cluster

commit 73e4b83a07b83f5e299df36f04b674452ba50f85
parent 35b1ad1f75a8d4abd2260719bd4ec0c8fc5c7c39
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Thu, 19 Feb 2026 11:01:24 +0100

try hardening bookwyrm and peertube more

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
apps/talos_cluster/bookwyrm/deployment.yaml
 | 
17
++++++-----------
M
apps/talos_cluster/peertube/deployment.yaml
 | 
20
++++++++++++++++----

2 files changed, 22 insertions(+), 15 deletions(-)
diff --git a/apps/talos_cluster/bookwyrm/deployment.yaml b/apps/talos_cluster/bookwyrm/deployment.yaml
@@ -187,22 +187,17 @@ spec:
             - name: DATA_UPLOAD_MAX_MEMORY_MiB
               value: "100"
       containers:
-        # NOTE: nginx:latest master runs as root for chown; same pattern as connectivity-tester.
-        # Switch to nginxinc/nginx-unprivileged when updating this image and replace securityContext
-        # with full non-root settings (runAsUser: 101, runAsNonRoot: true, drop ALL caps).
         - name: nginx
-          image: nginx:latest
+          image: nginxinc/nginx-unprivileged:1.27-alpine
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 101
+            runAsGroup: 101
             capabilities:
               drop:
                 - ALL
-              add:
-                - CHOWN
-                - FOWNER
-                - SETUID
-                - SETGID
             seccompProfile:
               type: RuntimeDefault
           resources:
@@ -380,7 +375,7 @@ spec:
           resources:
             limits:
               cpu: "500m"
-              memory: "2Gi"
+              memory: "3Gi"
             requests:
               cpu: 200m
               memory: 500Mi
@@ -536,7 +531,7 @@ spec:
           resources:
             limits:
               cpu: "500m"
-              memory: "1024Mi"
+              memory: "2Gi"
             requests:
               cpu: 200m
               memory: 200Mi
diff --git a/apps/talos_cluster/peertube/deployment.yaml b/apps/talos_cluster/peertube/deployment.yaml
@@ -87,11 +87,19 @@ spec:
       automountServiceAccountToken: false
       containers:
         # Nginx sidecar for S3 caching and static content
-        # NOTE: nginx:1.27-alpine master runs as root; same pattern as connectivity-tester UI.
-        # When/if switched to nginx-unprivileged, remove the added capabilities and add
-        # runAsNonRoot: true, runAsUser: 101, runAsGroup: 101.
         - name: nginx
-          image: nginx:1.27-alpine
+          image: nginxinc/nginx-unprivileged:1.27-alpine
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false  # envsubst template processing writes to /etc/nginx/conf.d/
+            runAsNonRoot: true
+            runAsUser: 101
+            runAsGroup: 101
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
           ports:
             - containerPort: 8080
               name: http
@@ -112,6 +120,8 @@ spec:
               mountPath: /etc/nginx/templates/default.conf.template
               subPath: peertube.conf
               readOnly: true
+            - name: nginx-tmp
+              mountPath: /tmp
           resources:
             requests:
               memory: "128Mi"
@@ -322,6 +332,8 @@ spec:
         - name: nginx-config
           configMap:
             name: peertube-nginx
+        - name: nginx-tmp
+          emptyDir: {}
 ---
 apiVersion: v1
 kind: Service