[UPDATE][neodb][1.0.2]Fix Nginx container runtime permissions

neodb/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: neodb
 description: NeoDB is an open source project to help users manage, share and discover collections, reviews and ratings for cultural products in the Fediverse.
 type: application
-version: 1.0.1
+version: 1.0.2
 appVersion: "0.19.6.3"

neodb/OlaresManifest.yaml

@@ -9,7 +9,7 @@ metadata:
   description: Open source Fediverse cultural tracking service to mark, review, and discover books, movies, music, and games.
   icon: https://raw.githubusercontent.com/Inverstar/neodb/main/icon-256.png
   appid: neodb
-  version: '1.0.1'
+  version: '1.0.2'
   title: NeoDB
   categories:
   - homelab
@@ -20,7 +20,7 @@ permission:
 spec:
   versionName: '0.19.6.3'
   upgradeDescription: |
-    - Fix Redis authentication in migration and workers by patching RQ_QUEUES with Olares Redis credentials.
+    - Run Nginx as non-root UID 1000 with writable emptyDir runtime mounts for nginx config, cache, logs, and pid.
   fullDescription: |
     NeoDB is an open-source, decentralized cultural tracking service for the Fediverse and Atmosphere.
 

neodb/i18n/en-US/OlaresManifest.yaml

@@ -3,7 +3,7 @@ metadata:
   description: Open source Fediverse cultural tracking service to mark, review, and discover books, movies, music, and games.
 spec:
   upgradeDescription: |
-    - Fix Redis authentication failure in database migration and background workers.
+    - Run Nginx as non-root UID 1000 with writable emptyDir runtime mounts for nginx config, cache, logs, and pid.
   fullDescription: |
     **Mark the things you love.**
 

neodb/i18n/zh-CN/OlaresManifest.yaml

@@ -3,7 +3,7 @@ metadata:
   description: 面向联邦宇宙（Fediverse）的开源书影音记录与文化发现平台。
 spec:
   upgradeDescription: |
-    - 修复数据库迁移和后台任务中的 Redis 密码鉴权失败问题。
+    - 适配非 root（UID 1000）运行 Nginx，挂载可写 emptyDir 运行时卷解决配置生成与缓存目录权限问题。
   fullDescription: |
     **记录你所爱的一切。**
 

neodb/templates/neodb.yaml

@@ -165,6 +165,7 @@ spec:
             - -c
           args:
             - |
+              mkdir -p /var/lib/nginx/body /var/lib/nginx/fastcgi /var/lib/nginx/proxy /var/lib/nginx/scgi /var/lib/nginx/uwsgi /run /var/log/nginx
               envsubst '${NEODB_WEB_SERVER} ${NEODB_API_SERVER} ${NEODB_MCP_SERVER} ${TAKAHE_WEB_SERVER}' < $NGINX_CONF > /etc/nginx/conf.d/neodb.conf
               exec nginx -g 'daemon off;'
           env:
@@ -181,6 +182,14 @@ spec:
               containerPort: 8000
               protocol: TCP
           volumeMounts:
+            - name: nginx-conf
+              mountPath: /etc/nginx/conf.d
+            - name: nginx-lib
+              mountPath: /var/lib/nginx
+            - name: nginx-log
+              mountPath: /var/log/nginx
+            - name: nginx-run
+              mountPath: /run
             - name: neodb-data
               mountPath: /www/m
               subPath: m
@@ -337,6 +346,14 @@ spec:
 
       restartPolicy: Always
       volumes:
+        - name: nginx-conf
+          emptyDir: {}
+        - name: nginx-lib
+          emptyDir: {}
+        - name: nginx-log
+          emptyDir: {}
+        - name: nginx-run
+          emptyDir: {}
         - name: neodb-patch
           configMap:
             name: neodb-patch