forked from sr2/ansible-collection-apps
Roles and playbooks for application deployment and management
- Python 100%
971b9f1b8c
zammad-init, zammad-railsserver, zammad-scheduler, zammad-websocket and zammad-nginx now run with a read-only root filesystem, no new privileges and every capability dropped, so not even root inside a container can change the Zammad code. The only writable paths are the existing var, storage and sites-enabled mounts and memory-backed tmpfs for /opt/zammad/tmp and /opt/zammad/log (plus podman's /tmp, /var/tmp and /run), and for nginx /etc/nginx/conf.d, /var/lib/nginx and /var/log/nginx. Everything written there is gone on the next start. This needs the Link release whose Zammad image keeps the code root-owned and stops the bridge initializers writing public/assets/images/icons.svg at boot (link-stack a343f2c9); on older images Zammad fails to start on a read-only root. The role now refuses to run with a podman_link_stack_version older than 3.8.0-beta.6, so the default pin must be bumped with that release. |
||
|---|---|---|
| .forgejo/workflows | ||
| meta | ||
| playbooks | ||
| roles | ||
| .ansible-lint.yml | ||
| .gitignore | ||
| galaxy.yml | ||
| renovate.json | ||