Harden pod and container security contexts across all workloads

Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem,
capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads
that lacked it: apache-tika, cyberchef, gotenberg, homeassistant,
matrix-delegation-nginx, paperless-server, paperless-consume cronjob
(plus automountServiceAccountToken false), patchmon-frontend,
urlaubsverwaltung and zipline. All contexts are configurable via
securityContext.pod / securityContext.container in values.yaml; writable
paths are provided as emptyDirs. Image-forced deviations (Home Assistant
root start for s6-overlay + NET_RAW for discovery, paperless root init
container for /run ownership) are documented in the charts' values.yaml.
Major version bump for every changed published chart.

zipline/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.0.0+up4.6.4
+version: 3.0.0+up4.6.4
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

zipline/templates/zipline.sfs.yaml

@@ -13,9 +13,13 @@ spec:
       labels:
         app: "{{ .Release.Name }}-{{ .Chart.Name }}-sfs"
     spec:
+      securityContext:
+        {{- toYaml .Values.zipline.securityContext.pod | nindent 8 }}
       containers:
         - name: "{{ .Release.Name }}-{{ .Chart.Name }}-sfs"
           image: "ghcr.io/diced/zipline:{{ .Chart.AppVersion }}"
+          securityContext:
+            {{- toYaml .Values.zipline.securityContext.container | nindent 12 }}
           env:
             - name: DATABASE_URL
               valueFrom:
@@ -60,8 +64,14 @@ spec:
             - name: zipline-volume
               mountPath: /zipline/themes
               subPath: themes/
+            # Zipline writes temporary chunks/files below /tmp; with a
+            # read-only root filesystem this must be a writable emptyDir.
+            - name: tmp
+              mountPath: /tmp
       automountServiceAccountToken: false
       volumes:
+        - name: tmp
+          emptyDir: {}
         - name: zipline-volume
           persistentVolumeClaim:
             claimName: {{ .Release.Name }}-{{ .Chart.Name }}-vc

zipline/values.yaml

@@ -7,6 +7,22 @@ config:
   domain: null
   maxUploadFileSize: 30m
 zipline:
+  # The upstream image ships no dedicated user, but the Node.js server runs
+  # fine as an arbitrary non-root uid; fsGroup makes the uploads PVC writable.
+  securityContext:
+    pod:
+      runAsNonRoot: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      fsGroup: 1000
+      fsGroupChangePolicy: Always
+    container:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      capabilities:
+        drop:
+          - ALL
   # Zipline v4 exposes /api/healthcheck (checks server and database health);
   # the endpoint is enabled by default (config.features.healthcheck). Since it
   # includes the database, it is used for readiness/startup only; liveness