feat(shelly-manager): restrict firmware LB ingress to the IoT network #1587

2026-11-07T10:16:49Z

claude-bot commented

2026-11-07 10:16:49 +00:00

Replaces fromEntities: world on shelly-manager-firmware-world-ingress with cidrGroupRef: net-iot (8082/TCP, /fw/ only).

Over the last 7 days the firmware log shows downloads from IoT plus the workstation 10.2.50.101 and an old fd50:: address. Per the approved source matrix, only IoT stays allowed. The shelly-manager-firmware LB is ETP=Local.

Refs S28-19

🤖 Generated with Claude Code

Replaces `fromEntities: world` on `shelly-manager-firmware-world-ingress` with `cidrGroupRef: net-iot` (8082/TCP, `/fw/` only). Over the last 7 days the firmware log shows downloads from IoT plus the workstation 10.2.50.101 and an old fd50:: address. Per the approved source matrix, only IoT stays allowed. The `shelly-manager-firmware` LB is ETP=Local. Refs S28-19 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-11-07 10:16:50 +00:00

feat(shelly-manager): restrict firmware LB ingress to the IoT network

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

9aecaacbb2

shelly-manager-firmware (:8082, /fw/ only) accepted any world source.
Shelly devices live on IoT; the LB is ETP=Local, so the client address
reaches the pod.

Refs S28-19

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit 41e272f188 into main

2026-11-07 10:30:52 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1587