Release gohoarder 0.0.3

charts/gohoarder/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: gohoarder
 description: A universal package cache proxy supporting npm, PyPI, and Go modules with security scanning
 type: application
-version: 0.0.2
-appVersion: "0.0.2"
+version: 0.0.3
+appVersion: "0.0.3"
 keywords:
   - package-manager
   - cache

charts/gohoarder/templates/deployment-frontend.yaml

@@ -26,7 +26,30 @@ spec:
       {{- end }}
       serviceAccountName: {{ include "gohoarder.serviceAccountName" . }}
       securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+        fsGroup: 101
+        runAsNonRoot: true
+        runAsUser: 101
+      initContainers:
+      - name: copy-static-files
+        image: "{{ .Values.image.frontend.repository }}:{{ .Values.image.frontend.tag | default .Chart.AppVersion }}"
+        command: ['sh', '-c']
+        args:
+        - |
+          # Copy built frontend files to writable volume
+          cp -rp /usr/share/nginx/html/* /html/
+          # Copy nginx config to writable volume
+          cp -rp /etc/nginx/conf.d/* /conf/
+        volumeMounts:
+        - name: nginx-html
+          mountPath: /html
+        - name: nginx-conf
+          mountPath: /conf
+        securityContext:
+          runAsUser: 101
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
       containers:
       - name: frontend
         securityContext:
@@ -35,6 +58,7 @@ spec:
             drop:
             - ALL
           readOnlyRootFilesystem: false
+          runAsUser: 101
         image: "{{ .Values.image.frontend.repository }}:{{ .Values.image.frontend.tag | default .Chart.AppVersion }}"
         imagePullPolicy: {{ .Values.image.frontend.pullPolicy }}
         ports:
@@ -64,6 +88,10 @@ spec:
           mountPath: /var/cache/nginx
         - name: nginx-run
           mountPath: /var/run
+        - name: nginx-html
+          mountPath: /usr/share/nginx/html
+        - name: nginx-conf
+          mountPath: /etc/nginx/conf.d
       volumes:
       - name: tmp
         emptyDir: {}
@@ -71,6 +99,10 @@ spec:
         emptyDir: {}
       - name: nginx-run
         emptyDir: {}
+      - name: nginx-html
+        emptyDir: {}
+      - name: nginx-conf
+        emptyDir: {}
       {{- with .Values.frontend.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/gohoarder/templates/deployment-scanner.yaml

@@ -42,9 +42,14 @@ spec:
           chown -R 1000:1000 /var/cache/gohoarder /var/lib/gohoarder /tmp/gohoarder
           chmod 750 /var/cache/gohoarder /var/lib/gohoarder
         volumeMounts:
-        {{- include "gohoarder.storageVolume" . | nindent 8 }}
-        {{- include "gohoarder.metadataVolume" . | nindent 8 }}
-        {{- include "gohoarder.trivyCacheVolume" . | nindent 8 }}
+        - name: storage
+          mountPath: /var/cache/gohoarder
+        - name: metadata
+          mountPath: /var/lib/gohoarder/metadata
+        {{- if .Values.security.scanners.trivy.enabled }}
+        - name: trivy-cache
+          mountPath: {{ .Values.security.scanners.trivy.cacheDb }}
+        {{- end }}
         - name: tmp
           mountPath: /tmp/gohoarder
         securityContext:

charts/gohoarder/templates/deployment-server.yaml

@@ -39,8 +39,10 @@ spec:
           chown -R 1000:1000 /var/cache/gohoarder /var/lib/gohoarder /tmp/gohoarder
           chmod 750 /var/cache/gohoarder /var/lib/gohoarder
         volumeMounts:
-        {{- include "gohoarder.storageVolume" . | nindent 8 }}
-        {{- include "gohoarder.metadataVolume" . | nindent 8 }}
+        - name: storage
+          mountPath: /var/cache/gohoarder
+        - name: metadata
+          mountPath: /var/lib/gohoarder/metadata
         - name: tmp
           mountPath: /tmp/gohoarder
         securityContext:

charts/gohoarder/values.yaml

@@ -51,17 +51,17 @@ image:
   server:
     repository: ghcr.io/lukaszraczylo/gohoarder-server
     pullPolicy: IfNotPresent
-    tag: "0.0.2"
+    tag: "0.0.3"
 
   frontend:
     repository: ghcr.io/lukaszraczylo/gohoarder-frontend
     pullPolicy: IfNotPresent
-    tag: "0.0.2"
+    tag: "0.0.3"
 
   scanner:
     repository: ghcr.io/lukaszraczylo/gohoarder-scanner
     pullPolicy: IfNotPresent
-    tag: "0.0.2"
+    tag: "0.0.3"
 
 # Service Account
 serviceAccount: