commit 3e6c3085bee2facc5c9c64818a7b9958ab4b9cdc parent e5e2725a3aa385ed4183bd4cc2b1c3dc71c734af Author: MTRNord <MTRNord@users.noreply.github.com> Date: Thu, 11 Sep 2025 11:19:04 +0200 Small fixes Diffstat:
| M | apps/talos_cluster/wkd/deployment.yaml | | | 135 | +++++++++++++++++++++++++++++++++++++++++++++++++------------------------------ |
1 file changed, 84 insertions(+), 51 deletions(-)
diff --git a/apps/talos_cluster/wkd/deployment.yaml b/apps/talos_cluster/wkd/deployment.yaml @@ -19,56 +19,56 @@ spec: - name: nginx image: nginxinc/nginx-unprivileged:1.25-alpine ports: - - containerPort: 8080 - name: http + - containerPort: 8080 + name: http volumeMounts: - - name: wkd-config - mountPath: /etc/nginx/conf.d - readOnly: true - - name: wkd-content - mountPath: /usr/share/nginx/html/.well-known/openpgpkey/hu/ - readOnly: true - - name: tmp - mountPath: /tmp - - name: var-cache-nginx - mountPath: /var/cache/nginx - - name: var-run - mountPath: /var/run + - name: wkd-config + mountPath: /etc/nginx/conf.d + readOnly: true + - name: wkd-content + mountPath: /usr/share/nginx/html/.well-known/openpgpkey/hu/ + readOnly: true + - name: tmp + mountPath: /tmp + - name: var-cache-nginx + mountPath: /var/cache/nginx + - name: var-run + mountPath: /var/run resources: - requests: - memory: "32Mi" - cpu: "10m" - limits: - memory: "64Mi" - cpu: "50m" + requests: + memory: "32Mi" + cpu: "10m" + limits: + memory: "64Mi" + cpu: "50m" livenessProbe: - httpGet: - path: /health - port: 8080 - initialDelaySeconds: 10 - periodSeconds: 30 + httpGet: + path: /health + port: 8080 + initialDelaySeconds: 10 + periodSeconds: 30 readinessProbe: - httpGet: - path: /health - port: 8080 - initialDelaySeconds: 5 - periodSeconds: 10 + httpGet: + path: /health + port: 8080 + initialDelaySeconds: 5 + periodSeconds: 10 securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 101 - runAsGroup: 101 - capabilities: - drop: - - ALL + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 101 + runAsGroup: 101 + capabilities: + drop: + - ALL volumes: - name: wkd-config configMap: - name: wkd-nginx-config + name: wkd-nginx-config - name: wkd-content configMap: - name: wkd-content + name: wkd-content - name: tmp emptyDir: {} - name: var-cache-nginx @@ -84,13 +84,46 @@ metadata: name: wkd-nginx-config namespace: mailserver data: - default.conf: "server {\n listen 8080;\n server_name _;\n \n root /usr/share/nginx/html;\n index index.html;\n\n - \ # Security headers\n add_header X-Content-Type-Options nosniff;\n add_header X-Frame-Options DENY;\n add_header - X-XSS-Protection \"1; mode=block\";\n\n # wkd specific configuration\n location /.well-known/openpgpkey/hu/p6d5q6ozbrkcy3cnexq8s8uzh1rk9fbs - {\n add_header Content-Type \"application/pgp-key; charset=utf-8\";\n add_header Cache-Control \"max-age=604800\";\n - \ try_files $uri =404;\n }\n\n # Health check endpoint\n location /health {\n access_log off;\n - \ return 200 \"healthy\\n\";\n add_header Content-Type text/plain;\n }\n\n # Deny access to other - locations\n location / {\n return 404;\n }\n\n # Disable server tokens\n server_tokens off;\n}\n" + default.conf: | + server { + listen 8080; + server_name _; + + root /usr/share/nginx/html; + index index.html; + + # Security headers + add_header X-Content-Type-Options nosniff; + add_header X-Frame-Options DENY; + add_header X-XSS-Protection "1; mode=block"; + + # wkd specific configuration + location /.well-known/openpgpkey/hu/p6d5q6ozbrkcy3cnexq8s8uzh1rk9fbs { + add_header Content-Type "application/octet-stream; charset=utf-8"; + add_header Cache-Control "max-age=604800"; + try_files $uri =404; + } + location /.well-known/openpgpkey/policy { + access_log off; + return 200 ""; + add_header Content-Type text/plain; + } + + # Health check endpoint + location /health { + access_log off; + return 200 "healthy\n"; + add_header Content-Type text/plain; + } + + # Deny access to other locations + location / { + return 404; + } + + # Disable server tokens + server_tokens off; + } --- apiVersion: v1 kind: Service @@ -122,8 +155,8 @@ spec: - nordgedanken.dev rules: - backendRefs: - - name: wkd-server - port: 8080 + - name: wkd-server + port: 8080 timeouts: - request: 240s - backendRequest: 0s + request: 240s + backendRequest: 0s