jakman85andClaude Opus 5
f92707f38c
Lets the operator's Android / Linux / Windows / macOS devices dial in from anywhere and behave like LAN machines: full reach to 192.168.2.0/24 plus internet egress out the house WAN. Opposite direction to platform/vpn-egress, which sends pods OUT through PIA; the two share nothing but the word "VPN". WireGuard because it is the only option with a first-party client on all four named platforms, and because its handshake MAC is keyed with the responder's own public key: an unauthenticated packet gets NO reply, so udp/51820 is indistinguishable from a closed port. That, not "it is encrypted", is what makes an unfiltered WAN port defensible, and why there is no source allowlist. hostNetwork: true is REQUIRED, not convenient. A pod-networked server must SNAT clients to its own pod IP, so every remote client would carry that pod's Cilium identity -- and a pod-sourced request to the shared Gateway VIP returns 403 from Envoy for ALL 16 hostnames (measured 2026-10-04), because Cilium's Gateway preserves the original source identity and enforces the destination's ingress policy. The obvious build would have shipped a healthy-looking tunnel on which every cluster web UI was 403 and *.home.keithjackson.dev did not even resolve. In the host netns traffic is SNATed to the node and arrives as host/remote-node, exactly like a LAN client. It also sidesteps the unsafe ip_forward sysctl, the L2-announcement lease lottery, and double encapsulation (hence MTU 1420). Permitted by restrict-host-namespaces' own carve-out for platform namespaces. The cost is stated in networkpolicy.yaml rather than papered over: no NetworkPolicy constrains a hostNetwork pod. A DaemonSet so the hand-made WAN forward cannot be invalidated by a reschedule; all three nodes answer the same keys, so failover is a one-line router change. Peer PUBLIC keys are plaintext in peers.yaml, which makes "who can get into my house" a reviewable PR diff. The only secret -- the server's private key -- is an out-of-band Secret: an agent must not mint a long-lived private key, and the two halves are joined only at pod start into a tmpfs that dies with the pod. Ships INERT-BUT-HEALTHY with zero peers. THREE off-repo manual steps remain (kernel module, server key, WAN forward) -- runbooks/vpn-remote-access.md. Touches clusters/** , so ci/approval-policy.sh will block pending the operator's /approve-override. Deliberately not posted by me (CLAUDE.md §1). Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
27 lines
1.6 KiB
YAML
27 lines
1.6 KiB
YAML
---
|
|
# WireGuard REMOTE-ACCESS VPN (north-south INGRESS) — the counterpart to platform/vpn-egress.
|
|
#
|
|
# Do not confuse the two. They are opposite directions and share nothing but the word "VPN":
|
|
# * platform/vpn-egress — pods OUT to the internet through a PIA tunnel (ADR-0015, R-NET-05/06/07).
|
|
# * platform/vpn-ingress — remote CLIENTS IN from the internet to this LAN. THIS directory.
|
|
#
|
|
# NOTE: intentionally NOT homelab.keithjackson.dev/app-namespace=true. This is PLATFORM network
|
|
# infrastructure (like cilium / vpn-egress), not an application, so Kyverno does NOT generate the app
|
|
# default-deny baseline here and the app-scoped auth-mode / egress-class / host-namespace policies do
|
|
# not apply — every Kyverno policy in platform/kyverno/policies matches namespaceSelector
|
|
# app-namespace=true. THAT EXEMPTION IS LOAD-BEARING HERE, not incidental: this workload runs with
|
|
# `hostNetwork: true`, which `restrict-host-namespaces` forbids in an app namespace. It is permitted
|
|
# here by that policy's OWN stated carve-out — "platform components that do [need host namespaces] --
|
|
# e.g. Cilium, node-exporter -- live in platform namespaces that do NOT carry the app-namespace
|
|
# label, so they are out of scope". daemonset.yaml documents why hostNetwork is REQUIRED rather than
|
|
# convenient; it is the single most consequential decision in this component.
|
|
#
|
|
# NO `gateway-access` label. This component serves no HTTP and attaches no HTTPRoute to the shared
|
|
# Gateway — it is a raw UDP listener. There is deliberately nothing here for the L7 Gateway to route.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: vpn-ingress
|
|
labels:
|
|
app.kubernetes.io/name: vpn-ingress
|