cluster

commit a12f5c291188aa51d0cf22a78a3dc38bd5b19787
parent 2e8d73b0df139059312b7c82b6de275d0a1ebc9b
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Wed, 18 Feb 2026 21:16:26 +0100

fix persephone, freshrss, cgit and convex

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
apps/talos_cluster/cgit/deployment.yaml
 | 
2
++
M
apps/talos_cluster/convex/deployment.yaml
 | 
5
++---
M
apps/talos_cluster/freshrss/deployment.yaml
 | 
14
+++++++++++---
M
apps/talos_cluster/persephone/deployment.yaml
 | 
2
+-

4 files changed, 16 insertions(+), 7 deletions(-)
diff --git a/apps/talos_cluster/cgit/deployment.yaml b/apps/talos_cluster/cgit/deployment.yaml
@@ -94,6 +94,8 @@ spec:
             capabilities:
               drop:
                 - ALL
+              add:
+                - FOWNER  # entrypoint does chmod /tmp (root-owned dir)
             seccompProfile:
               type: RuntimeDefault
           resources:
diff --git a/apps/talos_cluster/convex/deployment.yaml b/apps/talos_cluster/convex/deployment.yaml
@@ -84,9 +84,8 @@ spec:
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            runAsUser: 1000
-            runAsGroup: 1000
+            # runAsNonRoot/runAsUser omitted: image entrypoint script perms are tied
+            # to the image's own user; override breaks exec. Image must set non-root USER.
             capabilities:
               drop:
                 - ALL
diff --git a/apps/talos_cluster/freshrss/deployment.yaml b/apps/talos_cluster/freshrss/deployment.yaml
@@ -26,12 +26,20 @@ spec:
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false
-            runAsNonRoot: true
-            runAsUser: 33
-            runAsGroup: 33
+            # NOTE: FreshRSS entrypoint starts as root to write /etc/localtime, /etc/timezone,
+            # /etc/php config, set up cron, then seteuid to www-data (uid 33).
+            # Cannot set runAsNonRoot/runAsUser here — entrypoint breaks without root init.
+            # Capabilities needed for entrypoint setup: CHOWN, DAC_OVERRIDE (write /etc/ files),
+            # SETUID/SETGID (seteuid to www-data), FOWNER (chmod operations).
             capabilities:
               drop:
                 - ALL
+              add:
+                - CHOWN
+                - DAC_OVERRIDE
+                - FOWNER
+                - SETUID
+                - SETGID
             seccompProfile:
               type: RuntimeDefault
           env:
diff --git a/apps/talos_cluster/persephone/deployment.yaml b/apps/talos_cluster/persephone/deployment.yaml
@@ -26,7 +26,7 @@ spec:
           imagePullPolicy: Always
           securityContext:
             allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
+            readOnlyRootFilesystem: false  # app writes to ./uploads/tmp/ relative to workdir
             runAsNonRoot: true
             runAsUser: 1000
             runAsGroup: 1000