From dba75173fd18311542479861782ab78794744058 Mon Sep 17 00:00:00 2001
From: nyxerinys <nyxerinys5@gmail.com>
Date: Fri, 3 Jul 2026 08:20:43 -0500
Subject: [PATCH] try new settings

---
 modules/k3s/deployments/storage-combo.nix | 41 ++++++++++++-----------
 1 file changed, 22 insertions(+), 19 deletions(-)

diff --git a/modules/k3s/deployments/storage-combo.nix b/modules/k3s/deployments/storage-combo.nix
index 275ca12..ee4e17a 100644
--- a/modules/k3s/deployments/storage-combo.nix
+++ b/modules/k3s/deployments/storage-combo.nix
@@ -13,9 +13,10 @@
         template = {
           metadata = {
             labels.app = "storage-combo";
-            annotations."cdi.k8s.io/devices" = "cdi.nyxerinys.dev/fuse=rw";
+            annotations."cdi.k8s.io/cdi.nyxerinys.dev/fuse" = "rw";
           };
           spec = {
+            hostUsers = false;
             containers = [
               {
                 name = "storage-combo";
@@ -27,29 +28,31 @@
                     containerPort = 2222; 
                   }
                 ];
-                # volumeMounts = [
-                #   {
-                #     name = "fuse-device";
-                #     mountPath = "/dev/fuse";
-                #   }
-                # ];
+                volumeMounts = [
+                  {
+                    name = "fuse-device";
+                    mountPath = "/dev/fuse";
+                  }
+                ];
                 securityContext = {
+                  allowPrivilegeEscalation = true;
                   capabilities.add = ["SYS_ADMIN"];
-                  # privileged = false;
-                  # runAsUser = 0;
-                  # runAsGroup = 0;
+                  seccompProfile.type = "RuntimeDefault";
+                  runAsNonRoot = true;
+                  runAsUser = 1000;
+                  runAsGroup = 1000;
+                };
+              }
+            ];
+            volumes = [
+              {
+                name = "fuse-device";
+                hostPath = {
+                  path = "/dev/fuse";
+                  type = "CharDevice";
                 };
               }
             ];
-            # volumes = [
-            #   {
-            #     name = "fuse-device";
-            #     hostPath = {
-            #       path = "/dev/fuse";
-            #       type = "CharDevice";
-            #     };
-            #   }
-            # ];
           };
         };
       };