cyberchef:
  # The upstream image is stock nginx (root, listening on port 80). To still
  # run fully non-root, the pod runs as the image's nginx user (uid 101) and
  # the safe sysctl net.ipv4.ip_unprivileged_port_start=80 lets the unprivileged
  # nginx bind port 80 without NET_BIND_SERVICE.
  securityContext:
    pod:
      runAsNonRoot: true
      runAsUser: 101
      runAsGroup: 101
      sysctls:
        - name: net.ipv4.ip_unprivileged_port_start
          value: "80"
    container:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      capabilities:
        drop:
          - ALL
  livenessProbe:
    httpGet:
      path: /
      port: http
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  readinessProbe:
    httpGet:
      path: /
      port: http
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
  # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
  startupProbe:
    httpGet:
      path: /
      port: http
    periodSeconds: 5
    timeoutSeconds: 5
    failureThreshold: 30
  resources:
    # Limits are optional: memory and ephemeral-storage limits default to
    # limitFactor x the request, an explicitly set limit always wins, and a
    # CPU limit is only set when configured explicitly under "limits".
    limitFactor: 3
    requests:
      cpu: 0.1
      memory: 512Mi
      ephemeralStorage: 10Mi

ingress:
  enabled: true
  clusterIssuer: letsencrypt
  domain: null