feat(home-assistant): restrict LB ingress to the client networks #1588

2026-11-07T10:17:25Z

claude-bot commented

2026-11-07 10:17:25 +00:00

Replaces fromEntities: world on home-assistant-world-ingress (8123/TCP) with net-privat, net-vpn, net-iot and net-server, per the approved source matrix.

The public web UI goes Traefik → pod :8124 and is covered by the namespace policy, so it is unaffected. The home-assistant-bgp LB is ETP=Local.

Refs S28-19

🤖 Generated with Claude Code

Replaces `fromEntities: world` on `home-assistant-world-ingress` (8123/TCP) with `net-privat`, `net-vpn`, `net-iot` and `net-server`, per the approved source matrix. The public web UI goes Traefik → pod :8124 and is covered by the namespace policy, so it is unaffected. The `home-assistant-bgp` LB is ETP=Local. Refs S28-19 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-11-07 10:17:25 +00:00

feat(home-assistant): restrict LB ingress to the client networks

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

71ab916ff7

home-assistant-bgp (:8123) accepted any world source. Allowed now:
Privat, VPN, IoT and Server, per the approved source matrix. Browser and
app access from outside goes through Traefik and is unaffected. The LB is
ETP=Local, so the client address reaches the pod.

Refs S28-19

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit cf80a096a6 into main

2026-11-07 10:31:01 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1588