From cbc538ec7d6c7de2cb7d82a43e28bff588befb7d Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Fri, 6 Nov 2026 15:54:41 +0100 Subject: [PATCH] feat(trmnl): restrict device HTTP ingress to the IoT network allow-device-http admitted world on 2345/TCP. The TRMNL panel lives on IoT (terminus log: GET /api/display from 10.2.30.244 every ~5 min) and terminus-device is ETP=Local, so the client address reaches the pod. Source is now net-iot; host/remote-node stay for probes. Depends on #1583 (CiliumCIDRGroup net-iot). Refs S28-19 Co-Authored-By: Claude Opus 5.5 --- .../infrastructure/network-policies/trmnl-ns.yaml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/kubernetes/infrastructure/network-policies/trmnl-ns.yaml b/kubernetes/infrastructure/network-policies/trmnl-ns.yaml index 9d00e05e..021f962a 100644 --- a/kubernetes/infrastructure/network-policies/trmnl-ns.yaml +++ b/kubernetes/infrastructure/network-policies/trmnl-ns.yaml @@ -62,9 +62,10 @@ spec: # CA, so this bypasses Traefik entirely and the namespace default-deny has # to be opened for it — same shape as paperless's allow-ftp-scanner. # -# Scoped to the terminus pods and port 2345 only. Requests still have to -# carry a known device MAC in the `ID` header plus its api_key; this rule -# opens the port, not the application. +# Scoped to the terminus pods, port 2345 and the IoT network (the panel's +# network; the LB is ETP=Local, so the client address reaches the pod). +# Requests still have to carry a known device MAC in the `ID` header plus +# its api_key; this rule opens the port, not the application. apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: @@ -75,8 +76,13 @@ spec: matchLabels: app.kubernetes.io/name: terminus ingress: + - fromCIDRSet: + - cidrGroupRef: net-iot + toPorts: + - ports: + - port: "2345" + protocol: TCP - fromEntities: - - world - host - remote-node toPorts: -- 2.54.0