feat(paperless): restrict FTP and Syncthing LB ingress to their client networks

ftp-scanner and syncthing-sync accepted any world source. - ftp-scanner: IoT and Privat. Over the last 7 days the vsftpd log shows uploads from the BR5C scanner via fd02:30:: and the Brother via 10.2.50.170. - syncthing-sync: Privat and VPN. Over the last 7 days peers connected from 10.2.50.0/24 and fd02:50::/64. host and remote-node stay allowed. Both LBs are ETP=Local. Refs S28-19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-07 11:18:11 +01:00
2 changed files with 42 additions and 11 deletions
@@ -1,6 +1,13 @@
-# Syslog senders reaching the alloy-syslog LB (ETP=Local, client address
-# reaches the pod): network gear on Management, the SLZB coordinators on
-# IoT, and the UDM itself, which sources from its k8s-ingress address.
+# Targeted carve-out: alloy-syslog needs world ingress on the syslog
+# ports specifically. The Service is ETP=Cluster, so external syslog
+# senders (Proxmox, LXC hosts, network gear) hit the LB IP, get DNAT'd
+# to an alloy pod, and get SNAT'd to the receiving node's cilium_host
+# address. Cilium then sees the source as `world-ipv4` identity (the
+# cilium_host IP isn't a known endpoint), NOT `host` — so the broad
+# monitoring CNP's `fromEntities: host` rule doesn't catch it.
+#
+# Scoped via endpointSelector so this only widens ingress on the
+# alloy-syslog pod, not the whole namespace.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -12,10 +19,8 @@ spec:
      app.kubernetes.io/instance: alloy-syslog
      app.kubernetes.io/name: alloy
  ingress:
-    - fromCIDRSet:
-        - cidrGroupRef: net-management
-        - cidrGroupRef: net-iot
-        - cidrGroupRef: net-k8s-ingress
+    - fromEntities:
+        - world
      toPorts:
        - ports:
            - port: "514"
@@ -112,7 +112,7 @@ spec:
            - { type: 136, family: IPv6 }
            - { type: 143, family: IPv6 }
 ---
-# Allow FTP access (from scanners on the LAN) to the ftp-scanner pod.
+# FTP from the scanners (IoT and Privat) to the ftp-scanner pod.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -123,8 +123,24 @@ spec:
    matchLabels:
      app.kubernetes.io/name: ftp-scanner
  ingress:
+    - fromCIDRSet:
+        - cidrGroupRef: net-iot
+        - cidrGroupRef: net-privat
+      toPorts:
+        - ports:
+            - port: "21"
+              protocol: TCP
+            - port: "21100"
+              protocol: TCP
+            - port: "21101"
+              protocol: TCP
+            - port: "21102"
+              protocol: TCP
+            - port: "21103"
+              protocol: TCP
+            - port: "21104"
+              protocol: TCP
    - fromEntities:
-        - world
        - host
        - remote-node
      toPorts:
@@ -142,7 +158,7 @@ spec:
            - port: "21104"
              protocol: TCP
 ---
-# Allow Syncthing peer-to-peer sync from the LAN/world.
+# Allow Syncthing peer-to-peer sync from Privat and VPN.
 # - 22000 TCP+QUIC: actual sync traffic between peers.
 # - 21027 UDP: local-discovery broadcast packets from peers on the LAN.
 # UI (8384) is intentionally NOT listed — authentik-gate-sync generates the
@@ -157,8 +173,18 @@ spec:
    matchLabels:
      app.kubernetes.io/name: syncthing
  ingress:
+    - fromCIDRSet:
+        - cidrGroupRef: net-privat
+        - cidrGroupRef: net-vpn
+      toPorts:
+        - ports:
+            - port: "22000"
+              protocol: TCP
+            - port: "22000"
+              protocol: UDP
+            - port: "21027"
+              protocol: UDP
    - fromEntities:
-        - world
        - host
        - remote-node
      toPorts: