default: deny all, through a folder app of its own

actual-budget/networkpolicy.yaml

@@ -55,29 +55,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

apps/templates/cloudnative-pg-folder.yaml

@@ -0,0 +1,19 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cloudnative-pg-folder
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/rubenhensen/k8scd.git
+    targetRevision: HEAD
+    path: cloudnative-pg
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cnpg-system
+  syncPolicy:
+    automated:
+      selfHeal: true

apps/templates/default-folder.yaml

@@ -0,0 +1,19 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: default-folder
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/rubenhensen/k8scd.git
+    targetRevision: HEAD
+    path: default
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+  syncPolicy:
+    automated:
+      selfHeal: true

apps/templates/external-secrets-folder.yaml

@@ -0,0 +1,19 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets-folder
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/rubenhensen/k8scd.git
+    targetRevision: HEAD
+    path: external-secrets
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    automated:
+      selfHeal: true

apps/templates/plugin-barman-cloud-helm.yaml

@@ -1,32 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: plugin-barman-cloud
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    chart: plugin-barman-cloud
-    repoURL: https://cloudnative-pg.github.io/charts
-    targetRevision: 0.8.1
-    helm:
-      values: |
-        # CNPG's barman cloud plugin, which backs the PostgreSQL clusters
-        # up to Garage on the NAS (authentik/postgresql-backup.yaml,
-        # immich/postgresql-backup.yaml). It has to run in the operator's
-        # namespace; the chart gets its TLS certificates from cert-manager.
-        resources:
-          requests:
-            cpu: 10m
-            memory: 64Mi
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: cnpg-system
-  syncPolicy:
-    syncOptions:
-    - ServerSideApply=true
-    automated:
-      prune: true
-      selfHeal: true

authentik/networkpolicy.yaml

@@ -108,8 +108,7 @@ spec:
 ---
 # The CNPG operator checks each instance on its status port and connects to
 # PostgreSQL; the instance manager inside each pod watches its Cluster
-# through the API server. The barman cloud sidecar sends the WAL and the
-# base backups to Garage on the NAS (postgresql-backup.yaml).
+# through the API server.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -136,34 +135,3 @@ spec:
             cidr: 192.168.1.204/32
       ports:
         - port: 16443
-    - to:
-        - ipBlock:
-            cidr: 192.168.1.99/32
-      ports:
-        - port: 3900
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

authentik/postgresql-backup.yaml

@@ -1,92 +0,0 @@
-# Backups of authentik's database by CNPG itself, through the barman cloud
-# plugin (apps/templates/plugin-barman-cloud-helm.yaml): a base backup every
-# night, and every WAL segment as soon as it is full or 5 minutes old
-# (archive_timeout). Both go to the bucket cnpg-authentik in Garage on the
-# NAS (nas/garage), so the database can be restored to any moment of the
-# last 30 days. Velero copies the data directory while PostgreSQL runs,
-# which is not a consistent copy.
-# The key is Garage's cnpg-authentik, in Vault as kv/cnpg-authentik-s3; it
-# can only reach this bucket.
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: authentik-postgres-s3
-spec:
-  secretStoreRef:
-    name: vault-backend
-    kind: ClusterSecretStore
-  refreshInterval: 15m
-  target:
-    name: authentik-postgres-s3
-    creationPolicy: Owner
-    template:
-      engineVersion: v2
-      data:
-        ACCESS_KEY_ID: "{{ .access_key_id }}"
-        ACCESS_SECRET_KEY: "{{ .secret_access_key }}"
-        # Garage rejects requests signed for another region
-        REGION: garage
-  data:
-    - secretKey: access_key_id
-      remoteRef:
-        key: kv/cnpg-authentik-s3
-        property: access_key_id
-    - secretKey: secret_access_key
-      remoteRef:
-        key: kv/cnpg-authentik-s3
-        property: secret_access_key
----
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: authentik-postgres
-  annotations:
-    # The CRD comes with the plugin's own app
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  retentionPolicy: 30d
-  configuration:
-    destinationPath: s3://cnpg-authentik/
-    endpointURL: http://192.168.1.99:3900
-    s3Credentials:
-      accessKeyId:
-        name: authentik-postgres-s3
-        key: ACCESS_KEY_ID
-      secretAccessKey:
-        name: authentik-postgres-s3
-        key: ACCESS_SECRET_KEY
-      region:
-        name: authentik-postgres-s3
-        key: REGION
-    wal:
-      compression: gzip
-    data:
-      compression: gzip
-  instanceSidecarConfiguration:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
-    env:
-      # Newer boto3 adds checksums that S3-compatible stores can reject;
-      # the plugin's docs suggest sending them only when required.
-      - name: AWS_REQUEST_CHECKSUM_CALCULATION
-        value: when_required
-      - name: AWS_RESPONSE_CHECKSUM_VALIDATION
-        value: when_required
----
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: authentik-postgres-daily
-spec:
-  cluster:
-    name: authentik-postgres
-  # 03:00 UTC, after Longhorn's and Velero's backups; immediate: one right
-  # away, so WAL archiving has a base backup to start from.
-  schedule: "0 0 3 * * *"
-  immediate: true
-  backupOwnerReference: self
-  method: plugin
-  pluginConfiguration:
-    name: barman-cloud.cloudnative-pg.io

authentik/postgresql-cluster.yaml

@@ -8,12 +8,6 @@ spec:
   # start an in-place major upgrade. CNPG filled this in at creation.
   imageName: ghcr.io/cloudnative-pg/postgresql:17.4
   primaryUpdateStrategy: unsupervised
-  # WAL archiving and base backups to Garage, see postgresql-backup.yaml
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: authentik-postgres
   resources:
     requests:
       cpu: 50m

bolletjestrui/networkpolicy.yaml

@@ -54,29 +54,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

cert-manager/networkpolicy.yaml

@@ -0,0 +1,73 @@
+# cert-manager's three pods reach each other, DNS and the API server (the
+# node, port 16443), and take connections only from each other and the
+# node: the API server calls the webhook from there and the kubelet probes
+# come from there too (10.1.7.64 is the node's Calico VXLAN address,
+# projectcalico.org/IPv4VXLANTunnelAddr). Nothing scrapes the metrics on
+# 9402. The HTTP-01 solver pods run in each Certificate's own namespace
+# (acme-http01-solver in <namespace>/networkpolicy.yaml), not here.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector: {}
+    - from:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+        - ipBlock:
+            cidr: 10.1.7.64/32
+  egress:
+    - to:
+        - podSelector: {}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+      ports:
+        - port: 16443
+---
+# The controller talks to Let's Encrypt (443), and before it lets Let's
+# Encrypt check a challenge it fetches http://<host>/.well-known/... itself
+# (80). Every certificate's host has a public address, node001's or the
+# home router's (checked 2026-10-26), so the LAN stays out.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: controller-to-internet
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: cert-manager
+      app.kubernetes.io/component: controller
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - port: 80
+        - port: 443

cloudnative-pg/networkpolicy.yaml

@@ -0,0 +1,56 @@
+# The CloudNativePG operator reaches DNS, the API server (the node, port
+# 16443) and the PostgreSQL instances it runs in other namespaces: the
+# instance manager's status port (8000) and PostgreSQL (5432), which the
+# instances' own policies let in (postgres-cnpg in authentik and immich).
+# Besides its own namespace it takes connections only from the node: the
+# API server calls its webhook (9443) from there and the kubelet probes
+# come from there too (10.1.7.64 is the node's Calico VXLAN address,
+# projectcalico.org/IPv4VXLANTunnelAddr). The chart's Application
+# (apps/templates/cloudnativepg-helm.yaml) only installs the chart, so
+# this folder gets an Application of its own, cloudnative-pg-folder.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector: {}
+    - from:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+        - ipBlock:
+            cidr: 10.1.7.64/32
+  egress:
+    - to:
+        - podSelector: {}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+      ports:
+        - port: 16443
+    - to:
+        - namespaceSelector: {}
+          podSelector:
+            matchExpressions:
+              - key: cnpg.io/cluster
+                operator: Exists
+      ports:
+        - port: 8000
+        - port: 5432

default/networkpolicy.yaml

@@ -0,0 +1,14 @@
+# Nothing runs in default (2026-10-26: only the kubernetes Service, whose
+# endpoint is the API server on the node, which this doesn't touch). A pod
+# started here, by `kubectl run` or a manifest without a namespace, gets
+# no network at all, instead of reaching the LAN, Vault and every app.
+# Anything that needs a network gets a namespace and a policy of its own.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress

dns/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - external-secret.yaml
   - rbac.yaml
   - cronjob.yaml
+  - networkpolicy.yaml
 
 configMapGenerator:
   - name: dns-sync-script

dns/networkpolicy.yaml

@@ -0,0 +1,37 @@
+# The only pod here is the dns-sync Job (a PostSync hook): it installs its
+# Python packages from PyPI and pushes domains/ to TransIP's API, so it
+# reaches DNS and the internet (not the LAN, the API server or other
+# namespaces). Nothing connects to it.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 100.64.0.0/10
+              - 169.254.0.0/16
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - port: 443

external-secrets/networkpolicy.yaml

@@ -0,0 +1,68 @@
+# External Secrets' three pods reach each other, DNS and the API server
+# (the node, port 16443); the controller also reads Vault
+# (vault-active.vault.svc:8200, which vault/networkpolicy.yaml lets it
+# into). Besides their own namespace they take connections only from the
+# node: the API server calls the webhook from there and the kubelet probes
+# come from there too (10.1.7.64 is the node's Calico VXLAN address,
+# projectcalico.org/IPv4VXLANTunnelAddr). The Password generator behind
+# gatus/backup-check-token needs no network. The chart's Application
+# (apps/templates/external-secrets-helm.yaml) only installs the chart, so
+# this folder gets an Application of its own, external-secrets-folder.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector: {}
+    - from:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+        - ipBlock:
+            cidr: 10.1.7.64/32
+  egress:
+    - to:
+        - podSelector: {}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+      ports:
+        - port: 16443
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: controller-to-vault
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: external-secrets
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vault
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: vault
+      ports:
+        - port: 8200

freshrss/networkpolicy.yaml

@@ -56,29 +56,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

gatus/networkpolicy.yaml

@@ -83,29 +83,3 @@ spec:
             cidr: 192.168.1.204/32
       ports:
         - port: 16443
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

gitea/networkpolicy.yaml

@@ -55,29 +55,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

immich/networkpolicy.yaml

@@ -73,9 +73,7 @@ spec:
 ---
 # The CNPG operator checks each instance on its status port and connects to
 # PostgreSQL; the instance manager inside each pod watches its Cluster
-# through the API server (the node, port 16443). The barman cloud sidecar
-# sends the WAL and the base backups to Garage on the NAS
-# (postgresql-backup.yaml).
+# through the API server (the node, port 16443).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -102,34 +100,3 @@ spec:
             cidr: 192.168.1.204/32
       ports:
         - port: 16443
-    - to:
-        - ipBlock:
-            cidr: 192.168.1.99/32
-      ports:
-        - port: 3900
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

immich/postgresql-backup.yaml

@@ -1,97 +0,0 @@
-# Backups of immich's database (albums, faces, the photos' metadata; the
-# photos themselves are files on immich-claim) by CNPG itself, through the
-# barman cloud plugin (apps/templates/plugin-barman-cloud-helm.yaml): a base
-# backup every night, and every WAL segment as soon as it is full or 5
-# minutes old (archive_timeout). Both go to the bucket cnpg-immich in Garage
-# on the NAS (nas/garage), so the database can be restored to any moment of
-# the last 30 days. Velero copies the data directory while PostgreSQL runs,
-# which is not a consistent copy. Only the PostgreSQL 17 cluster; the 14
-# one is about to go.
-# The key is Garage's cnpg-immich, in Vault as kv/cnpg-immich-s3; it can
-# only reach this bucket.
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: immich-postgres-17-s3
-  namespace: immich
-spec:
-  secretStoreRef:
-    name: vault-backend
-    kind: ClusterSecretStore
-  refreshInterval: 15m
-  target:
-    name: immich-postgres-17-s3
-    creationPolicy: Owner
-    template:
-      engineVersion: v2
-      data:
-        ACCESS_KEY_ID: "{{ .access_key_id }}"
-        ACCESS_SECRET_KEY: "{{ .secret_access_key }}"
-        # Garage rejects requests signed for another region
-        REGION: garage
-  data:
-    - secretKey: access_key_id
-      remoteRef:
-        key: kv/cnpg-immich-s3
-        property: access_key_id
-    - secretKey: secret_access_key
-      remoteRef:
-        key: kv/cnpg-immich-s3
-        property: secret_access_key
----
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: immich-postgres-17
-  namespace: immich
-  annotations:
-    # The CRD comes with the plugin's own app
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  retentionPolicy: 30d
-  configuration:
-    destinationPath: s3://cnpg-immich/
-    endpointURL: http://192.168.1.99:3900
-    s3Credentials:
-      accessKeyId:
-        name: immich-postgres-17-s3
-        key: ACCESS_KEY_ID
-      secretAccessKey:
-        name: immich-postgres-17-s3
-        key: ACCESS_SECRET_KEY
-      region:
-        name: immich-postgres-17-s3
-        key: REGION
-    wal:
-      compression: gzip
-    data:
-      compression: gzip
-  instanceSidecarConfiguration:
-    resources:
-      requests:
-        cpu: 10m
-        memory: 64Mi
-    env:
-      # Newer boto3 adds checksums that S3-compatible stores can reject;
-      # the plugin's docs suggest sending them only when required.
-      - name: AWS_REQUEST_CHECKSUM_CALCULATION
-        value: when_required
-      - name: AWS_RESPONSE_CHECKSUM_VALIDATION
-        value: when_required
----
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: immich-postgres-17-daily
-  namespace: immich
-spec:
-  cluster:
-    name: immich-postgres-17
-  # 03:00 UTC, after Longhorn's and Velero's backups; immediate: one right
-  # away, so WAL archiving has a base backup to start from.
-  schedule: "0 0 3 * * *"
-  immediate: true
-  backupOwnerReference: self
-  method: plugin
-  pluginConfiguration:
-    name: barman-cloud.cloudnative-pg.io

immich/postgresql-cluster-17.yaml

@@ -18,13 +18,6 @@ spec:
     shared_preload_libraries:
       - "vchord.so"
 
-  # WAL archiving and base backups to Garage, see postgresql-backup.yaml
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: immich-postgres-17
-
   # Filled once from the PostgreSQL 14 cluster (immich-postgres) after its
   # embedding columns were turned into real[] and pgvecto.rs was dropped,
   # see docs/upgrade-k8s-1.33.md.

mariadb-operator/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - operator-crds-helm.yaml
   - operator-helm.yaml
+  - networkpolicy.yaml

mariadb-operator/networkpolicy.yaml

@@ -0,0 +1,54 @@
+# The mariadb-operator's three pods reach each other, DNS and the API
+# server (the node, port 16443); the operator also connects to MariaDB on
+# 3306 for the databases, users and grants it manages (mbgwp's
+# mariadb-from-operator lets it in). Besides their own namespace they take
+# connections only from the node: the API server calls the webhook from
+# there and the kubelet probes come from there too (10.1.7.64 is the node's
+# Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr). This
+# folder's Application deploys into argocd (the operator's own
+# Applications), hence the namespace here.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default
+  namespace: mariadb-system
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector: {}
+    - from:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+        - ipBlock:
+            cidr: 10.1.7.64/32
+  egress:
+    - to:
+        - podSelector: {}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+      ports:
+        - port: 16443
+    - to:
+        - namespaceSelector: {}
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: mariadb
+      ports:
+        - port: 3306

mbgwp/networkpolicy.yaml

@@ -85,29 +85,3 @@ spec:
               kubernetes.io/metadata.name: mariadb-system
       ports:
         - port: 3306
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

nas/garage/README.md

@@ -31,12 +31,5 @@ Velero's key is in Vault as `kv/velero-s3` (`access_key_id`,
 `velero/external-secret.yaml`. Without the cluster, `$g key info velero
 --show-secret` on the NAS shows it again.
 
-CNPG's backups (`authentik/postgresql-backup.yaml`,
-`immich/postgresql-backup.yaml`) have a bucket and a key per cluster, so
-neither database can touch the other's backups. Made on 2026-10-26 the
-same way as Velero's, with `cnpg-authentik` and `cnpg-immich` as both
-bucket and key name; the keys are in Vault as `kv/cnpg-authentik-s3` and
-`kv/cnpg-immich-s3`.
-
 Renovate updates the image tag in `compose.yaml`, but nothing deploys it:
 after merging, `docker compose pull && docker compose up -d` on the NAS.

ntfy/networkpolicy.yaml

@@ -65,29 +65,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

renovate.json

@@ -4,7 +4,6 @@
     "config:recommended",
     "customManagers:githubActionsVersions"
   ],
-  "timezone": "Europe/Amsterdam",
   "argocd": {
     "description": "Every app folder; Renovate's regexes are RE2, which has no lookahead, so the other folders are skipped through ignorePaths",
     "managerFilePatterns": [
@@ -89,27 +88,6 @@
         "major"
       ],
       "enabled": false
-    },
-    {
-      "description": "Patch updates of apps that hold little state and are easy to roll back, and of CI's tools, merge themselves once CI passes: three days after the release, in the evening or at the weekend, when the cluster can be reached. Not the databases, operators, Vault, authentik, Longhorn, Velero, immich, Gitea or WordPress. Renovate merges itself; the repo has no branch protection for GitHub's auto-merge to wait on",
-      "matchFileNames": [
-        "ntfy/**",
-        "gatus/**",
-        "freshrss/**",
-        "serpbear/**",
-        "actual-budget/**",
-        ".github/workflows/**"
-      ],
-      "matchUpdateTypes": [
-        "patch"
-      ],
-      "minimumReleaseAge": "3 days",
-      "automerge": true,
-      "platformAutomerge": false,
-      "automergeSchedule": [
-        "* 17-21 * * 1-5",
-        "* 10-21 * * 0,6"
-      ]
     }
   ]
 }

serpbear/networkpolicy.yaml

@@ -54,29 +54,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

vault/networkpolicy.yaml

@@ -66,29 +66,3 @@ spec:
               - 169.254.0.0/16
               - 172.16.0.0/12
               - 192.168.0.0/16
----
-# cert-manager's HTTP-01 solver, which runs only while a certificate
-# renews: Let's Encrypt and cert-manager's own self check reach it on 8089
-# through Envoy. The policies above let Envoy reach the app's port only,
-# which left the solver unreachable (found 2026-10-26, when ynab's renewal
-# hung).
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: acme-http01-solver
-spec:
-  podSelector:
-    matchLabels:
-      acme.cert-manager.io/http01-solver: "true"
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: envoy-gateway-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: envoy
-      ports:
-        - port: 8089

velero/networkpolicy.yaml

@@ -0,0 +1,52 @@
+# Velero, its node agent, and the pods it starts here (the data movers of
+# each pod volume backup or restore, kopia's maintenance jobs, the chart's
+# CRD upgrade job) reach each other, DNS, the API server (the node, port
+# 16443) and Garage on the NAS (192.168.1.99:3900, nas/garage). The node
+# agent reads volumes through its hostPath mount, not the network. Besides
+# their own namespace they take connections only from the node (kubelet
+# probes; 10.1.7.64 is the node's Calico VXLAN address,
+# projectcalico.org/IPv4VXLANTunnelAddr); nothing scrapes the metrics on
+# 8085. MinIO (the NAS, port 9000) is not allowed: going back to it means
+# adding its port here as well.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector: {}
+    - from:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+        - ipBlock:
+            cidr: 10.1.7.64/32
+  egress:
+    - to:
+        - podSelector: {}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.204/32
+      ports:
+        - port: 16443
+    - to:
+        - ipBlock:
+            cidr: 192.168.1.99/32
+      ports:
+        - port: 3900