Feat: Add configurable media volume support

[nareddyt]

Overview

Following up on the startup permissions fix (#46), this PR adds support for a configurable media volume to handle file/image uploads to /opt/traccar/media.

• Adds a new media volume configuration block in values.yaml (disabled by default) to allow mounting a PVC or other storage volume.
• Automatically default-injects podSecurityContext.fsGroup to match the container's runAsUser (typically 1000) if media.enabled is true (unless custom fsGroup is defined), ensuring the directory is writeable without manual troubleshooting.
• Includes comments in values.yaml documenting PVC and emptyDir configuration options.

Testing Done

Verified in my self-hosted deployment that device images are successfully uploaded and persisted across pod restarts.

[tananaev]

Why is this configuration much more complicated and different than overrides?

[nareddyt]

Why is this configuration much more complicated and different than overrides?

The main complicated part is this, right?

      {{- $podSec := .Values.podSecurityContext }}
      {{- if and .Values.media.enabled (not .Values.podSecurityContext.fsGroup) .Values.securityContext.runAsUser }}
        {{- $podSec = merge (dict "fsGroup" .Values.securityContext.runAsUser) .Values.podSecurityContext }}
      {{- end }}
      {{- if not (empty $podSec) }}

It is needed to support read-write volumes. Because traccar docker container ships with root user by default, but this chart overrides it to non-root by default -

traccar-helm/charts/traccar/values.yaml

Lines 165 to 166 in 0a2d976

	runAsNonRoot: true
	runAsUser: 1000

- we add this helm templating to properly set the fsGroup with the same non-root user. Without out, the non-root user will try to write files to the volume which is owned by root, resulting in the same permission denied error.

This complication was not needed for web override because that is read-only, not read-write.

[tananaev]

Wait, why is it not needed for web override?

[nareddyt]

Wait, why is it not needed for web override?

Web override is read only, and we do emptyDir by default, which has 777 permissions

[tananaev]

Web override is NOT readonly!