Matrix-Synapse chart: security hardening, naming scheme, configurable probes

- Values-driven securityContext for the Synapse pod/container with hardened
  defaults: runAsNonRoot as uid/gid 1000 (matching the image's previous gosu
  drop target), readOnlyRootFilesystem, allowPrivilegeEscalation false, all
  capabilities dropped; /tmp mounted as emptyDir. The now-ineffective UID/GID
  env vars are removed (the securityContext controls the user).
- Naming scheme: delegation Deployment renamed to ...-delegation-nginx-deployment,
  ConfigMap to ...-delegation-nginx-configmap (references and service selector
  updated).
- matrix.configSecretRef moved to secrets.configSecretRef (repo standard).
- Probes for Synapse and the delegation nginx are values-configurable;
  defaults are the previous hardcoded settings.
- Flexible ingress standard: ingress.className (default nginx) and
  ingress.annotations merged with the cert-manager annotation.
- Additive matrix.env block rendered through tpl (value/secretKeyRef/
  configMapKeyRef forms).
- CI fixtures: secret ref moved, seed job image synced to appVersion.
- Chart 4.2.1+upv1.159.0 -> 5.0.0+upv1.159.0 (major; app version unchanged).

matrix-synapse/templates/matrix-synapse.sfs.yaml

@@ -18,52 +18,49 @@ spec:
     spec:
       automountServiceAccountToken: false
       securityContext:
-        fsGroup: 1000
-        fsGroupChangePolicy: Always
+        {{- toYaml .Values.matrix.securityContext.pod | nindent 8 }}
       containers:
         - name: "{{ .Release.Name }}-{{ .Chart.Name }}-container"
           image: "ghcr.io/element-hq/synapse:{{ .Chart.AppVersion }}"
+          securityContext:
+            {{- toYaml .Values.matrix.securityContext.container | nindent 12 }}
           env:
             - name: SYNAPSE_SERVER_NAME
               value: "{{ required "You must provide a Server-Name" .Values.matrix.serverName }}"
             - name: SYNAPSE_REPORT_STATS
               value: "no"
-            - name: UID
-              value: "1000"
-            - name: GID
-              value: "1000"
             - name: TZ
               value: "{{ .Values.matrix.timezone }}"
+            {{- range $value := .Values.matrix.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name }}
+              value: {{ tpl $value.value $ }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
           ports:
             - name: http
               containerPort: 8008
               protocol: TCP
           readinessProbe:
-            httpGet:
-              path: /health
-              port: http
-              scheme: HTTP
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
+            {{- toYaml .Values.matrix.readinessProbe | nindent 12 }}
           livenessProbe:
-            httpGet:
-              path: /health
-              port: http
-              scheme: HTTP
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          # The startup probe gates liveness/readiness. Synapse can take a
-          # while to start (migrations, cache warmup): budget 10s * 30 = 300s.
+            {{- toYaml .Values.matrix.livenessProbe | nindent 12 }}
           startupProbe:
-            httpGet:
-              path: /health
-              port: http
-              scheme: HTTP
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 30
+            {{- toYaml .Values.matrix.startupProbe | nindent 12 }}
           resources:
             {{- include "matrix-synapse.resources" .Values.matrix.resources | nindent 12 }}
           volumeMounts:
@@ -76,7 +73,13 @@ spec:
             - name: matrix-synapse-config-secret
               mountPath: /data/homeserver.yaml
               subPath: homeserver.yaml
+            # Scratch space so the read-only root filesystem never blocks
+            # temp-file writes (e.g. URL-preview downloads).
+            - name: tmp
+              mountPath: /tmp
       volumes:
+        - name: tmp
+          emptyDir: {}
         - name: matrix-synapse-volume
           persistentVolumeClaim:
             claimName: {{ .Release.Name }}-{{ .Chart.Name }}-pvc