configuration (mutually exclusive with postgres)
-sqlite:
-  enabled: false
-  dataDir: /var/lib/taskchampion-sync-server/data
-  # Resource limits and requests
-  resources:
-    limits:
-      memory: 25Mi
-      cpu: 100m
-    requests:
-      # 5Mi is sufficient for the SQLite image
-      memory: 5Mi
-      cpu: 10m
-  existingPV: ""
-  emptyDir:
-    sizeLimit: ""
-    medium: ""
-  persistence:
-    enabled: true
-    size: 1Gi
-    accessMode: ReadWriteOnce
-    storageClass: ""
-    existingClaim: ""
-
-# PostgreSQL configuration
-postgres:
-  enabled: false
-  existingSecret: ""  # If empty, auto-create secret; if provided, use existing
-  # Individual connection components for building connection string
-  database: taskchampion
-  host: postgres
-  port: 5432
-  username: user
-  password: ""
-  # SSL mode for the PostgreSQL connection.
-  # Use 'disable' for internal cluster connections (no TLS).
-  # Options: disable, allow, prefer, require, verify-ca, verify-full
-  sslMode: disable
-  initContainer:
-    enabled: true
-    image: postgres:17-alpine
-    imagePullPolicy: IfNotPresent
-    # Override the schema URL. Defaults to the official schema for this chart's appVersion.
-    # e.g. https://raw.githubusercontent.com/GothenburgBitFactory/taskchampion-sync-server/v0.7.0/postgres/schema.sql
-    schemaUrl: ""
-  # Resource limits and requests
-  resources:
-    limits:
-      memory: 100Mi
-      cpu: 100m
-    requests:
-      # 20Mi is the minimum for the Postgres image
-      memory: 20Mi
-      cpu: 10m
Author	SHA1	Message	Date
bp99	90a73ea7bd	add gitea docker publish workflow	2026-01-02 14:54:11 +01:00
bp99	a08cda96ce	allow running with custom PUID and PGID	2026-01-02 14:42:07 +01:00