feat(supabase): add services and statefulset for database management

feat(synapse): update ingress to use traefik ingress class and bump version

feat(syncthing-discovery): introduce syncthing discovery service with deployment and ingress

feat(syncthing-relay): add syncthing relay server with deployment and ingress configuration

fix(taiga): update liveness and readiness probes to use tcpSocket for health checks

fix(taiga): change PVC access mode to ReadWriteMany for media and static storage

feat(traefik): add icon and ignore rules for traefik service

docs(ushahidi): add notes for Redis configuration and Laravel startup probe adjustments

feat(ushahidi): implement dedicated Redis deployment for Ushahidi

fix(vllm): update deployment strategy and readiness/liveness probes for improved stability

fix(writefreely): pin writefreely image version to v0.15.1 for consistency

docs(zulip): add notes for TLS-terminating reverse proxy configuration and expected behavior

immich/versions/1/deployment-machine-learning.yaml

@@ -16,6 +16,11 @@ spec:
         app: immich-machine-learning
         component: machine-learning
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - image: "ghcr.io/immich-app/immich-machine-learning:v1.135.3"
           name: immich-machine-learning
@@ -25,6 +30,11 @@ spec:
           env:
             - name: TZ
               value: "UTC"
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: false
           volumeMounts:
             - mountPath: /cache
               name: immich-cache

immich/versions/1/deployment-microservices.yaml

@@ -9,16 +9,18 @@ spec:
     matchLabels:
       app: immich-microservices
   strategy:
-    rollingUpdate:
-      maxSurge: 0
-      maxUnavailable: 1
-    type: RollingUpdate
+    type: Recreate
   template:
     metadata:
       labels:
         app: immich-microservices
         component: microservices
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - image: "ghcr.io/immich-app/immich-server:v1.135.3"
           name: immich-microservices
@@ -43,6 +45,11 @@ spec:
               value: "UTC"
             - name: IMMICH_WORKERS_EXCLUDE
               value: api
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: false
           volumeMounts:
             - mountPath: /usr/src/app/upload
               name: immich-storage

immich/versions/1/deployment-server.yaml

@@ -9,16 +9,18 @@ spec:
     matchLabels:
       app: immich-server
   strategy:
-    rollingUpdate:
-      maxSurge: 0
-      maxUnavailable: 1
-    type: RollingUpdate
+    type: Recreate
   template:
     metadata:
       labels:
         app: immich-server
         component: server
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - image: "ghcr.io/immich-app/immich-server:v1.135.3"
           name: immich-server
@@ -46,6 +48,11 @@ spec:
               value: "UTC"
             - name: IMMICH_WORKERS_EXCLUDE
               value: microservices
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: false
           volumeMounts:
             - mountPath: /usr/src/app/upload
               name: immich-storage

immich/versions/1/ingress.yaml

@@ -7,6 +7,7 @@ metadata:
     external-dns.alpha.kubernetes.io/target: "{{ .externalDnsDomain }}"
     external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
 spec:
+  ingressClassName: traefik
   rules:
     - host: "{{ .domain }}"
       http:

immich/versions/1/manifest.yaml

@@ -1,4 +1,4 @@
-version: 1.135.3-2
+version: 1.135.3-4
 requires:
   - name: redis
   - name: postgres