From 57514c3c1417ea7ba4b4529ce5f8f3f9253356fa Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Sun, 25 Oct 2026 03:12:02 +0100
Subject: [PATCH] immich: limit the pods to each other, DNS and the internet

---
 immich/networkpolicy.yaml | 102 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 102 insertions(+)
 create mode 100644 immich/networkpolicy.yaml

diff --git a/immich/networkpolicy.yaml b/immich/networkpolicy.yaml
new file mode 100644
index 0000000..325a93e
--- /dev/null
+++ b/immich/networkpolicy.yaml
@@ -0,0 +1,102 @@
+# immich faces the internet (every member of the group logs in, and shared
+# links are public), so its pods only reach each other, DNS and the
+# internet: not the LAN (NAS, router), the Kubernetes API or other
+# namespaces. The OIDC login with authentik goes out through its public
+# address. Ingress comes from Envoy, the CNPG operator and the node itself
+# (kubelet probes; 10.1.7.64 is the node's Calico VXLAN address,
+# projectcalico.org/IPv4VXLANTunnelAddr).
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector: {}
+    - from:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+        - ipBlock:
+            cidr: 10.1.7.64/32
+  egress:
+    - to:
+        - podSelector: {}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    # The internet: authentik's public address, the ML models from Hugging
+    # Face.
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: server-from-envoy
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: helm-immich
+      app.kubernetes.io/name: server
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: envoy-gateway-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: envoy
+      ports:
+        - port: 2283
+---
+# The CNPG operator checks each instance on its status port and connects to
+# PostgreSQL; the instance manager inside each pod watches its Cluster
+# through the API server (the node, port 16443).
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: postgres-cnpg
+spec:
+  podSelector:
+    matchExpressions:
+      - key: cnpg.io/cluster
+        operator: Exists
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: cnpg-system
+      ports:
+        - port: 8000
+        - port: 5432
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+      ports:
+        - port: 16443