cluster

commit c63e8235cd0485eafd471a070b1098036d56ac8a
parent c14f7d966fe9133489dc576dcbb311cde4bce6f8
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Wed, 18 Feb 2026 21:02:17 +0100

harden bookwyrm and draupnir-synapse keydb

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
apps/talos_cluster/bookwyrm/keydb.yaml
 | 
50
+++++++++++++++++++++++++++++++++-----------------
M
apps/talos_cluster/draupnir-synapse/keydb.yaml
 | 
50
+++++++++++++++++++++++++++++++++-----------------

2 files changed, 66 insertions(+), 34 deletions(-)
diff --git a/apps/talos_cluster/bookwyrm/keydb.yaml b/apps/talos_cluster/bookwyrm/keydb.yaml
@@ -11,6 +11,9 @@ spec:
     metadata:
       labels:
         app: bookwyrm-keydb
+      automountServiceAccountToken: false
+      securityContext:
+        fsGroup: 999
     spec:
       containers:
         - name: bookwyrm-keydb
@@ -20,32 +23,45 @@ spec:
           args: ["/etc/keydb/keydb.conf", "--protected-mode", "no"]
           ports:
             - containerPort: 6379
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+            runAsNonRoot: true
+            runAsUser: 999
+            runAsGroup: 999
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
           resources:
             requests:
               memory: "128Mi"
               cpu: "100m"
-            limits: {}
+            limits:
+              memory: "256Mi"
+              cpu: "500m"
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - keydb-cli ping
+            initialDelaySeconds: 10
+            timeoutSeconds: 5
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - keydb-cli ping
+            initialDelaySeconds: 10
+            timeoutSeconds: 5
       tolerations:
         - key: arch
           operator: Equal
           value: arm64
           effect: NoSchedule
-      livenessProbe:
-        exec:
-          command:
-            - sh
-            - -c
-            - keydb-cli ping
-        initialDelaySeconds: 10
-        timeoutSeconds: 5
-      readinessProbe:
-        exec:
-          command:
-            - sh
-            - -c
-            - keydb-cli ping
-        initialDelaySeconds: 10
-        timeoutSeconds: 5
 ---
 apiVersion: v1
 kind: Service
diff --git a/apps/talos_cluster/draupnir-synapse/keydb.yaml b/apps/talos_cluster/draupnir-synapse/keydb.yaml
@@ -11,6 +11,9 @@ spec:
     metadata:
       labels:
         app: draupnir-synapse-keydb
+      automountServiceAccountToken: false
+      securityContext:
+        fsGroup: 999
     spec:
       containers:
         - name: draupnir-synapse-keydb
@@ -20,32 +23,45 @@ spec:
           args: ["/etc/keydb/keydb.conf", "--protected-mode", "no"]
           ports:
             - containerPort: 6379
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+            runAsNonRoot: true
+            runAsUser: 999
+            runAsGroup: 999
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
           resources:
             requests:
               memory: "128Mi"
               cpu: "100m"
-            limits: {}
+            limits:
+              memory: "256Mi"
+              cpu: "500m"
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - keydb-cli ping
+            initialDelaySeconds: 10
+            timeoutSeconds: 5
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - keydb-cli ping
+            initialDelaySeconds: 10
+            timeoutSeconds: 5
       tolerations:
         - key: arch
           operator: Equal
           value: arm64
           effect: NoSchedule
-      livenessProbe:
-        exec:
-          command:
-            - sh
-            - -c
-            - keydb-cli ping
-        initialDelaySeconds: 10
-        timeoutSeconds: 5
-      readinessProbe:
-        exec:
-          command:
-            - sh
-            - -c
-            - keydb-cli ping
-        initialDelaySeconds: 10
-        timeoutSeconds: 5
 ---
 apiVersion: v1
 kind: Service