From 570c93559ba02c019146788f15bdef8bbb8780c7 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sat, 7 Nov 2026 11:18:11 +0100 Subject: [PATCH] feat(paperless): restrict FTP and Syncthing LB ingress to their client networks ftp-scanner and syncthing-sync accepted any world source. - ftp-scanner: IoT and Privat. Over the last 7 days the vsftpd log shows uploads from the BR5C scanner via fd02:30:: and the Brother via 10.2.50.170. - syncthing-sync: Privat and VPN. Over the last 7 days peers connected from 10.2.50.0/24 and fd02:50::/64. host and remote-node stay allowed. Both LBs are ETP=Local. Refs S28-19 Co-Authored-By: Claude Opus 5.5 --- .../network-policies/paperless-ns.yaml | 34 ++++++++++++++++--- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/kubernetes/infrastructure/network-policies/paperless-ns.yaml b/kubernetes/infrastructure/network-policies/paperless-ns.yaml index 7cde08a4..7ae39ce9 100644 --- a/kubernetes/infrastructure/network-policies/paperless-ns.yaml +++ b/kubernetes/infrastructure/network-policies/paperless-ns.yaml @@ -112,7 +112,7 @@ spec: - { type: 136, family: IPv6 } - { type: 143, family: IPv6 } --- -# Allow FTP access (from scanners on the LAN) to the ftp-scanner pod. +# FTP from the scanners (IoT and Privat) to the ftp-scanner pod. apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: @@ -123,8 +123,24 @@ spec: matchLabels: app.kubernetes.io/name: ftp-scanner ingress: + - fromCIDRSet: + - cidrGroupRef: net-iot + - cidrGroupRef: net-privat + toPorts: + - ports: + - port: "21" + protocol: TCP + - port: "21100" + protocol: TCP + - port: "21101" + protocol: TCP + - port: "21102" + protocol: TCP + - port: "21103" + protocol: TCP + - port: "21104" + protocol: TCP - fromEntities: - - world - host - remote-node toPorts: @@ -142,7 +158,7 @@ spec: - port: "21104" protocol: TCP --- -# Allow Syncthing peer-to-peer sync from the LAN/world. +# Allow Syncthing peer-to-peer sync from Privat and VPN. # - 22000 TCP+QUIC: actual sync traffic between peers. # - 21027 UDP: local-discovery broadcast packets from peers on the LAN. # UI (8384) is intentionally NOT listed — authentik-gate-sync generates the @@ -157,8 +173,18 @@ spec: matchLabels: app.kubernetes.io/name: syncthing ingress: + - fromCIDRSet: + - cidrGroupRef: net-privat + - cidrGroupRef: net-vpn + toPorts: + - ports: + - port: "22000" + protocol: TCP + - port: "22000" + protocol: UDP + - port: "21027" + protocol: UDP - fromEntities: - - world - host - remote-node toPorts: -- 2.54.0