feat(trmnl): restrict device HTTP ingress to the IoT network

allow-device-http admitted world on 2345/TCP. The TRMNL panel lives on IoT (terminus log: GET /api/display from 10.2.30.244 every ~5 min) and terminus-device is ETP=Local, so the client address reaches the pod. Source is now net-iot; host/remote-node stay for probes. Depends on #1583 (CiliumCIDRGroup net-iot). Refs S28-19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 15:54:41 +01:00
1 changed files with 10 additions and 4 deletions
@@ -62,9 +62,10 @@ spec:
 # CA, so this bypasses Traefik entirely and the namespace default-deny has
 # to be opened for it — same shape as paperless's allow-ftp-scanner.
 #
-# Scoped to the terminus pods and port 2345 only. Requests still have to
-# carry a known device MAC in the `ID` header plus its api_key; this rule
-# opens the port, not the application.
+# Scoped to the terminus pods, port 2345 and the IoT network (the panel's
+# network; the LB is ETP=Local, so the client address reaches the pod).
+# Requests still have to carry a known device MAC in the `ID` header plus
+# its api_key; this rule opens the port, not the application.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -75,8 +76,13 @@ spec:
    matchLabels:
      app.kubernetes.io/name: terminus
  ingress:
+    - fromCIDRSet:
+        - cidrGroupRef: net-iot
+      toPorts:
+        - ports:
+            - port: "2345"
+              protocol: TCP
    - fromEntities:
-        - world
        - host
        - remote-node
      toPorts: