feat(trmnl): restrict device HTTP ingress to the IoT network

allow-device-http admitted world on 2345/TCP. The TRMNL panel lives on
IoT (terminus log: GET /api/display from 10.2.30.244 every ~5 min) and
terminus-device is ETP=Local, so the client address reaches the pod.
Source is now net-iot; host/remote-node stay for probes.

Depends on #1583 (CiliumCIDRGroup net-iot).

Refs S28-19

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/docs/edge-host.md

@@ -164,7 +164,9 @@ role keeps logs off local flash and monitors wear:
 - **Docker logs to journald** (`docker-daemon.json`, `log-driver: journald`)
   instead of unbounded json files under `/var/lib/docker/containers`. Both
   compose services inherit it; `docker logs` still works.
-- **Grafana Alloy ships the journal to Loki** (`edge-alloy.service`). Its
+- **Grafana Alloy ships the journal to Loki** (`edge-alloy.service`, which
+  runs the upstream `grafana/alloy` image with `/run/log/journal` mounted
+  read-only; Arch's `grafana-alloy` package has no `loki.source.journal`). Its
   WAL/positions sit on `/run/alloy` (tmpfs), so the agent writes nothing to
   the eMMC either. Net effect: no log writes hit local flash — the trade-off
   is that logs are RAM-only and lost on reboot unless already shipped.

ansible/plays/install-edge-host.yml

@@ -34,6 +34,7 @@
   roles:
     - certificates
     - common
+    - pacman-cache
     - edge-flash-wear
     - docker-install
     - edge-log-shipper

ansible/roles/edge-log-shipper/defaults/main.yml

@@ -7,7 +7,9 @@
 
 edge_alloy_config_file: /etc/alloy/edge.alloy
 edge_alloy_http_port: 12345
-edge_alloy_bin: /usr/bin/grafana-alloy   # Arch `grafana-alloy` pkg names the binary this, not `alloy`
+# Upstream image: Arch's grafana-alloy 1.21 is built without
+# loki.source.journal. Renovate-tracked (customManagers in renovate.json).
+edge_alloy_image: grafana/alloy:v1.21.3@sha256:8ab871206bd2d8f89277f53abffee5f452a293980788d52f85fa183a87a505a4
 edge_loki_push_url: "https://loki.renner.uno/loki/api/v1/push"
 edge_loki_username: edge-1
 edge_alloy_labels:

ansible/roles/edge-log-shipper/tasks/main.yml

@@ -6,15 +6,18 @@
 # directly, so one journal source covers everything. Alloy s storage/WAL sits
 # on /run (tmpfs) so it does not write to flash either.
 
-- name: Install grafana-alloy
+# Alloy runs from the upstream image (see edge-alloy.service); the Arch package
+# lacks journal support.
+- name: Remove the grafana-alloy package
   ansible.builtin.package:
     name: grafana-alloy
-    state: present
+    state: absent
 
 - name: Create alloy system group
   ansible.builtin.group:
     name: alloy
     system: true
+  register: edge_alloy_group
 
 - name: Create alloy system user
   ansible.builtin.user:
@@ -24,6 +27,25 @@
     system: true
     create_home: false
     shell: /usr/bin/nologin
+  register: edge_alloy_user
+
+- name: Look up the systemd-journal group
+  ansible.builtin.getent:
+    database: group
+    key: systemd-journal
+
+- name: Set the container identity
+  ansible.builtin.set_fact:
+    edge_alloy_uid: "{{ edge_alloy_user.uid }}"
+    edge_alloy_gid: "{{ edge_alloy_group.gid }}"
+    edge_alloy_journal_gid: "{{ ansible_facts.getent_group['systemd-journal'][1] }}"
+
+- name: Pull the alloy image
+  ansible.builtin.command:
+    argv: [docker, pull, "{{ edge_alloy_image }}"]
+  register: edge_alloy_pull
+  changed_when: "'Downloaded newer image' in edge_alloy_pull.stdout"
+  notify: Restart alloy
 
 - name: Create alloy config directory
   ansible.builtin.file:

ansible/roles/edge-log-shipper/templates/edge-alloy.service.j2

@@ -1,32 +1,35 @@
 [Unit]
-Description=Grafana Alloy (edge-1 log shipper -> Loki)
+Description=Grafana Alloy (journal -> Loki)
 Documentation=https://grafana.com/docs/alloy/
-After=network-online.target
+After=docker.service network-online.target
+Requires=docker.service
 Wants=network-online.target
 
 [Service]
 Type=simple
-User=alloy
-Group=alloy
-# Read the (volatile) systemd journal.
-SupplementaryGroups=systemd-journal
-# WAL + positions on tmpfs so the agent never writes to the eMMC. %t is the
-# runtime dir root (/run); RuntimeDirectory creates /run/alloy owned by us.
-RuntimeDirectory=alloy
-ExecStart={{ edge_alloy_bin }} run \
+# WAL + positions on tmpfs so the agent never writes to the eMMC.
+ExecStartPre=/usr/bin/install -d -o alloy -g alloy -m 0750 /run/alloy
+ExecStartPre=-/usr/bin/docker rm -f edge-alloy
+# Attached run with --log-driver none: the container's output reaches the
+# journal once, through this unit.
+ExecStart=/usr/bin/docker run --rm --name edge-alloy \
+  --log-driver none \
+  --network host \
+  --user {{ edge_alloy_uid }}:{{ edge_alloy_gid }} \
+  --group-add {{ edge_alloy_journal_gid }} \
+  --read-only --tmpfs /tmp \
+  --cap-drop ALL --security-opt no-new-privileges \
+  -v /run/log/journal:/run/log/journal:ro \
+  -v /etc/machine-id:/etc/machine-id:ro \
+  -v {{ edge_alloy_config_file }}:/etc/alloy/config.alloy:ro \
+  -v /run/alloy:/var/lib/alloy \
+  {{ edge_alloy_image }} run \
   --server.http.listen-addr=127.0.0.1:{{ edge_alloy_http_port }} \
-  --storage.path=%t/alloy \
-  {{ edge_alloy_config_file }}
-ExecReload=/bin/kill -HUP $MAINPID
-Restart=on-failure
+  --storage.path=/var/lib/alloy \
+  /etc/alloy/config.alloy
+ExecStop=/usr/bin/docker stop edge-alloy
+Restart=always
 RestartSec=10s
-LimitNOFILE=65536
-
-# Hardening (bare metal, no LXC namespace limits here).
-NoNewPrivileges=yes
-ProtectSystem=strict
-ProtectHome=yes
-PrivateTmp=yes
 
 [Install]
 WantedBy=multi-user.target

ansible/roles/pacman-cache/files/pacman-cache.hook

@@ -0,0 +1,14 @@
+# Managed by ansible (roles/pacman-cache).
+# Downloaded packages are not kept; older versions come from the Arch Linux
+# Archive.
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Removing downloaded packages from the cache...
+When = PostTransaction
+Exec = /usr/bin/find /var/cache/pacman/pkg -mindepth 1 -delete

ansible/roles/pacman-cache/tasks/main.yml

@@ -0,0 +1,21 @@
+---
+# Keep the pacman package cache empty. pacman keeps every downloaded package;
+# on a 7 GB eMMC root the cache grows to gigabytes. Arch hosts only.
+
+- name: Ensure the pacman hook directory exists
+  ansible.builtin.file:
+    path: /etc/pacman.d/hooks
+    state: directory
+    mode: "0755"
+
+- name: Empty the package cache after every transaction
+  ansible.builtin.copy:
+    src: pacman-cache.hook
+    dest: /etc/pacman.d/hooks/pacman-cache.hook
+    mode: "0644"
+
+- name: Empty the package cache
+  ansible.builtin.command:
+    argv: [find, /var/cache/pacman/pkg, -mindepth, "1", -delete, -print]
+  register: pacman_cache_clean
+  changed_when: pacman_cache_clean.stdout | length > 0

kubernetes/infrastructure/network-policies/cidr-groups.yaml

@@ -0,0 +1,150 @@
+# Client networks as Cilium CIDR groups, referenced from CNPs via
+# fromCIDRSet.cidrGroupRef. ULA + IPv4 only: the ISP-delegated GUA prefixes
+# change and are not listed.
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-default
+spec:
+  externalCIDRs:
+    - fd00::/64
+    - 192.168.8.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-management
+spec:
+  externalCIDRs:
+    - fd02:10::/64
+    - 10.2.10.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-radius
+spec:
+  externalCIDRs:
+    - fd02:11::/64
+    - 10.2.11.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-video
+spec:
+  externalCIDRs:
+    - 10.2.20.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-iot
+spec:
+  externalCIDRs:
+    - fd02:30::/64
+    - 10.2.30.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-server
+spec:
+  externalCIDRs:
+    - fd02:40::/64
+    - fd40::/64
+    - 10.2.40.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-k8s-node
+spec:
+  externalCIDRs:
+    - fd02:46::/64
+    - 10.2.46.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-k8s-ingress
+spec:
+  externalCIDRs:
+    - fd02:47::/64
+    - 10.2.47.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-k8s-pod
+spec:
+  externalCIDRs:
+    - fd02:48::/64
+    - 10.2.48.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-privat
+spec:
+  externalCIDRs:
+    - fd02:50::/64
+    - 10.2.50.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-phone
+spec:
+  externalCIDRs:
+    - 10.2.60.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-access
+spec:
+  externalCIDRs:
+    - 10.2.70.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-vpn
+spec:
+  externalCIDRs:
+    - 10.2.80.0/24
+    - 192.168.32.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-guest
+spec:
+  externalCIDRs:
+    - 10.2.90.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-multi-transfer
+spec:
+  externalCIDRs:
+    - 10.2.122.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-multi-lan
+spec:
+  externalCIDRs:
+    - 10.2.123.0/24
+---
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: net-mutti
+spec:
+  externalCIDRs:
+    - 10.2.200.0/24

kubernetes/infrastructure/network-policies/kustomization.yaml

@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - cidr-groups.yaml
   - default-deny.yaml
   - allow-ingress.yaml
   - ingress-isolation.yaml

kubernetes/infrastructure/network-policies/trmnl-ns.yaml

@@ -62,9 +62,10 @@ spec:
 # CA, so this bypasses Traefik entirely and the namespace default-deny has
 # to be opened for it — same shape as paperless's allow-ftp-scanner.
 #
-# Scoped to the terminus pods and port 2345 only. Requests still have to
-# carry a known device MAC in the `ID` header plus its api_key; this rule
-# opens the port, not the application.
+# Scoped to the terminus pods, port 2345 and the IoT network (the panel's
+# network; the LB is ETP=Local, so the client address reaches the pod).
+# Requests still have to carry a known device MAC in the `ID` header plus
+# its api_key; this rule opens the port, not the application.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -75,8 +76,13 @@ spec:
     matchLabels:
       app.kubernetes.io/name: terminus
   ingress:
+    - fromCIDRSet:
+        - cidrGroupRef: net-iot
+      toPorts:
+        - ports:
+            - port: "2345"
+              protocol: TCP
     - fromEntities:
-        - world
         - host
         - remote-node
       toPorts: