Home-Network/home-network-k3s-impl

0 Fork 0

Files

T

History

jakman85andClaude Opus 4.8 28498f1099 fix(apps): semaphore fsGroup — schema 1.3.0 podSecurityContext for non-root PVC write

The semaphoreui/semaphore image runs as non-root UID 1001 / GID 0 and writes its
generated config.json into the config dir on boot. A mounted Longhorn PVC is
root:root, so UID 1001 got "permission denied" and the pod crash-looped.

First-class the fix into the render contract (same mechanism the retired
gitea-bootstrap-patch was replaced by): schema 1.3.0 adds an optional pod-level
`podSecurityContext`, emitted verbatim onto spec.template.spec.securityContext by
render.py. Absent => every other app renders byte-identical (verified). semaphore
declares fsGroup=1001 (kubelet group-owns the PVC + adds the supplemental group so
UID 1001 can write) plus runAsUser/runAsGroup/runAsNonRoot pinning the image identity.

render.py selftest extended (verbatim render + absence). L0 (schema+kyverno 17/17),
L1 3/3, lint all green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-08-26 02:00:45 -05:00

..

gitea-actions-runner-secret.sops.yaml

Phase-6: enable Gitea Actions, in-cluster act_runner, static CI gate

2026-08-25 23:51:52 -05:00

gitea-actions.yaml

fix(ci): kyverno CLI arch x86_64 in install-tools; wait for dind certs

2026-08-26 00:04:04 -05:00

gitea-bootstrap-secret.sops.yaml

fix(gitea): mount PVC at /data + headless-install bootstrap (Phase 6)

2026-08-25 18:07:56 -05:00

gitea.yaml

feat(catalog): add SD env/envFrom/lifecycle; retire gitea bootstrap patch

2026-08-26 01:13:52 -05:00

jackett.yaml

fix(render): namespace-pin east-west selectors so declared deps actually connect

2026-08-26 01:01:56 -05:00

kustomization.yaml

feat(apps): onboard semaphore (Phase 6) — second CNPG-DB + OIDC-target app

2026-08-26 01:47:22 -05:00

nextcloud-bootstrap-secret.sops.yaml

feat(apps): onboard nextcloud (Phase 6) — first CNPG-DB + OIDC-target patterns

2026-08-26 01:32:00 -05:00

nextcloud-db-app.sops.yaml

feat(apps): onboard nextcloud (Phase 6) — first CNPG-DB + OIDC-target patterns

2026-08-26 01:32:00 -05:00

nextcloud-db.yaml

feat(apps): onboard nextcloud (Phase 6) — first CNPG-DB + OIDC-target patterns

2026-08-26 01:32:00 -05:00

nextcloud.yaml

feat(apps): onboard nextcloud (Phase 6) — first CNPG-DB + OIDC-target patterns

2026-08-26 01:32:00 -05:00

pihole.yaml

fix(renderer): Recreate strategy for Deployments mounting RWO PVCs

2026-08-25 18:14:45 -05:00

plex.yaml

fix(render): namespace-pin east-west selectors so declared deps actually connect

2026-08-26 01:01:56 -05:00

qbittorrent.yaml

fix(render): namespace-pin east-west selectors so declared deps actually connect

2026-08-26 01:01:56 -05:00

radarr.yaml

fix(render): namespace-pin east-west selectors so declared deps actually connect

2026-08-26 01:01:56 -05:00

README.md

Initial skeleton: home-network-k3s implementation repo

2026-08-15 23:41:43 -05:00

seerr.yaml

fix(render): namespace-pin east-west selectors so declared deps actually connect

2026-08-26 01:01:56 -05:00

semaphore-bootstrap-secret.sops.yaml

feat(apps): onboard semaphore (Phase 6) — second CNPG-DB + OIDC-target app

2026-08-26 01:47:22 -05:00

semaphore-db-app.sops.yaml

feat(apps): onboard semaphore (Phase 6) — second CNPG-DB + OIDC-target app

2026-08-26 01:47:22 -05:00

semaphore-db.yaml

feat(apps): onboard semaphore (Phase 6) — second CNPG-DB + OIDC-target app

2026-08-26 01:47:22 -05:00

semaphore.yaml

fix(apps): semaphore fsGroup — schema 1.3.0 podSecurityContext for non-root PVC write

2026-08-26 02:00:45 -05:00

sonarr.yaml

fix(render): namespace-pin east-west selectors so declared deps actually connect

2026-08-26 01:01:56 -05:00

README.md

apps

Placeholder — populated in Phase 0. See ../home-network-k3s (read-only spec).