Refactor ansible-apply.yaml and inventory/hosts, add ansible.cfg

terraform/k8sapps/nextcloud.tf

@@ -299,6 +299,9 @@ resource "kubernetes_deployment" "nextcloud_redis" {
               memory = "50Mi"
             }
           }
+          security_context {
+            allow_privilege_escalation = false
+          }
 
           readiness_probe {
             tcp_socket {
@@ -399,6 +402,9 @@ resource "kubernetes_deployment" "nextcloud_apache" {
               value = env.value
             }
           }
+          security_context {
+            allow_privilege_escalation = false
+          }
 
           dynamic "env" {
             for_each = local.nextcloud_secrets
@@ -476,6 +482,9 @@ resource "kubernetes_cron_job_v1" "nextcloud_cron_apache" {
 
               command = ["curl"]
               args    = ["--fail", "-L", "http://http/cron.php"]
+              security_context {
+                allow_privilege_escalation = false
+              }
             }
             restart_policy                   = "Never"
             termination_grace_period_seconds = 30