homelab/kubernetes/infrastructure/network-policies/paperless-ns.yaml

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: paperless
spec:
  endpointSelector: {}
  ingress:
    # anchor: paperless-admit
    - fromEndpoints:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": paperless
    # traefik is intentionally NOT in this list. paperless's
    # URL-facing entry is the dedicated paperless-gate outpost in the
    # authentik namespace; traefik routes paperless.renner.uno to that
    # outpost via an ExternalName service, so the TCP connection
    # terminates in the authentik namespace and never opens into the
    # paperless namespace directly. Allowing traefik here would broaden
    # the trust boundary off the gate outpost — see
    # kubernetes/apps/paperless/network-policy.yaml for the
    # gate-specific ingress rule.
    #
    # Note: the database and monitoring allows below DO broaden the trust
    # boundary in the way this note warns about, because endpointSelector
    # is {} and therefore covers the paperless pod too. They are kept
    # because both are load-bearing — CNPG reaches the postgres cluster
    # from `database`, and the blackbox probe of
    # http://paperless.paperless.svc.cluster.local:80/accounts/login/
    # (kubernetes/apps/monitoring-rules/probes-blackbox.yaml#paperless-app-health)
    # runs from `monitoring`.
    # Scoping them to specific pods and ports is tracked in REN-28.
    # anchor: database-admit
    - fromEndpoints:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": database
    # anchor: monitoring-admit
    - fromEndpoints:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": monitoring
    # anchor: host-admit
    - fromEntities:
        - host
        - remote-node
    # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See
    # home-assistant-ns.yaml for the rationale.
    - fromEndpoints:
        - matchExpressions:
            - key: io.kubernetes.pod.namespace
              operator: Exists
      icmps:
        - fields:
            - { type: 0,   family: IPv4 }
            - { type: 3,   family: IPv4 }
            - { type: 8,   family: IPv4 }
            - { type: 11,  family: IPv4 }
            - { type: 12,  family: IPv4 }
            - { type: 1,   family: IPv6 }
            - { type: 2,   family: IPv6 }
            - { type: 3,   family: IPv6 }
            - { type: 4,   family: IPv6 }
            - { type: 128, family: IPv6 }
            - { type: 129, family: IPv6 }
            - { type: 133, family: IPv6 }
            - { type: 134, family: IPv6 }
            - { type: 135, family: IPv6 }
            - { type: 136, family: IPv6 }
            - { type: 143, family: IPv6 }
  egress:
    - toEndpoints:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": paperless
    - toEndpoints:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": authentik
    - toEndpoints:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": ingress
            app.kubernetes.io/name: traefik
    - toEndpoints:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": rook-ceph
    - toEndpoints:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
    - toEntities:
        - host
        - remote-node
        - world
    # ICMP — egress mirror.
    - toEndpoints:
        - matchExpressions:
            - key: io.kubernetes.pod.namespace
              operator: Exists
      icmps:
        - fields:
            - { type: 0,   family: IPv4 }
            - { type: 3,   family: IPv4 }
            - { type: 8,   family: IPv4 }
            - { type: 11,  family: IPv4 }
            - { type: 12,  family: IPv4 }
            - { type: 1,   family: IPv6 }
            - { type: 2,   family: IPv6 }
            - { type: 3,   family: IPv6 }
            - { type: 4,   family: IPv6 }
            - { type: 128, family: IPv6 }
            - { type: 129, family: IPv6 }
            - { type: 133, family: IPv6 }
            - { type: 134, family: IPv6 }
            - { type: 135, family: IPv6 }
            - { type: 136, family: IPv6 }
            - { type: 143, family: IPv6 }
---
# Allow FTP access (from scanners on the LAN) to the ftp-scanner pod.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-ftp-scanner
  namespace: paperless
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: ftp-scanner
  ingress:
    - fromEntities:
        - world
        - host
        - remote-node
      toPorts:
        - ports:
            - port: "21"
              protocol: TCP
            - port: "21100"
              protocol: TCP
            - port: "21101"
              protocol: TCP
            - port: "21102"
              protocol: TCP
            - port: "21103"
              protocol: TCP
            - port: "21104"
              protocol: TCP
---
# Allow Syncthing peer-to-peer sync from the LAN/world.
# - 22000 TCP+QUIC: actual sync traffic between peers.
# - 21027 UDP: local-discovery broadcast packets from peers on the LAN.
# UI (8384) is intentionally NOT listed — accessed via port-forward
# until an Ingress + Authentik gate is added.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-syncthing-sync
  namespace: paperless
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: syncthing
  ingress:
    - fromEntities:
        - world
        - host
        - remote-node
      toPorts:
        - ports:
            - port: "22000"
              protocol: TCP
            - port: "22000"
              protocol: UDP
            - port: "21027"
              protocol: UDP