Both backups reach the Hetzner storage box over SSH; the TURN rotation and
Wiki.js reach rohana. Everything else is now refused for them.
Two separate policies rather than entries in egress-nur-intern, because a
policy's egress rules apply to every pod it selects: hanging the storage
box off the shared policy would hand it to fourteen workloads that have no
business there.
rohana is allowed as 10.0.0.3/32, not as its public address. The DNS
pointer from the previous commit sends the public name down the private
path, and the certificate is valid there - both measured after the change,
not assumed. So the group's one deliberate Gitea exception no longer leaves
the cluster at all.
Congruence checked before pushing, and this is the check worth keeping:
twenty names are excluded from the broad rule and exactly the same twenty
are covered by a narrow one. An entry on one side only would either cut a
workload off completely or leave the restriction inert, and neither is a
syntax error.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F2Q4Ri8NGwyTZzScvKnWFM
Thore CimbalandClaude Opus 5
0a7b8f4bf1