[abhichandra-v]

What

Non-breaking hardening + reliability for the Gotify deployment:

• Pin the image to gotify/server:2 instead of :latest, so a pod restart
  can't silently pull a new major version.
• Add resource requests/limits (CPU, memory, ephemeral-storage) — the pod
  currently has none, so one container can consume whatever the node has.
• Add liveness and readiness probes (liveness: TCP :80; readiness: HTTP
  /version on :80, which Gotify serves unauthenticated).
• Add a container securityContext: allowPrivilegeEscalation: false,
  all capabilities dropped with only NET_BIND_SERVICE added back (Gotify
  binds :80), and seccomp RuntimeDefault.

Why

Without probes, Kubernetes can't tell a wedged pod from a healthy one; without
limits a single pod can starve the node; and :latest makes "what's actually
running" ambiguous across restarts. The securityContext is defense-in-depth a
notification server doesn't need to give up.

Scope

Deliberately minimal and non-breaking. The Service, PVC, env, and data volume
are unchanged. I kept NET_BIND_SERVICE so the container can still bind :80,
and left readOnlyRootFilesystem, a non-root UID, and a NetworkPolicy out —
those depend on the image's runtime assumptions and your cluster's networking,
and are better as separate changes. The image is pinned, so imagePullPolicy
is intentionally left at the IfNotPresent default rather than Always.
Verified the manifest still parses.

[cyberops7]

The tag is the one thing holding this back. gotify/server:latest is 3.1.1 right now, so :2 would move existing installs back a major version to 2.9.1. That's not harmless: 3.0 changed how tokens are stored. In a quick test, an app token created on 3.1.1 was rejected with a 401 once the same data volume was started on 2.9.1.

Gotify publishes major-version tags, so gotify/server:3 with imagePullPolicy: Always seems like the right balance. It picks up fixes within 3.x and avoids the next breaking major. Without Always, each node keeps whatever 3.x build it pulled first, and the tag stops updating.

The rest checks out: Gotify ran fine with the dropped capabilities, no-new-privileges and the 128Mi limit, and /version serves the readiness probe without auth. Happy to merge after the tag change.