From 57851bf43a9a412a10be91234027dc399a826f1f Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Sun, 25 Oct 2026 03:09:06 +0100
Subject: [PATCH] mbgwp: limit WordPress to its database, DNS and the internet

---
 mbgwp/networkpolicy.yaml | 87 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 mbgwp/networkpolicy.yaml

diff --git a/mbgwp/networkpolicy.yaml b/mbgwp/networkpolicy.yaml
new file mode 100644
index 0000000..3f14564
--- /dev/null
+++ b/mbgwp/networkpolicy.yaml
@@ -0,0 +1,87 @@
+# WordPress faces the internet, so if it is ever taken over it should only
+# reach its own database, DNS and the internet: not the LAN (NAS, router),
+# the Kubernetes API or other namespaces. Ingress comes from Envoy, the
+# mariadb-operator and the node itself (kubelet probes; 10.1.7.64 is the
+# node's Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr).
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector: {}
+    - from:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+        - ipBlock:
+            cidr: 10.1.7.64/32
+  egress:
+    - to:
+        - podSelector: {}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    # The internet, which includes this site's own public address
+    # (wp-cron's loopback requests go out and come back through Envoy).
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: wordpress-from-envoy
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: wordpress
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: envoy-gateway-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: envoy
+      ports:
+        - port: 8000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: mariadb-from-operator
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: mariadb
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: mariadb-system
+      ports:
+        - port: 3306