---
# Default-deny baseline (R-NET-01): deny all ingress + egress, allow only DNS. `homepage` is a
# PLATFORM namespace so Kyverno does not auto-generate this — we ship it explicitly (defense in
# depth). Same shape as the Kyverno-generated app baseline. Cilium enforces the UNION of this
# NetworkPolicy and the CiliumNetworkPolicy below (allow if ANY policy allows).
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: homepage
  labels:
    homelab.keithjackson.dev/baseline: default-deny
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress: []
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
---
# Gateway ingress allow (R-NET-01/02): only the shared Gateway (the Cilium `ingress` entity) may
# reach Homepage, on its container port 3000. Homepage is a pure link dashboard — it makes NO
# outbound calls (bundled `mdi-*` icons, no service-status widgets), so DNS-only egress from the
# baseline above is sufficient and no egress CNP is added (minimal egress).
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: homepage-allow-gateway-ingress
  namespace: homepage
  labels:
    app.kubernetes.io/name: homepage
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: homepage
  ingress:
    - fromEntities:
        - ingress
      toPorts:
        - ports:
            - port: "3000"
              protocol: TCP