feat(trmnl): restrict device HTTP ingress to the IoT network

allow-device-http admitted world on 2345/TCP. The TRMNL panel lives on IoT (terminus log: GET /api/display from 10.2.30.244 every ~5 min) and terminus-device is ETP=Local, so the client address reaches the pod. Source is now net-iot; host/remote-node stay for probes. Depends on #1583 (CiliumCIDRGroup net-iot). Refs S28-19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 15:54:41 +01:00
3 changed files with 31 additions and 17 deletions
@@ -49,11 +49,20 @@ edge-1.iot.renner.uno
 zwave_gateway
 heating_can

-# NTP servers: every edge host (edge-1 BACKUP prio 70, edge-2 BACKUP prio 60;
-# see the ntp_servers map in plays/install-ntp-ha.yml). Talos nodes cannot run
-# chrony or keepalived. The jupiter/saturn/neptune entries in that map
-# describe retired PVE hosts. See plays/install-ntp-ha.yml for why keepalived
-# is scoped more narrowly than chrony within this group.
+# NTP servers. edge-1 was added here so the role would survive the PVE hosts
+# being retired for bare-metal Talos, which cannot run chrony or keepalived
+# itself. That retirement has now happened, so edge-1 is the ONLY member.
+#
+# THIS IS NO LONGER HIGHLY AVAILABLE. The group was jupiter (MASTER, prio 100),
+# saturn (90), neptune (80) and edge-1 (BACKUP, 70); the first three are gone.
+# A single VRRP member takes the address regardless of its configured state, so
+# the service address is still served, but by one thin client with
+# no failover behind it. install-ntp-ha.yml still carries the four-host
+# ntp_servers priority map, which now describes hosts that do not exist.
+#
+# Restoring redundancy needs a second chrony host that is not a Talos node.
+# See plays/install-ntp-ha.yml for why keepalived is scoped more narrowly than
+# chrony within this group.
 [ntp_cluster:children]
 edge_host

@@ -62,9 +62,10 @@ spec:
 # CA, so this bypasses Traefik entirely and the namespace default-deny has
 # to be opened for it — same shape as paperless's allow-ftp-scanner.
 #
-# Scoped to the terminus pods and port 2345 only. Requests still have to
-# carry a known device MAC in the `ID` header plus its api_key; this rule
-# opens the port, not the application.
+# Scoped to the terminus pods, port 2345 and the IoT network (the panel's
+# network; the LB is ETP=Local, so the client address reaches the pod).
+# Requests still have to carry a known device MAC in the `ID` header plus
+# its api_key; this rule opens the port, not the application.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy
 metadata:
@@ -75,8 +76,13 @@ spec:
    matchLabels:
      app.kubernetes.io/name: terminus
  ingress:
+    - fromCIDRSet:
+        - cidrGroupRef: net-iot
+      toPorts:
+        - ports:
+            - port: "2345"
+              protocol: TCP
    - fromEntities:
-        - world
        - host
        - remote-node
      toPorts:
@@ -68,14 +68,13 @@ locals {
  # idx is a static per-network slot for rule_index derivation — never
  # reuse a freed idx for a new network.
  #
-  # Deliberately absent: (40) Server idx=4, (49) k8s Ceph idx=6,
-  # (46) k8s Node, (47) k8s Ingress and (48) k8s Pod. The cluster nodes
-  # have interfaces on those VLANs (mgmt0, node0, ingress0, pod0), so a
-  # DNATed flow's reply would go directly over the shared L2 and bypass
-  # the UDM's conntrack (asymmetric, connection drops) — and clients there
-  # are the nodes themselves, whose DNS chain (CoreDNS -> k8s_gateway)
-  # already resolves the public names in-cluster. idx=5 stays reserved
-  # (its network, (42) Ingress, no longer exists).
+  # Deliberately absent: (40) Server idx=4, (42) Ingress idx=5, and
+  # (49) k8s Ceph idx=6. The cluster nodes have interfaces on those VLANs,
+  # so a DNATed flow's reply would go directly over the shared L2 and
+  # bypass the UDM's conntrack (asymmetric, connection drops) — and
+  # clients there are the nodes themselves, whose DNS chain (CoreDNS ->
+  # k8s_gateway) already resolves the public names in-cluster. Their idx
+  # slots stay reserved.
  hairpin_networks = {
    "Default"              = { id = "5d4fba77ce63ee614841d53d", idx = 0 }
    "(10) Management"      = { id = "600334abf9ee0c059da6be8f", idx = 1 }