chore(deps): update golang docker tag to v1.27.3 (#420)

Part of the dancefinder.unbound.se cutover to Frostmoln Production (infra: unboundsoftware/infra#1896, already applied).

- Replaces the AWS `deploy-prod` job (failing since CI left AWS) with `deploy-prod-frostmoln` (`deploy prod-frostmoln -n dancefinder`), as schemas did.
- Restricted securityContext (runAsNonRoot, drop ALL, seccomp RuntimeDefault) and `imagePullSecrets: oci-registry` (Platform registry).
- Listens on 8080 (`PORT`) as uid 65534. MAPS_API_KEY comes from the namespace's SecretStore (Frostmoln Secret `dancefinder`).

Merging deploys to Frostmoln only; DNS still points at AWS until the cutover.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01H6eVuR4Yt3m7TbDTDwyZJi
Reviewed-on: https://gitea.unbound.se/dancefinder/geo-service/pulls/417

.gitea/workflows/ci.yaml

@@ -18,16 +18,30 @@ jobs:
       - name: Build and push
         run: unset GITEA_TOKEN && build && push
 
-  deploy-prod:
+  deploy-prod-frostmoln:
     needs: build
     if: gitea.ref == 'refs/heads/master'
     runs-on: ubuntu-latest
     env:
-      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
+      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_FROSTMOLN_PRODUCTION }}
       GITEA_REPOSITORY: ${{ gitea.repository }}
+      FM_TENANT: 9ae61342-0f76-476f-8176-e46f6b0b0c32
     environment: prod
     steps:
       - uses: actions/checkout@v7
       - uses: buildtool/setup-buildtools-action@v1
-      - name: Deploy
-        run: deploy prod
+      - name: Install fm
+        run: |
+          sudo install -d -m 0755 /etc/apt/keyrings
+          sudo curl -fsSL -o /etc/apt/keyrings/frostmoln.gpg https://get.frostmoln.cloud/deb/frostmoln.gpg
+          sudo curl -fsSL -o /etc/apt/sources.list.d/frostmoln.sources https://get.frostmoln.cloud/deb/frostmoln.sources
+          sudo apt-get update && sudo apt-get install -y fm
+      - name: Deploy to Frostmoln production
+        env:
+          FROSTMOLN_API_KEY: ${{ secrets.FROSTMOLN_PRODUCTION_DEPLOY_KEY }}
+        # The cluster API is private: the kubeconfig's exec plugin opens an fm
+        # tunnel on demand. fm reads the key from its config file, not the env.
+        run: |
+          fm auth api-key set "$FROSTMOLN_API_KEY" > /dev/null
+          fm kubernetes cluster kubeconfig ${{ vars.FROSTMOLN_PRODUCTION_CLUSTER_ID }} --exec --file "$RUNNER_TEMP/kubeconfig"
+          KUBECONFIG_CONTENT="$(cat "$RUNNER_TEMP/kubeconfig")" deploy prod-frostmoln -n dancefinder

Dockerfile

@@ -1,4 +1,4 @@
-FROM amd64/golang:1.27.2@sha256:9e036bef9c3cd035cae4aeff523b3997c3c8aa993b13d112a71ea90143e87e48 as builder
+FROM amd64/golang:1.27.3@sha256:806880ee211370bb7d6c3b665d2d27357425116282b4c643e297b74655eb6f05 as builder
 WORKDIR /src
 COPY * ./
 RUN go get

go.mod

@@ -5,7 +5,7 @@ go 1.26.0
 require (
 	cloud.google.com/go/maps v1.43.0
 	github.com/caarlos0/env v3.5.0+incompatible
-	google.golang.org/api v0.302.0
+	google.golang.org/api v0.304.0
 	google.golang.org/genproto v0.0.0-20261012220534-4341edf3f941
 	google.golang.org/grpc v1.84.0
 	googlemaps.github.io/maps v1.7.0

go.sum

@@ -164,8 +164,8 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.302.0 h1:/eENsEv3+GE0QiEmXjdaLI84Mt76LNjGz4vp4E7sRVw=
-google.golang.org/api v0.302.0/go.mod h1:dcjRWAy1QdjGb3Z67Qu0gdBWH2gL8Qoy/RI2ZVuvdeE=
+google.golang.org/api v0.304.0 h1:2R1dYSiIVQRGcKN901u9yPFEdJu5h90oGY5X4TcgbmA=
+google.golang.org/api v0.304.0/go.mod h1:dcjRWAy1QdjGb3Z67Qu0gdBWH2gL8Qoy/RI2ZVuvdeE=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=

k8s/deploy.yaml

@@ -21,6 +21,13 @@ spec:
       labels:
         app.kubernetes.io/name: geo-service
     spec:
+      imagePullSecrets:
+        - name: oci-registry
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -35,6 +42,10 @@ spec:
                 topologyKey: kubernetes.io/hostname
       containers:
         - name: geo-service
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
           resources:
             limits:
               memory: "100Mi"
@@ -43,8 +54,11 @@ spec:
           imagePullPolicy: Always
           image: ${IMAGE}
           ports:
-            - containerPort: 80
+            - containerPort: 8080
               name: http
+          env:
+            - name: PORT
+              value: "8080"
           envFrom:
             - secretRef:
                 name: geo-service
@@ -59,7 +73,7 @@ spec:
     - port: 80
       name: http
       protocol: TCP
-      targetPort: 80
+      targetPort: 8080
   selector:
     app.kubernetes.io/name: geo-service
   type: ClusterIP

k8s/secrets-prod-frostmoln.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: geo-service
+spec:
+  refreshInterval: 1h
+  # The namespace's store (infra frostmoln/production/apps.tf); MAPS_API_KEY
+  # lives in the Frostmoln Secret "dancefinder", next to the API's settings
+  # (infra frostmoln/production/scripts/seed-app.sh).
+  secretStoreRef:
+    name: frostmoln
+    kind: SecretStore
+  target:
+    name: geo-service
+    template:
+      engineVersion: v2
+      data:
+        MAPS_API_KEY: "{{ .MAPS_API_KEY }}"
+  dataFrom:
+  - extract:
+      key: dancefinder

k8s/secrets.yaml

@@ -1,14 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: geo-service
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: external-secrets
-    kind: ClusterSecretStore
-  target:
-    creationPolicy: Owner
-  dataFrom:
-  - extract:
-      key: applications/dancefinder/geo-service