0 Fork 0

Files

T

jakman85 7e8ae472c9 fix(net): renderer emits world/internet egress allow per egress class + fix jackett/plex tags

Root cause the media stack surfaced: the default-deny baseline is DNS-only egress (correct for
R-NET-01 east-west), but the egress CLASS (internet/vpn) had no policy ALLOWING north-south
egress — so qbittorrent/sonarr/radarr couldn't reach the internet at all (VPN downloaders
broken). Add an additive per-app CiliumNetworkPolicy '<app>-allow-internet-egress' with
toEntities:[world] (non-cluster); the egress-class steering + kill-switch (ADR-0015) govern the
PATH (internet=WAN, vpn=tun0). East-west stays denied except declared dependencies; R-NET-01
baseline unchanged. Re-rendered all apps + regenerated L1 goldens. Also fixed jackett + plex
image tags (bad pins -> :latest; Renovate/update policy pins later).

2026-08-25 09:02:05 -05:00

gitea.yaml

fix(net): renderer emits world/internet egress allow per egress class + fix jackett/plex tags

2026-08-25 09:02:05 -05:00

jackett.yaml

fix(net): renderer emits world/internet egress allow per egress class + fix jackett/plex tags

2026-08-25 09:02:05 -05:00

kustomization.yaml

Merge feature/onboard-arr: Sonarr + Radarr (VPN + arr->downloader allows)

2026-08-25 08:45:56 -05:00

pihole.yaml

fix(net): renderer emits world/internet egress allow per egress class + fix jackett/plex tags