feat: improve security and stability for Vaultwarden and CodiMD

Security:
- Move Vaultwarden ADMIN_TOKEN to Secret (was plaintext)
- Remove root user execution from CodiMD (runAsUser: 0)
- Use fixed image versions instead of latest tag

Stability:
- Add liveness/readiness probes to Vaultwarden, CodiMD, CodiMD DB
- Add resource requests/limits to all services
- Set appropriate memory/CPU constraints

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/codimd/manifests/03-codimd-db-deployment.yaml

@@ -17,6 +17,13 @@ spec:
       containers:
         - name: postgres
           image: postgres:17-alpine
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
           env:
             - name: POSTGRES_USER
               value: "codimd"
@@ -29,6 +36,27 @@ spec:
                   key: POSTGRES_PASSWORD
             - name: PGDATA
               value: "/var/lib/postgresql/data/pgdata"
+          # Health check
+          livenessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -d "$POSTGRES_DB" -U "$POSTGRES_USER"
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - pg_isready -d "$POSTGRES_DB" -U "$POSTGRES_USER"
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
           volumeMounts:
             - mountPath: "/var/lib/postgresql/data"
               name: db-data

apps/codimd/manifests/05-codimd-app-deployment.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   replicas: 1
   strategy:
-    type: Recreate 
+    type: Recreate
   selector:
     matchLabels:
       app: codimd
@@ -14,12 +14,16 @@ spec:
       labels:
         app: codimd
     spec:
-      securityContext:      # <-- 這裡開始
-        runAsUser: 0
-        fsGroup: 0          # <-- 結束
       containers:
         - name: codimd
-          image: hackmdio/hackmd:latest
+          image: hackmdio/hackmd:2.5.3-alpine
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
           env:
             - name: CMD_DB_URL
               valueFrom:
@@ -34,6 +38,23 @@ spec:
               value: "true"
             - name: CMD_CSP_ENABLE
               value: "false"
+          # Health check (CodiMD has /healthz endpoint)
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 3000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
           volumeMounts:
             - mountPath: "/home/hackmd/app/public/uploads"
               name: upload-data