Nick SzaunigandClaude Opus 5.5
04f9363e4b
Documents, avatars and the encrypted app backups lived in ./uploads and ./backups inside the container and were lost on every restart. The backend now mounts the apicore-data volume at /data (configmap paths /data/documents and /data/backups). Both deployments pin the image to a CI build (sha-<commit>) with imagePullPolicy IfNotPresent instead of :latest, run as uid 1000 with seccomp RuntimeDefault, no privilege escalation and all capabilities dropped. The frontend gets a liveness probe. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
16 lines
540 B
YAML
16 lines
540 B
YAML
# Persistenter Speicher fuer Dokumente, Avatare und die verschluesselten
|
|
# App-Backups (ConfigMap: DOCUMENTS_STORAGE_PATH=/data/documents,
|
|
# BACKUP_STORAGE_PATH=/data/backups). Im Cluster: StorageClass smb-app
|
|
# (SMB 3.1.1 mit seal, uid/gid 1000 = User "node" aus dem Dockerfile).
|
|
# ReadWriteMany, damit mehrere Backend-Replicas dieselben Dateien sehen.
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: apicore-data
|
|
spec:
|
|
accessModes: [ReadWriteMany]
|
|
storageClassName: smb-app
|
|
resources:
|
|
requests:
|
|
storage: 20Gi
|