diff --git a/authentik/networkpolicy.yaml b/authentik/networkpolicy.yaml
new file mode 100644
index 0000000..ecf167d
--- /dev/null
+++ b/authentik/networkpolicy.yaml
@@ -0,0 +1,137 @@
+# authentik faces the internet (the login for every member of the group),
+# so its pods only reach each other, DNS and the internet: not the LAN
+# (NAS, router) or other namespaces. Scouts Online, the apps' OIDC calls
+# and the LDAP outpost's connection to the server all use public
+# addresses. The worker and the CNPG instance manager also reach the API
+# server (the node, port 16443). Ingress comes from Envoy, the CNPG
+# operator, the node itself (kubelet probes; 10.1.7.64 is the node's
+# Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr), and for
+# the LDAP outpost from anywhere: Stalwart on node001 comes in through the
+# router and the ldap-outpost-external NodePort.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector: {}
+    - from:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+        - ipBlock:
+            cidr: 10.1.7.64/32
+  egress:
+    - to:
+        - podSelector: {}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: server-from-envoy
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/component: server
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: envoy-gateway-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: envoy
+      ports:
+        - port: 9000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ldap-outpost
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: authentik-outpost-ldap
+  policyTypes:
+    - Ingress
+  ingress:
+    - ports:
+        - port: 3389
+        - port: 6636
+---
+# The outpost controller deploys and updates the LDAP outpost.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: worker-to-api
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/component: worker
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+      ports:
+        - port: 16443
+---
+# The CNPG operator checks each instance on its status port and connects to
+# PostgreSQL; the instance manager inside each pod watches its Cluster
+# through the API server.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: postgres-cnpg
+spec:
+  podSelector:
+    matchExpressions:
+      - key: cnpg.io/cluster
+        operator: Exists
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: cnpg-system
+      ports:
+        - port: 8000
+        - port: 5432
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+      ports:
+        - port: 16443