jklein
0021becba2
- Values-driven securityContext for the Synapse pod/container with hardened defaults: runAsNonRoot as uid/gid 1000 (matching the image's previous gosu drop target), readOnlyRootFilesystem, allowPrivilegeEscalation false, all capabilities dropped; /tmp mounted as emptyDir. The now-ineffective UID/GID env vars are removed (the securityContext controls the user). - Naming scheme: delegation Deployment renamed to ...-delegation-nginx-deployment, ConfigMap to ...-delegation-nginx-configmap (references and service selector updated). - matrix.configSecretRef moved to secrets.configSecretRef (repo standard). - Probes for Synapse and the delegation nginx are values-configurable; defaults are the previous hardcoded settings. - Flexible ingress standard: ingress.className (default nginx) and ingress.annotations merged with the cert-manager annotation. - Additive matrix.env block rendered through tpl (value/secretKeyRef/ configMapKeyRef forms). - CI fixtures: secret ref moved, seed job image synced to appVersion. - Chart 4.2.1+upv1.159.0 -> 5.0.0+upv1.159.0 (major; app version unchanged).
40 lines
1.2 KiB
YAML
40 lines
1.2 KiB
YAML
{{- if .Values.matrix.delegation.enabled }}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-configmap
|
|
data:
|
|
nginx.conf: |
|
|
worker_processes 1;
|
|
# The container runs as the unprivileged nginx user with a read-only root
|
|
# filesystem: pid file and temp paths live in the /tmp emptyDir, and the
|
|
# listen port is unprivileged (8080).
|
|
pid /tmp/nginx.pid;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
http {
|
|
client_body_temp_path /tmp/client_temp;
|
|
proxy_temp_path /tmp/proxy_temp;
|
|
fastcgi_temp_path /tmp/fastcgi_temp;
|
|
uwsgi_temp_path /tmp/uwsgi_temp;
|
|
scgi_temp_path /tmp/scgi_temp;
|
|
|
|
server {
|
|
listen 8080;
|
|
|
|
location /.well-known/matrix/server {
|
|
return 200 '{"m.server": "{{ .Values.ingress.domain }}:443"}';
|
|
add_header Content-Type application/json;
|
|
}
|
|
|
|
location /.well-known/matrix/client {
|
|
return 200 '{"m.homeserver": {"base_url": "https://{{ .Values.ingress.domain }}"}}';
|
|
add_header Content-Type application/json;
|
|
add_header "Access-Control-Allow-Origin" *;
|
|
}
|
|
}
|
|
}
|
|
{{- end }} |