feat(supabase): add services and statefulset for database management

feat(synapse): update ingress to use traefik ingress class and bump version

feat(syncthing-discovery): introduce syncthing discovery service with deployment and ingress

feat(syncthing-relay): add syncthing relay server with deployment and ingress configuration

fix(taiga): update liveness and readiness probes to use tcpSocket for health checks

fix(taiga): change PVC access mode to ReadWriteMany for media and static storage

feat(traefik): add icon and ignore rules for traefik service

docs(ushahidi): add notes for Redis configuration and Laravel startup probe adjustments

feat(ushahidi): implement dedicated Redis deployment for Ushahidi

fix(vllm): update deployment strategy and readiness/liveness probes for improved stability

fix(writefreely): pin writefreely image version to v0.15.1 for consistency

docs(zulip): add notes for TLS-terminating reverse proxy configuration and expected behavior

externaldns/app.yaml

@@ -3,3 +3,7 @@ is: externaldns
 description: Automatically configures DNS records for services
 category: services
 latest: "v0"
+ignoreRules:
+  - WC-ICON # infrastructure service; not user-facing
+  - WC-SEL  # infrastructure service; selectors are managed by the upstream manifest
+  - WC-NS   # fixed namespace: externaldns

externaldns/versions/v0/externaldns-cloudflare.yaml

@@ -16,6 +16,10 @@ spec:
         app: external-dns
     spec:
       serviceAccountName: external-dns
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: external-dns
           image: registry.k8s.io/external-dns/external-dns:v0.13.4
@@ -30,6 +34,11 @@ spec:
             - --publish-internal-services
             - --no-cloudflare-proxied
             - --log-level=debug
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: true
           env:
             - name: CF_API_TOKEN
               valueFrom:

externaldns/versions/v0/manifest.yaml

@@ -1,4 +1,4 @@
-version: v0.13.4-1
+version: v0.13.4-2
 deploymentName: external-dns
 requires:
   - name: cert-manager