From 6d30c0f3e0c70342608d4beddd9cff4315b5267b Mon Sep 17 00:00:00 2001
From: chemavx <chemavx@git.chemavx.xyz>
Date: Wed, 17 Jun 2026 10:40:07 +0000
Subject: [PATCH] fix(ghost-en): stage redirects via initContainer, not
 read-only mount

A ConfigMap volume is read-only at the FS level, so the Ghost entrypoint's
chown -R on content/ failed ("Read-only file system") and crash-looped.
Copy redirects.yaml onto the writable PVC with an initContainer instead;
still GitOps-sourced and refreshed on every pod start.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 ghost-en/deployment.yaml | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/ghost-en/deployment.yaml b/ghost-en/deployment.yaml
index 1b0b831..a7f36df 100644
--- a/ghost-en/deployment.yaml
+++ b/ghost-en/deployment.yaml
@@ -41,6 +41,24 @@ spec:
       labels:
         app: ghost-en
     spec:
+      # Stage the GitOps-managed redirects file onto the writable content PVC.
+      # A ConfigMap volume is always read-only at the FS level, so the Ghost
+      # entrypoint's `chown -R` on content/ fails ("Read-only file system").
+      # Copying via an initContainer leaves a normal, chownable file on the PVC,
+      # refreshed from the ConfigMap (git source of truth) on every pod start.
+      initContainers:
+        - name: install-redirects
+          image: ghost:5-alpine
+          command:
+            - sh
+            - -c
+            - "mkdir -p /var/lib/ghost/content/data && cp /redirects-src/redirects.yaml /var/lib/ghost/content/data/redirects.yaml"
+          volumeMounts:
+            - name: ghost-en-content
+              mountPath: /var/lib/ghost/content
+            - name: redirects
+              mountPath: /redirects-src
+              readOnly: true
       containers:
         - name: ghost
           image: ghost:5-alpine
@@ -101,12 +119,6 @@ spec:
           volumeMounts:
             - name: ghost-en-content
               mountPath: /var/lib/ghost/content
-            # Custom redirects, GitOps-managed via the ghost-en-redirects ConfigMap.
-            # Nested read-only file mount inside the content PVC's data dir.
-            - name: redirects
-              mountPath: /var/lib/ghost/content/data/redirects.yaml
-              subPath: redirects.yaml
-              readOnly: true
       volumes:
         - name: ghost-en-content
           persistentVolumeClaim: