Josh Hawkins 41bc1a5844 Container security hardening (phase 4) (#24140) ...

* Support read-only rootfs with self-signed certs in /config/tls

* Support read-only rootfs in s6 and pre-compile bytecode

* Assert read-only rootfs support in CI

* Document hardened read-only deployment

* keep certsync's cert selection identical to nginx's

* note the uid trade-off in user: mode

* fail fast when EXTRA_GROUPS or a missing media volume meets read_only

* keep nosuid and nodev on the /run tmpfs

* support read_only in the default mode

* don't take go2rtc down when the homekit file isn't writable

* lead with the hardware consequence of switching to user:

* refuse to write TLS material through a symlink as root

* note that memryx writes models to the root filesystem

* certsync watches whichever cert path nginx loaded

2026-09-12 07:30:04 -06:00

..

ci.yml

Container security hardening (phase 4) (#24140)

2026-09-12 07:30:04 -06:00

pr_template_check.yml

Bump actions/github-script from 7 to 9 (#22830)

2026-04-30 12:26:28 -06:00

pull_request.yml

generate the API docs OpenAPI spec from the app with per-endpoint auth requirements (#23476)

2026-06-13 16:04:22 -06:00

release.yml

add synaptics to release (#21591)

2026-01-10 11:50:37 -06:00

stale.yml

Miscellaneous fixes (#23053)

2026-04-30 17:19:53 -06:00