Refactor Gitea and SSH configurations, update backup scripts, and enhance Nginx settings

- Updated SSH configuration for Gitea to disable banner and TTY, and modified the AuthorizedKeysCommand.
- Simplified gitea-shell script to directly call the k8s_gitea_shell command with required parameters.
- Removed unused gitea-auth script from playbook_gitea.yml.
- Updated systools_version in playbook_systools.yml to 0.4.5.
- Enhanced ssh_locker_helper to copy redirect URL to clipboard based on OS.
- Added a new script test_imaps for IMAP testing.
- Updated Terraform configurations for various applications, including:
  - Added a backup script for MariaDB with retention policy.
  - Changed Gitea version to 1.24-rootless and adjusted SSH settings.
  - Updated Nginx configurations to log errors and access to stderr/stdout.
  - Refactored services to use ClusterIP type and adjusted security contexts for deployments.
  - Added temporary storage for applications using empty_dir.
  - Enhanced backup.sh scripts for better error handling and logging.

terraform/modules/apps/nginx/main.tf

@@ -45,6 +45,8 @@ resource "kubernetes_service" "website" {
     selector = {
       app = format("website-%s", replace(each.key, ".", "-"))
     }
+
+    type       = "ClusterIP"
     cluster_ip = "None"
   }
 }
@@ -177,11 +179,6 @@ resource "kubernetes_deployment" "website" {
       spec {
         service_account_name = kubernetes_service_account.website_service_account.metadata[0].name
 
-        security_context {
-          fs_group    = 1000
-          run_as_user = 1000
-        }
-
         container {
           name              = "website"
           image             = "nginx:${var.tag}"
@@ -212,7 +209,10 @@ resource "kubernetes_deployment" "website" {
           }
 
           security_context {
+            run_as_user                = 1000
+            run_as_group               = 1000
             allow_privilege_escalation = false
+            read_only_root_filesystem  = true
           }
 
           port {
@@ -239,6 +239,10 @@ resource "kubernetes_deployment" "website" {
             sub_path   = "default.conf"
             read_only  = true
           }
+          volume_mount {
+            name       = "tmp"
+            mount_path = "/tmp"
+          }
           volume_mount {
             name       = "website"
             mount_path = "/tmp/site"
@@ -265,6 +269,12 @@ resource "kubernetes_deployment" "website" {
             name = kubernetes_config_map.nginx_default_config[each.key].metadata[0].name
           }
         }
+        volume {
+          name = "tmp"
+          empty_dir {
+            medium = "Memory"
+          }
+        }
         volume {
           name = "website"
           host_path {
@@ -296,4 +306,3 @@ resource "kubernetes_deployment" "website" {
     ignore_changes = [spec[0].template[0].metadata[0].annotations["kubectl.kubernetes.io/restartedAt"]]
   }
 }
-