Refactor Gitea and SSH configurations, update backup scripts, and enhance Nginx settings

- Updated SSH configuration for Gitea to disable banner and TTY, and modified the AuthorizedKeysCommand.
- Simplified gitea-shell script to directly call the k8s_gitea_shell command with required parameters.
- Removed unused gitea-auth script from playbook_gitea.yml.
- Updated systools_version in playbook_systools.yml to 0.4.5.
- Enhanced ssh_locker_helper to copy redirect URL to clipboard based on OS.
- Added a new script test_imaps for IMAP testing.
- Updated Terraform configurations for various applications, including:
  - Added a backup script for MariaDB with retention policy.
  - Changed Gitea version to 1.24-rootless and adjusted SSH settings.
  - Updated Nginx configurations to log errors and access to stderr/stdout.
  - Refactored services to use ClusterIP type and adjusted security contexts for deployments.
  - Added temporary storage for applications using empty_dir.
  - Enhanced backup.sh scripts for better error handling and logging.

terraform/modules/apps/nginx-reverse-proxy/main.tf

@@ -45,6 +45,8 @@ resource "kubernetes_service" "reverse-proxy" {
     selector = {
       app = "reverse-proxy"
     }
+
+    type       = "ClusterIP"
     cluster_ip = "None"
   }
 }
@@ -234,7 +236,7 @@ resource "kubernetes_deployment" "reverse_proxy" {
       }
       spec {
         dynamic "container" {
-          for_each = local.wireguard_config != "null" ? [1] : []
+          for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
           content {
 
             name  = "wireguard"
@@ -263,6 +265,7 @@ resource "kubernetes_deployment" "reverse_proxy" {
               capabilities {
                 add = ["NET_ADMIN"]
               }
+              read_only_root_filesystem = true
             }
 
             env {
@@ -291,11 +294,16 @@ resource "kubernetes_deployment" "reverse_proxy" {
               mount_path = "/lib/modules"
               read_only  = true
             }
+
+            volume_mount {
+              name       = "wireguard-run"
+              mount_path = "/run"
+            }
           }
         }
 
         dynamic "container" {
-          for_each = var.auth_token != "" ? [1] : []
+          for_each = nonsensitive(var.auth_token) != "" ? [1] : []
           content {
             name  = "auth-sidecar"
             image = "python:3.11-slim"
@@ -322,6 +330,14 @@ resource "kubernetes_deployment" "reverse_proxy" {
               container_port = 5000
               name           = "auth"
             }
+
+            security_context {
+              read_only_root_filesystem  = true
+              run_as_group               = 1000
+              run_as_user                = 1000
+              allow_privilege_escalation = false
+              run_as_non_root            = true
+            }
           }
         }
 
@@ -338,6 +354,7 @@ resource "kubernetes_deployment" "reverse_proxy" {
 
           security_context {
             allow_privilege_escalation = false
+            read_only_root_filesystem  = true
           }
 
           readiness_probe {
@@ -386,32 +403,31 @@ resource "kubernetes_deployment" "reverse_proxy" {
               protocol       = upper(port.value.protocol)
             }
           }
-
           volume_mount {
             name       = "nginx"
             mount_path = "/etc/nginx/nginx.conf"
             sub_path   = "nginx.conf"
             read_only  = true
           }
-
           volume_mount {
             name       = "services"
             mount_path = "/etc/nginx/conf.d/"
             read_only  = true
           }
-
           volume_mount {
             name       = "streams"
             mount_path = "/etc/nginx/streams.d/"
             read_only  = true
           }
-
           volume_mount {
             name       = "nginx-errors"
             mount_path = "/usr/share/nginx/html/errors"
             read_only  = true
           }
-
+          volume_mount {
+            name       = "nginx-tmp"
+            mount_path = "/tmp"
+          }
           dynamic "volume_mount" {
             for_each = length([for v in var.services : v.tls if v.tls == true]) > 0 ? [1] : []
             content {
@@ -423,17 +439,17 @@ resource "kubernetes_deployment" "reverse_proxy" {
         }
 
         dynamic "volume" {
-          for_each = local.wireguard_config != "null" ? [1] : []
+          for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
           content {
             name = "wireguard-config"
             config_map {
-              name = kubernetes_config_map.wireguard_config[0].metadata[0].name
+              name = nonsensitive(kubernetes_config_map.wireguard_config[0].metadata[0].name)
             }
           }
         }
 
         dynamic "volume" {
-          for_each = local.wireguard_config != "null" ? [1] : []
+          for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
           content {
             name = "lib-modules"
             host_path {
@@ -442,6 +458,16 @@ resource "kubernetes_deployment" "reverse_proxy" {
           }
         }
 
+        dynamic "volume" {
+          for_each = nonsensitive(local.wireguard_config) != "null" ? [1] : []
+          content {
+            name = "wireguard-run"
+            empty_dir {
+              medium = "Memory"
+            }
+          }
+        }
+
         volume {
           name = "auth-script"
           config_map {
@@ -477,6 +503,12 @@ resource "kubernetes_deployment" "reverse_proxy" {
           }
         }
 
+        volume {
+          name = "nginx-tmp"
+          empty_dir {
+          }
+        }
+
         dynamic "volume" {
           for_each = length([for v in var.services : v.tls if v.tls == true]) > 0 ? [1] : []
           content {