Container security hardening (phase 4) (#24140)

* Support read-only rootfs with self-signed certs in /config/tls

* Support read-only rootfs in s6 and pre-compile bytecode

* Assert read-only rootfs support in CI

* Document hardened read-only deployment

* keep certsync's cert selection identical to nginx's

* note the uid trade-off in user: mode

* fail fast when EXTRA_GROUPS or a missing media volume meets read_only

* keep nosuid and nodev on the /run tmpfs

* support read_only in the default mode

* don't take go2rtc down when the homekit file isn't writable

* lead with the hardware consequence of switching to user:

* refuse to write TLS material through a symlink as root

* note that memryx writes models to the root filesystem

* certsync watches whichever cert path nginx loaded

docker/main/rootfs/usr/local/go2rtc/prepare_homekit.py

@@ -66,7 +66,17 @@ def main() -> int:
     path = sys.argv[1]
     do_chown = "--chown" in sys.argv[2:]
 
-    fd = open_nofollow(path)
+    try:
+        fd = open_nofollow(path)
+    except PermissionError:
+        print(
+            f"[WARN] {path} is not writable by uid {os.geteuid()}, so HomeKit "
+            "pairing changes will not persist. It is owned by the go2rtc user "
+            "from an earlier run in the default mode. To fix, on the host run: "
+            f"chown {os.geteuid()}:{os.getegid()} <your config dir>/{os.path.basename(path)}"
+        )
+        return 0
+
     try:
         content = os.read(fd, MAX_BYTES).decode("utf-8", "replace")
         normalized = normalize(content)

docker/main/rootfs/usr/local/nginx/templates/listen.gotmpl

@@ -8,8 +8,8 @@ listen {{ .listen.internal }};
     listen {{ .listen.external }} ssl;
     {{ if .ipv6.enabled }}listen [::]:{{ .listen.external_port }} ssl;{{ end }}
 
-    ssl_certificate /etc/letsencrypt/live/frigate/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/frigate/privkey.pem;
+    ssl_certificate {{ .tls.cert_path }}/fullchain.pem;
+    ssl_certificate_key {{ .tls.cert_path }}/privkey.pem;
 
     # generated 2024-06-01, Mozilla Guideline v5.7, nginx 1.25.3, OpenSSL 1.1.1w, modern configuration, no OCSP
     # https://ssl-config.mozilla.org/#server=nginx&version=1.25.3&config=modern&openssl=1.1.1w&ocsp=false&guideline=5.7