Harden pod and container security contexts across all workloads

Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem,
capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads
that lacked it: apache-tika, cyberchef, gotenberg, homeassistant,
matrix-delegation-nginx, paperless-server, paperless-consume cronjob
(plus automountServiceAccountToken false), patchmon-frontend,
urlaubsverwaltung and zipline. All contexts are configurable via
securityContext.pod / securityContext.container in values.yaml; writable
paths are provided as emptyDirs. Image-forced deviations (Home Assistant
root start for s6-overlay + NET_RAW for discovery, paperless root init
container for /run ownership) are documented in the charts' values.yaml.
Major version bump for every changed published chart.

matrix-synapse/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: matrix-synapse
 description: A Helm chart to deploy a Matrix Synapse server on Kubernetes
 type: application
-version: 2.0.0+upv1.149.1
+version: 3.0.0+upv1.149.1
 appVersion: "v1.149.1"
 maintainers:
   - name: jklein

matrix-synapse/templates/matrix-delegation-nginx.configmap.yaml

@@ -6,15 +6,25 @@ metadata:
 data:
   nginx.conf: |
     worker_processes 1;
-  
+    # The container runs as the unprivileged nginx user with a read-only root
+    # filesystem: pid file and temp paths live in the /tmp emptyDir, and the
+    # listen port is unprivileged (8080).
+    pid /tmp/nginx.pid;
+
     events {
       worker_connections 1024;
     }
-    
+
     http {
+      client_body_temp_path /tmp/client_temp;
+      proxy_temp_path /tmp/proxy_temp;
+      fastcgi_temp_path /tmp/fastcgi_temp;
+      uwsgi_temp_path /tmp/uwsgi_temp;
+      scgi_temp_path /tmp/scgi_temp;
+
       server {
-        listen 80;
-        
+        listen 8080;
+
         location /.well-known/matrix/server {
           return 200 '{"m.server": "{{ .Values.ingress.domain }}:443"}';
           add_header Content-Type application/json;

matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml

@@ -16,16 +16,25 @@ spec:
         app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
     spec:
       automountServiceAccountToken: false
+      securityContext:
+        {{- toYaml .Values.matrix.delegation.securityContext.pod | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx
           image: "nginx:1.28.3"
+          securityContext:
+            {{- toYaml .Values.matrix.delegation.securityContext.container | nindent 12 }}
           ports:
-            - containerPort: 80
+            - containerPort: 8080
               name: http
           volumeMounts:
             - name: nginx-config
               mountPath: /etc/nginx/nginx.conf
               subPath: nginx.conf
+            # The mounted nginx.conf points the pid file and all temp paths to
+            # /tmp, so a single writable emptyDir suffices with a read-only
+            # root filesystem.
+            - name: tmp
+              mountPath: /tmp
           resources:
             limits:
               memory: "{{ .Values.matrix.delegation.resources.limits.memory }}"
@@ -61,6 +70,8 @@ spec:
             timeoutSeconds: 3
             failureThreshold: 30
       volumes:
+        - name: tmp
+          emptyDir: {}
         - name: nginx-config
           configMap:
             name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-config

matrix-synapse/values.yaml

@@ -5,6 +5,21 @@ matrix:
   delegation:
     enabled: false
     serverUrl: null
+    # The delegation nginx runs as the image's unprivileged nginx user
+    # (uid 101) and listens on the unprivileged port 8080; pid file and temp
+    # paths are redirected to the /tmp emptyDir by the mounted nginx.conf.
+    securityContext:
+      pod:
+        runAsNonRoot: true
+        runAsUser: 101
+        runAsGroup: 101
+      container:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        capabilities:
+          drop:
+            - ALL
     resources:
       limits:
         memory: "128Mi"