fix: make the nginx config readable by the unprivileged user

COPY keeps the source file's mode; a 600 file (local checkouts) left
uid 101 unable to read it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

.gitea/workflows/ci.yaml

@@ -18,16 +18,30 @@ jobs:
       - name: Build and push
         run: unset GITEA_TOKEN && build && push
 
-  deploy-prod:
+  deploy-prod-frostmoln:
     needs: build
     if: gitea.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     env:
-      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
+      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_FROSTMOLN_PRODUCTION }}
       GITEA_REPOSITORY: ${{ gitea.repository }}
+      FM_TENANT: 9ae61342-0f76-476f-8176-e46f6b0b0c32
     environment: prod
     steps:
       - uses: actions/checkout@v7
       - uses: buildtool/setup-buildtools-action@v1
-      - name: Deploy to production
+      - name: Install fm
-        run: deploy prod
+        run: |
+          sudo install -d -m 0755 /etc/apt/keyrings
+          sudo curl -fsSL -o /etc/apt/keyrings/frostmoln.gpg https://get.frostmoln.cloud/deb/frostmoln.gpg
+          sudo curl -fsSL -o /etc/apt/sources.list.d/frostmoln.sources https://get.frostmoln.cloud/deb/frostmoln.sources
+          sudo apt-get update && sudo apt-get install -y fm
+      - name: Deploy to Frostmoln production
+        env:
+          FROSTMOLN_API_KEY: ${{ secrets.FROSTMOLN_PRODUCTION_DEPLOY_KEY }}
+        # The cluster API is private: the kubeconfig's exec plugin opens an fm
+        # tunnel on demand. fm reads the key from its config file, not the env.
+        run: |
+          fm auth api-key set "$FROSTMOLN_API_KEY" > /dev/null
+          fm kubernetes cluster kubeconfig ${{ vars.FROSTMOLN_PRODUCTION_CLUSTER_ID }} --exec --file "$RUNNER_TEMP/kubeconfig"
+          KUBECONFIG_CONTENT="$(cat "$RUNNER_TEMP/kubeconfig")" deploy prod-frostmoln -n schemas

Dockerfile

@@ -12,9 +12,10 @@ RUN npm run postinstall && npm run generate && npm run lint && npm run test:cove
 FROM scratch as export
 COPY --from=builder /build/coverage /
 
-FROM amd64/nginx:1.31.7@sha256:227f31dac037a2f1cdbd17ca9eec940a76c6c1b3187f5285eca2c3edb5d19c31
+# Unprivileged (uid 101, port 8080): Frostmoln enforces restricted Pod Security.
+FROM nginxinc/nginx-unprivileged:1.31.6@sha256:1d26a516fb93b18f9c0214dc9c645054486e516f13ff09ef63d5bd5c622278a2
 MAINTAINER Joakim Olsson <joakim@unbound.se>
 
-COPY ./nginx/nginx.conf /etc/nginx/nginx.conf
+COPY --chmod=644 ./nginx/nginx.conf /etc/nginx/nginx.conf
-COPY ./nginx/security_headers.conf /etc/nginx/security_headers.conf
+COPY --chmod=644 ./nginx/security_headers.conf /etc/nginx/security_headers.conf
 COPY --from=builder /build/.output/public/ /usr/share/nginx/html/

k8s/deploy.yaml

@@ -23,6 +23,11 @@ spec:
         app.kubernetes.io/name: schemas-app
         app.kubernetes.io/instance: schemas
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        seccompProfile:
+          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -39,19 +44,23 @@ spec:
       - name: schemas-app
         image: ${IMAGE}
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
         ports:
-        - containerPort: 80
+        - containerPort: 8080
         readinessProbe:
           httpGet:
             path: /
-            port: 80
+            port: 8080
           initialDelaySeconds: 5
           periodSeconds: 5
           timeoutSeconds: 5
         livenessProbe:
           httpGet:
             path: /
-            port: 80
+            port: 8080
           initialDelaySeconds: 10
           periodSeconds: 10
           timeoutSeconds: 5
@@ -71,9 +80,8 @@ metadata:
   labels:
     app.kubernetes.io/name: schemas-app
 spec:
-  type: NodePort
   selector:
     app.kubernetes.io/name: schemas-app
   ports:
   - port: 80
-    targetPort: 80
+    targetPort: 8080

k8s/ingress-prod-frostmoln.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: schemas-app
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: "schemas.unbound.se"
+      http:
+        paths:
+          # Everything but /query, which the schemas API's longer path takes.
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: schemas-app
+                port:
+                  number: 80

k8s/ingress-prod.yaml

@@ -1,25 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: schemas-app-ingress
-  annotations:
-    alb.ingress.kubernetes.io/group.name: "default"
-    alb.ingress.kubernetes.io/group.order: "15"
-    alb.ingress.kubernetes.io/scheme: internet-facing
-    alb.ingress.kubernetes.io/target-type: instance
-    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
-    alb.ingress.kubernetes.io/ssl-redirect: "443"
-    alb.ingress.kubernetes.io/healthcheck-path: '/'
-spec:
-  ingressClassName: "alb"
-  rules:
-    - host: "schemas.unbound.se"
-      http:
-        paths:
-          - path: /*
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: schemas-app
-                port:
-                  number: 80

nginx/nginx.conf

@@ -1,14 +1,20 @@
-user  nginx;
 worker_processes  auto;
 
 error_log  /var/log/nginx/error.log notice;
-pid        /var/run/nginx.pid;
+pid        /tmp/nginx.pid;
 
 events {
   worker_connections  1024;
 }
 
 http {
+  # Writable by the unprivileged (uid 101) worker.
+  client_body_temp_path /tmp/client_temp;
+  proxy_temp_path       /tmp/proxy_temp_path;
+  fastcgi_temp_path     /tmp/fastcgi_temp;
+  uwsgi_temp_path       /tmp/uwsgi_temp;
+  scgi_temp_path        /tmp/scgi_temp;
+
   include       /etc/nginx/mime.types;
   default_type  application/octet-stream;
   types {
@@ -22,7 +28,7 @@ http {
   keepalive_timeout  65;
 
   server {
-    listen       80;
+    listen       8080;
     server_name  localhost;
     root         /usr/share/nginx/html;
     index        index.html index.htm;