commit f54c94bd63ffb5afb8f7afc6edcedf2be90dd4f4
parent 873ad6ef35af3aebdc8cf35814d958e913fbe07e
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Wed, 18 Feb 2026 20:53:04 +0100
harden ntfy, connectivity-tester and draupnir4all and matrix-stats
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
4 files changed, 80 insertions(+), 24 deletions(-)
diff --git a/apps/talos_cluster/connectivity-tester/deployment.yaml b/apps/talos_cluster/connectivity-tester/deployment.yaml
@@ -17,6 +17,7 @@ spec:
labels:
app: connectivity-tester
spec:
+ automountServiceAccountToken: false
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
@@ -38,8 +39,21 @@ spec:
command:
- sleep
- "10"
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+ runAsGroup: 1000
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
resources:
- limits: {}
+ limits:
+ cpu: "200m"
+ memory: "128Mi"
requests:
memory: "100Mi"
cpu: "100m"
@@ -95,6 +109,7 @@ spec:
labels:
app: connectivity-tester-api
spec:
+ automountServiceAccountToken: false
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
@@ -111,8 +126,21 @@ spec:
- name: federation-tester-api
image: ghcr.io/mtrnord/rust-federation-tester:v0.2.6
imagePullPolicy: IfNotPresent
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+ runAsGroup: 1000
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
resources:
- limits: {}
+ limits:
+ cpu: "500m"
+ memory: "512Mi"
requests:
memory: "344Mi"
cpu: "252m"
@@ -121,10 +149,6 @@ spec:
mountPath: /app/config.yaml
subPath: config.yaml
readOnly: true
- securityContext:
- runAsUser: 1000
- runAsGroup: 1000
- readOnlyRootFilesystem: true
ports:
- containerPort: 8080
name: api
diff --git a/apps/talos_cluster/draupnir4all/deployment.yaml b/apps/talos_cluster/draupnir4all/deployment.yaml
@@ -36,6 +36,7 @@ spec:
app.kubernetes.io/instance: main-process
app.kubernetes.io/name: draupnir4all
spec:
+ automountServiceAccountToken: false
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
@@ -69,15 +70,24 @@ spec:
value: "--trace-warnings"
command: ["./draupnir-entrypoint.sh"]
args: ["appservice", "-c", "/data/config/config.appservice.yaml", "-f", "/data/config/draupnir-registration.yaml", "--draupnir-config", "/data/config/draupnir-config.yaml", "-p", "9000"]
+ securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+ runAsGroup: 1000
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
resources:
- limits: {}
+ limits:
+ cpu: "1000m"
+ memory: "512Mi"
requests:
memory: "344Mi"
cpu: "252m"
- securityContext:
- runAsUser: 1000
- runAsGroup: 1000
- readOnlyRootFilesystem: true
ports:
- containerPort: 9001
name: api
diff --git a/apps/talos_cluster/matrix-org-statistics/deployment.yaml b/apps/talos_cluster/matrix-org-statistics/deployment.yaml
@@ -29,6 +29,7 @@ spec:
labels:
app: morg-statistics
spec:
+ automountServiceAccountToken: false
containers:
- name: morg-statistics
image: ghcr.io/mtrnord/matrix-org-statistics:latest
@@ -44,9 +45,16 @@ spec:
memory: "500Mi"
cpu: "250m"
securityContext:
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
runAsUser: 999
runAsGroup: 999
- readOnlyRootFilesystem: false
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
ports:
- containerPort: 8080
name: http
diff --git a/apps/talos_cluster/ntfy/release.yaml b/apps/talos_cluster/ntfy/release.yaml
@@ -11,6 +11,7 @@ spec:
labels:
app: ntfy
spec:
+ automountServiceAccountToken: false
securityContext:
runAsUser: 1000
runAsGroup: 1000
@@ -21,8 +22,16 @@ spec:
securityContext:
runAsUser: 0
runAsGroup: 0
- allowPrivilegeEscalation: true
- command: ["sh", "-c", "chown -R 1000:1000 /opt/docker/ntfy/cache /etc/ntfy"]
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ add:
+ - CHOWN
+ - FOWNER
+ - DAC_OVERRIDE
+ command:
+ ["sh", "-c", "chown -R 1000:1000 /opt/docker/ntfy/cache /etc/ntfy"]
volumeMounts:
- name: ntfy-cache
mountPath: /opt/docker/ntfy/cache
@@ -34,10 +43,16 @@ spec:
- name: ntfy
securityContext:
allowPrivilegeEscalation: false
+ runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
readOnlyRootFilesystem: true
- image: binwiederhier/ntfy
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
+ image: binwiederhier/ntfy:v2.17.0
args: ["serve", "--config", "/opt/docker/ntfy/config/ntfy.yml"]
env:
- name: TZ
@@ -52,6 +67,14 @@ spec:
ports:
- containerPort: 8080
name: http
+ livenessProbe:
+ httpGet:
+ path: /v1/health
+ port: 8080
+ readinessProbe:
+ httpGet:
+ path: /v1/health
+ port: 8080
volumeMounts:
- name: ntfy-config
mountPath: /opt/docker/ntfy/config
@@ -61,15 +84,6 @@ spec:
mountPath: /etc/ntfy
- name: ntfy-cache-2
mountPath: /var/cache/ntfy
- probes:
- livenessProbe:
- httpGet:
- path: /v1/health
- port: 8080
- readinessProbe:
- httpGet:
- path: /v1/health
- port: 8080
volumes:
- name: ntfy-config
configMap:
