From f6250800f2f8d049314a844ae128b0f92001fc8a Mon Sep 17 00:00:00 2001
From: Inverstar <lnq1208@163.com>
Date: Tue, 6 Oct 2026 00:07:08 +0800
Subject: [PATCH] [UPDATE][neodb][1.0.2]Fix Nginx container runtime permissions
 with non-root emptyDir mounts

---
 neodb/Chart.yaml                     |  2 +-
 neodb/OlaresManifest.yaml            |  4 ++--
 neodb/i18n/en-US/OlaresManifest.yaml |  2 +-
 neodb/i18n/zh-CN/OlaresManifest.yaml |  2 +-
 neodb/templates/neodb.yaml           | 17 +++++++++++++++++
 5 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/neodb/Chart.yaml b/neodb/Chart.yaml
index 6eb2c2d99..460cc58e2 100644
--- a/neodb/Chart.yaml
+++ b/neodb/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: neodb
 description: NeoDB is an open source project to help users manage, share and discover collections, reviews and ratings for cultural products in the Fediverse.
 type: application
-version: 1.0.1
+version: 1.0.2
 appVersion: "0.19.6.3"
diff --git a/neodb/OlaresManifest.yaml b/neodb/OlaresManifest.yaml
index 41c8df423..c14e7abd7 100644
--- a/neodb/OlaresManifest.yaml
+++ b/neodb/OlaresManifest.yaml
@@ -9,7 +9,7 @@ metadata:
   description: Open source Fediverse cultural tracking service to mark, review, and discover books, movies, music, and games.
   icon: https://raw.githubusercontent.com/Inverstar/neodb/main/icon-256.png
   appid: neodb
-  version: '1.0.1'
+  version: '1.0.2'
   title: NeoDB
   categories:
   - homelab
@@ -20,7 +20,7 @@ permission:
 spec:
   versionName: '0.19.6.3'
   upgradeDescription: |
-    - Fix Redis authentication in migration and workers by patching RQ_QUEUES with Olares Redis credentials.
+    - Run Nginx as non-root UID 1000 with writable emptyDir runtime mounts for nginx config, cache, logs, and pid.
   fullDescription: |
     NeoDB is an open-source, decentralized cultural tracking service for the Fediverse and Atmosphere.
 
diff --git a/neodb/i18n/en-US/OlaresManifest.yaml b/neodb/i18n/en-US/OlaresManifest.yaml
index b314dfa0f..1a2751406 100644
--- a/neodb/i18n/en-US/OlaresManifest.yaml
+++ b/neodb/i18n/en-US/OlaresManifest.yaml
@@ -3,7 +3,7 @@ metadata:
   description: Open source Fediverse cultural tracking service to mark, review, and discover books, movies, music, and games.
 spec:
   upgradeDescription: |
-    - Fix Redis authentication failure in database migration and background workers.
+    - Run Nginx as non-root UID 1000 with writable emptyDir runtime mounts for nginx config, cache, logs, and pid.
   fullDescription: |
     **Mark the things you love.**
 
diff --git a/neodb/i18n/zh-CN/OlaresManifest.yaml b/neodb/i18n/zh-CN/OlaresManifest.yaml
index 17e889f97..0e9f18acb 100644
--- a/neodb/i18n/zh-CN/OlaresManifest.yaml
+++ b/neodb/i18n/zh-CN/OlaresManifest.yaml
@@ -3,7 +3,7 @@ metadata:
   description: 面向联邦宇宙（Fediverse）的开源书影音记录与文化发现平台。
 spec:
   upgradeDescription: |
-    - 修复数据库迁移和后台任务中的 Redis 密码鉴权失败问题。
+    - 适配非 root（UID 1000）运行 Nginx，挂载可写 emptyDir 运行时卷解决配置生成与缓存目录权限问题。
   fullDescription: |
     **记录你所爱的一切。**
 
diff --git a/neodb/templates/neodb.yaml b/neodb/templates/neodb.yaml
index 489191625..25a79dbb9 100644
--- a/neodb/templates/neodb.yaml
+++ b/neodb/templates/neodb.yaml
@@ -165,6 +165,7 @@ spec:
             - -c
           args:
             - |
+              mkdir -p /var/lib/nginx/body /var/lib/nginx/fastcgi /var/lib/nginx/proxy /var/lib/nginx/scgi /var/lib/nginx/uwsgi /run /var/log/nginx
               envsubst '${NEODB_WEB_SERVER} ${NEODB_API_SERVER} ${NEODB_MCP_SERVER} ${TAKAHE_WEB_SERVER}' < $NGINX_CONF > /etc/nginx/conf.d/neodb.conf
               exec nginx -g 'daemon off;'
           env:
@@ -181,6 +182,14 @@ spec:
               containerPort: 8000
               protocol: TCP
           volumeMounts:
+            - name: nginx-conf
+              mountPath: /etc/nginx/conf.d
+            - name: nginx-lib
+              mountPath: /var/lib/nginx
+            - name: nginx-log
+              mountPath: /var/log/nginx
+            - name: nginx-run
+              mountPath: /run
             - name: neodb-data
               mountPath: /www/m
               subPath: m
@@ -337,6 +346,14 @@ spec:
 
       restartPolicy: Always
       volumes:
+        - name: nginx-conf
+          emptyDir: {}
+        - name: nginx-lib
+          emptyDir: {}
+        - name: nginx-log
+          emptyDir: {}
+        - name: nginx-run
+          emptyDir: {}
         - name: neodb-patch
           configMap:
             name: neodb-patch