jklein
b5eba4cbf1
Add securityContext hardening (runAsNonRoot, readOnlyRootFilesystem, capabilities drop ALL, allowPrivilegeEscalation false) to the 10 workloads that lacked it: apache-tika, cyberchef, gotenberg, homeassistant, matrix-delegation-nginx, paperless-server, paperless-consume cronjob (plus automountServiceAccountToken false), patchmon-frontend, urlaubsverwaltung and zipline. All contexts are configurable via securityContext.pod / securityContext.container in values.yaml; writable paths are provided as emptyDirs. Image-forced deviations (Home Assistant root start for s6-overlay + NET_RAW for discovery, paperless root init container for /run ownership) are documented in the charts' values.yaml. Major version bump for every changed published chart.
40 lines
1.2 KiB
YAML
40 lines
1.2 KiB
YAML
{{- if .Values.matrix.delegation.enabled }}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-config
|
|
data:
|
|
nginx.conf: |
|
|
worker_processes 1;
|
|
# The container runs as the unprivileged nginx user with a read-only root
|
|
# filesystem: pid file and temp paths live in the /tmp emptyDir, and the
|
|
# listen port is unprivileged (8080).
|
|
pid /tmp/nginx.pid;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
http {
|
|
client_body_temp_path /tmp/client_temp;
|
|
proxy_temp_path /tmp/proxy_temp;
|
|
fastcgi_temp_path /tmp/fastcgi_temp;
|
|
uwsgi_temp_path /tmp/uwsgi_temp;
|
|
scgi_temp_path /tmp/scgi_temp;
|
|
|
|
server {
|
|
listen 8080;
|
|
|
|
location /.well-known/matrix/server {
|
|
return 200 '{"m.server": "{{ .Values.ingress.domain }}:443"}';
|
|
add_header Content-Type application/json;
|
|
}
|
|
|
|
location /.well-known/matrix/client {
|
|
return 200 '{"m.homeserver": {"base_url": "https://{{ .Values.ingress.domain }}"}}';
|
|
add_header Content-Type application/json;
|
|
add_header "Access-Control-Allow-Origin" *;
|
|
}
|
|
}
|
|
}
|
|
{{- end }} |