Thore Cimbal
32e2c8e556
Auto-Deploy on Push / verify-and-notify (push) Successful in 53s
Synapse's own media-scanning module (Issue #19) can never see E2EE attachment content - a structural limit, not a bug. This adds a small standalone HTTP wrapper around the same ClamAV instance, reachable from browser JS at /_scan, so the ThreadNet-Web client fork can scan plaintext both before encrypting/uploading and after downloading/ decrypting - covering both directions regardless of room encryption. Auth via Synapse's own /whoami endpoint, no separate auth system.
362 lines
9.8 KiB
YAML
362 lines
9.8 KiB
YAML
# Default-deny ingress for the matrix namespace, with explicit allow rules per component.
|
|
# Egress is intentionally untouched (federation to arbitrary Matrix servers, ACME, SMTP,
|
|
# DNS all stay unrestricted).
|
|
#
|
|
# Lesson learned deploying the authentik namespace's equivalent policy: NetworkPolicy
|
|
# filters on the pod's actual container port, not the Service's external port (e.g.
|
|
# authentik-server's Service maps 80->9000). Wherever a Service here uses a *named*
|
|
# targetPort, this file references that name directly instead of guessing a number -
|
|
# Kubernetes resolves it from the pod spec, which is safer than a hardcoded port.
|
|
#
|
|
# matrix-stack-postgres already effectively has no dedicated chart NetworkPolicy of its
|
|
# own (unlike authentik-postgresql's Bitnami one) - the rules below are the only gate.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default-deny-ingress
|
|
namespace: matrix
|
|
spec:
|
|
podSelector: {}
|
|
policyTypes:
|
|
- Ingress
|
|
---
|
|
# axion1337.chat (root) -> Element Web
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-element-web
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: element-web
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: element
|
|
---
|
|
# admin.axion1337.chat -> Element Admin
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-element-admin
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: element-admin
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: http
|
|
---
|
|
# axion1337.chat/docs/setup -> Element desktop setup docs (our own nginx)
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-element-web-docs
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: element-web-docs
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8080
|
|
---
|
|
# matrix.axion1337.chat AND the well-known delegation both front through haproxy
|
|
# (matrix-stack-synapse and matrix-stack-well-known Services both target haproxy's
|
|
# named ports, not synapse-main directly).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-haproxy
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: haproxy
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: haproxy-synapse
|
|
- protocol: TCP
|
|
port: haproxy-403
|
|
- protocol: TCP
|
|
port: haproxy-wkd
|
|
# Draupnir (Issue #18) calls Synapse's client-server API directly, in-namespace -
|
|
# without this it would be silently blocked by the default-deny policy.
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: draupnir
|
|
ports:
|
|
- protocol: TCP
|
|
port: haproxy-synapse
|
|
# Client-Scan-Dienst (Issue #19-Erweiterung) validiert Access-Tokens gegen Synapses
|
|
# eigenen /whoami-Endpoint statt eine eigene Auth zu bauen.
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: clamav-http-scanner
|
|
ports:
|
|
- protocol: TCP
|
|
port: haproxy-synapse
|
|
---
|
|
# account.axion1337.chat (Traefik) + matrix.axion1337.chat (also routes to MAS for some
|
|
# paths) + synapse-main calling MAS's internal port for session/token introspection.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-mas
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: matrix-authentication-service
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: synapse-main
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8080
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: synapse-main
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8081
|
|
---
|
|
# Synapse itself: reached via haproxy (same namespace), calls from MAS (provisioning),
|
|
# metrics scraped by Alloy (monitoring namespace).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-synapse
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: synapse-main
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: haproxy
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: matrix-authentication-service
|
|
ports:
|
|
- protocol: TCP
|
|
port: synapse-http
|
|
- protocol: TCP
|
|
port: synapse-health
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: monitoring
|
|
ports:
|
|
- protocol: TCP
|
|
port: synapse-metrics
|
|
---
|
|
# mrtc.axion1337.chat (Traefik) for the auth handshake, plus Alloy scraping metrics.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-rtc-authorisation-service
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: matrix-rtc-authorisation-service
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: matrix-rtc-sfu
|
|
ports:
|
|
- protocol: TCP
|
|
port: http
|
|
---
|
|
# The SFU: mrtc.axion1337.chat (Traefik) for signalling, Alloy for metrics, and the
|
|
# NodePort-exposed WebRTC media ports need to stay open to the internet by design -
|
|
# that's the actual point of a TURN/SFU media relay, not a mistake.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-rtc-sfu
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: matrix-rtc-sfu
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: http
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: monitoring
|
|
ports:
|
|
- protocol: TCP
|
|
port: metrics
|
|
- from:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
ports:
|
|
- protocol: TCP
|
|
port: 30001
|
|
- protocol: UDP
|
|
port: 30002
|
|
---
|
|
# Postgres: only Synapse and MAS need data access; Alloy scrapes the exporter.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-postgres
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: postgres
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: synapse-main
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: matrix-authentication-service
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: synapse-backup
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: monitoring
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9187
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-acme-solver
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
acme.cert-manager.io/http01-solver: "true"
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8089
|
|
|
|
# Note: coturn runs with hostNetwork: true, so NetworkPolicy does not apply to it at all -
|
|
# it's already gated by the Hetzner Cloud Firewall instead. Nothing to write here.
|
|
---
|
|
# ClamAV (Issue #19): only Synapse's check_media_file_for_spam module calls this, over
|
|
# clamd's plain TCP protocol on port 3310. Nothing else needs to reach it.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-clamav
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: clamav
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: synapse-main
|
|
# Client-seitiger Scan-Dienst (Issue #19-Erweiterung) braucht denselben ClamAV.
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: clamav-http-scanner
|
|
ports:
|
|
- protocol: TCP
|
|
port: clamd
|
|
---
|
|
# axion1337.chat/_scan (Traefik) - client-seitiger Scan-Dienst, direkt vom Browser aufgerufen.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-ingress-clamav-http-scanner
|
|
namespace: matrix
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: clamav-http-scanner
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
ports:
|
|
- protocol: TCP
|
|
port: http
|