cluster

commit 873ad6ef35af3aebdc8cf35814d958e913fbe07e
parent 3528b9a364dffab2e920e0b9499cbc685ad2bfe6
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Wed, 18 Feb 2026 20:48:16 +0100

harden mta-sts and wkd deployments

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
apps/talos_cluster/blog/docker/Dockerfile
 | 
6
+++---
M
apps/talos_cluster/mailserver/mta-sts-deployment.yaml
 | 
5
++++-
M
apps/talos_cluster/wkd/deployment.yaml
 | 
3
+++

3 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/apps/talos_cluster/blog/docker/Dockerfile b/apps/talos_cluster/blog/docker/Dockerfile
@@ -71,9 +71,9 @@ RUN wget -q https://downloads.wordpress.org/plugin/redis-cache.2.7.0.zip \
     && unzip -q redis-cache.2.7.0.zip -d /var/www/html/wordpress/wp-content/plugins/ \
     && rm redis-cache.2.7.0.zip
 # Install ActivityPub plugin
-RUN wget -q https://downloads.wordpress.org/plugin/activitypub.7.9.0.zip \
-    && unzip -q activitypub.7.9.0.zip -d /var/www/html/wordpress/wp-content/plugins/ \
-    && rm activitypub.7.9.0.zip
+RUN wget -q https://downloads.wordpress.org/plugin/activitypub.7.9.1.zip \
+    && unzip -q activitypub.7.9.1.zip -d /var/www/html/wordpress/wp-content/plugins/ \
+    && rm activitypub.7.9.1.zip
 # Install Embed Optimizer
 RUN wget -q https://downloads.wordpress.org/plugin/embed-optimizer.1.0.0-beta3.zip \
     && unzip -q embed-optimizer.1.0.0-beta3.zip -d /var/www/html/wordpress/wp-content/plugins/ \
diff --git a/apps/talos_cluster/mailserver/mta-sts-deployment.yaml b/apps/talos_cluster/mailserver/mta-sts-deployment.yaml
@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: nginx
-          image: nginxinc/nginx-unprivileged:1.25-alpine
+          image: nginxinc/nginx-unprivileged:1.29-alpine
           ports:
             - containerPort: 8080
               name: http
@@ -62,6 +62,8 @@ spec:
             capabilities:
               drop:
                 - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: mta-sts-config
           configMap:
@@ -75,6 +77,7 @@ spec:
           emptyDir: {}
         - name: var-run
           emptyDir: {}
+      automountServiceAccountToken: false
       securityContext:
         fsGroup: 101
 ---
diff --git a/apps/talos_cluster/wkd/deployment.yaml b/apps/talos_cluster/wkd/deployment.yaml
@@ -65,6 +65,8 @@ spec:
             capabilities:
               drop:
                 - ALL
+            seccompProfile:
+              type: RuntimeDefault
       volumes:
         - name: wkd-config
           configMap:
@@ -78,6 +80,7 @@ spec:
           emptyDir: {}
         - name: var-run
           emptyDir: {}
+      automountServiceAccountToken: false
       securityContext:
         fsGroup: 101
 ---