commit 3a0ec2d620eac7c5e893198387d73313a1782e71
parent c63e8235cd0485eafd471a070b1098036d56ac8a
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Wed, 18 Feb 2026 21:06:29 +0100
harden further deployments
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
8 files changed, 163 insertions(+), 6 deletions(-)
diff --git a/apps/talos_cluster/blog/mysql.yaml b/apps/talos_cluster/blog/mysql.yaml
@@ -14,9 +14,23 @@ spec:
labels:
app: mysql
spec:
+ automountServiceAccountToken: false
+ securityContext:
+ fsGroup: 999
containers:
- name: mysql
image: mariadb:12.0
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: false
+ runAsNonRoot: true
+ runAsUser: 999
+ runAsGroup: 999
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
env:
- name: MARIADB_ROOT_PASSWORD
valueFrom:
diff --git a/apps/talos_cluster/blog/wordpress.yaml b/apps/talos_cluster/blog/wordpress.yaml
@@ -26,11 +26,23 @@ spec:
labels:
app: wordpress
spec:
+ automountServiceAccountToken: false
securityContext:
fsGroup: 33
containers:
- name: wordpress
image: ghcr.io/mtrnord/blog:latest
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: false
+ runAsNonRoot: true
+ runAsUser: 33
+ runAsGroup: 33
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
env:
- name: DB_HOST
value: mysql-service.blog.svc.cluster.local
diff --git a/apps/talos_cluster/cgit/deployment.yaml b/apps/talos_cluster/cgit/deployment.yaml
@@ -33,6 +33,9 @@ spec:
app: cgit
app.kubernetes.io/name: cgit
spec:
+ automountServiceAccountToken: false
+ securityContext:
+ fsGroup: 1000
containers:
- name: anubis
image: ghcr.io/techarohq/anubis:latest
@@ -73,6 +76,7 @@ spec:
runAsGroup: 1000
runAsNonRoot: true
allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
@@ -81,8 +85,21 @@ spec:
- name: cgit
image: ghcr.io/mtrnord/cgit-docker:main
imagePullPolicy: Always
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+ runAsGroup: 1000
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
resources:
- limits: {}
+ limits:
+ cpu: "500m"
+ memory: "512Mi"
requests:
memory: "344Mi"
cpu: "252m"
diff --git a/apps/talos_cluster/continuwuity/deployment.yaml b/apps/talos_cluster/continuwuity/deployment.yaml
@@ -14,11 +14,27 @@ spec:
labels:
app: continuwuity
spec:
+ automountServiceAccountToken: false
enableServiceLinks: false
+ securityContext:
+ fsGroup: 1000
containers:
- name: continuwuity
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+ runAsGroup: 1000
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
resources:
- limits: {}
+ limits:
+ cpu: "2000m"
+ memory: "2Gi"
requests:
memory: "100Mi"
cpu: "28m"
@@ -34,6 +50,8 @@ spec:
readOnly: true
- name: continuwuity-data
mountPath: /var/lib/continuwuity
+ - name: tmp
+ mountPath: /tmp
env:
- name: CONTINUWUITY_CONFIG
value: /etc/conduwuit/conduwuit.toml
@@ -57,6 +75,8 @@ spec:
- name: continuwuity-data
persistentVolumeClaim:
claimName: continuwuity
+ - name: tmp
+ emptyDir: {}
---
apiVersion: v1
kind: Service
diff --git a/apps/talos_cluster/convex/deployment.yaml b/apps/talos_cluster/convex/deployment.yaml
@@ -17,6 +17,9 @@ spec:
labels:
app: convex
spec:
+ automountServiceAccountToken: false
+ securityContext:
+ fsGroup: 1000
containers:
- name: backend
image: ghcr.io/mtrnord/git-convex:latest
@@ -78,8 +81,21 @@ spec:
# value: ""
# - name: "S3_STORAGE_SNAPSHOT_IMPORTS_BUCKET"
# value: ""
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+ runAsGroup: 1000
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
resources:
- limits: {}
+ limits:
+ cpu: "2000m"
+ memory: "1Gi"
requests:
memory: "344Mi"
cpu: "252m"
@@ -112,13 +128,26 @@ spec:
scheme: HTTP
- name: dashboard
image: ghcr.io/get-convex/convex-dashboard:latest
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+ runAsGroup: 1000
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
env:
- name: "NEXT_PUBLIC_DEPLOYMENT_URL"
value: "https://api.convex.mtrnord.blog"
- name: "NEXT_PUBLIC_LOAD_MONACO_INTERNALLY"
value: "true"
resources:
- limits: {}
+ limits:
+ cpu: "500m"
+ memory: "512Mi"
requests:
memory: "344Mi"
cpu: "252m"
diff --git a/apps/talos_cluster/freshrss/deployment.yaml b/apps/talos_cluster/freshrss/deployment.yaml
@@ -17,9 +17,23 @@ spec:
labels:
app: freshrss
spec:
+ automountServiceAccountToken: false
+ securityContext:
+ fsGroup: 33
containers:
- name: freshrss
image: freshrss/freshrss:1.28.1
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: false
+ runAsNonRoot: true
+ runAsUser: 33
+ runAsGroup: 33
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
env:
- name: TZ
value: "Europe/Berlin"
@@ -30,7 +44,9 @@ spec:
- name: LISTEN
value: "0.0.0.0:8080"
resources:
- limits: {}
+ limits:
+ cpu: "500m"
+ memory: "512Mi"
requests:
memory: "344Mi"
cpu: "252m"
@@ -43,6 +59,10 @@ spec:
mountPath: "/var/www/FreshRSS/data"
- mountPath: /tmp
name: tmp
+ - mountPath: /var/run
+ name: var-run
+ - mountPath: /var/log
+ name: var-log
livenessProbe:
httpGet:
path: /
@@ -61,6 +81,10 @@ spec:
- name: tmp
emptyDir:
sizeLimit: 2048Mi
+ - name: var-run
+ emptyDir: {}
+ - name: var-log
+ emptyDir: {}
- name: data
persistentVolumeClaim:
claimName: freshrss-data
diff --git a/apps/talos_cluster/miro-neoboard-exporter/release.yaml b/apps/talos_cluster/miro-neoboard-exporter/release.yaml
@@ -44,10 +44,31 @@ spec:
labels:
app: miro-neoboard-exporter
spec:
+ automountServiceAccountToken: false
+ securityContext:
+ fsGroup: 1000
containers:
- name: miro-neoboard-exporter
image: ghcr.io/mtrnord/neoboard-exporter:latest
imagePullPolicy: Always
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+ runAsGroup: 1000
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
+ resources:
+ limits:
+ cpu: "200m"
+ memory: "256Mi"
+ requests:
+ cpu: "50m"
+ memory: "64Mi"
ports:
- containerPort: 3000
envFrom:
@@ -57,6 +78,8 @@ spec:
- name: env-file
mountPath: /app/.env
subPath: .env
+ - name: tmp
+ mountPath: /tmp
livenessProbe:
httpGet:
path: /
@@ -76,6 +99,8 @@ spec:
successThreshold: 1
failureThreshold: 3
volumes:
+ - name: tmp
+ emptyDir: {}
- name: env-file
secret:
secretName: ENC[AES256_GCM,data:oin2nzHOttpqP0vrx7wBz2yxwdfF9z8cZTVky9I=,iv:IEfzn9Ht9ItEd69xSn+DDZri08VakSlH685lgrfWgSo=,tag:dpL4cc/qOiK7K8z4R8MplQ==,type:str]
diff --git a/apps/talos_cluster/persephone/deployment.yaml b/apps/talos_cluster/persephone/deployment.yaml
@@ -17,16 +17,32 @@ spec:
labels:
app: persephone
spec:
+ automountServiceAccountToken: false
+ securityContext:
+ fsGroup: 1000
containers:
- name: persephone
image: ghcr.io/mtrnord/persephone:main
imagePullPolicy: Always
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+ runAsGroup: 1000
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
env:
# Base path for the configuration file
- name: PERSEPHONE_CONFIG
value: /data/config.yaml
resources:
- limits: {}
+ limits:
+ cpu: "1000m"
+ memory: "512Mi"
requests:
memory: "344Mi"
cpu: "252m"
