From 4a7058fd1ed47ffe2a856b61687130316069869b Mon Sep 17 00:00:00 2001
From: pieced-ci <ci@pieced.ch>
Date: Sat, 16 May 2026 21:40:40 +0000
Subject: [PATCH] Sync chart from pieced-threema-gateway 0.1.3

---
 deploy/helm/pieced-threema-gateway/Chart.yaml             | 4 ++--
 .../helm/pieced-threema-gateway/templates/deployment.yaml | 4 ++++
 deploy/helm/pieced-threema-gateway/values.yaml            | 8 +++++++-
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/deploy/helm/pieced-threema-gateway/Chart.yaml b/deploy/helm/pieced-threema-gateway/Chart.yaml
index 4e7034c..694602b 100644
--- a/deploy/helm/pieced-threema-gateway/Chart.yaml
+++ b/deploy/helm/pieced-threema-gateway/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: pieced-threema-gateway
 description: PieCed IT central Threema Gateway relay
 type: application
-version: 0.1.2
-appVersion: "0.1.2"
+version: 0.1.3
+appVersion: "0.1.3"
diff --git a/deploy/helm/pieced-threema-gateway/templates/deployment.yaml b/deploy/helm/pieced-threema-gateway/templates/deployment.yaml
index bbf044c..88cb386 100644
--- a/deploy/helm/pieced-threema-gateway/templates/deployment.yaml
+++ b/deploy/helm/pieced-threema-gateway/templates/deployment.yaml
@@ -17,6 +17,10 @@ spec:
         app.kubernetes.io/name: pieced-threema-gateway
     spec:
       serviceAccountName: pieced-threema-gateway
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: relay
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
diff --git a/deploy/helm/pieced-threema-gateway/values.yaml b/deploy/helm/pieced-threema-gateway/values.yaml
index 892554e..86f7e89 100644
--- a/deploy/helm/pieced-threema-gateway/values.yaml
+++ b/deploy/helm/pieced-threema-gateway/values.yaml
@@ -6,9 +6,15 @@ namespace: threema-gateway
 
 image:
   repository: registry.c5ai.ch/pieced/pieced-threema-gateway
-  tag: "0.1.2"
+  tag: "0.1.3"
   pullPolicy: IfNotPresent
 
+# Pull from registry.c5ai.ch — matches operator + portal pattern.
+# The Secret must already exist in the namespace (one-shot copy from
+# pieced-system on initial bootstrap; see README).
+imagePullSecrets:
+  - name: registry-creds
+
 replicas: 1
 
 service: