# Minimal ingress policy for a home cluster. Default-deny within the
# namespace, then allow:
#   - Web traffic to hot pods on :5000 (cloudflared ingress)
#   - Prometheus scrape traffic on :5000 (prop metrics) and :9100 (Rust workers)
#   - Erlang distribution (EPMD + ephemeral ports) between prop + backfill pods
#
# Egress is unrestricted — pods need to reach Postgres, NFS (10.0.19.103),
# HRRR (skippy + NOAA S3), and IEM.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: prop-allow-web
  namespace: prop
spec:
  podSelector:
    matchLabels:
      app: prop
      tier: hot
  policyTypes:
    - Ingress
  ingress:
    # Web traffic from cloudflared (any source, port :5000).
    - from: []
      ports:
        - port: 5000
          protocol: TCP
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: prop-allow-metrics
  namespace: prop
spec:
  podSelector:
    matchLabels:
      app: prop
      tier: hot
  policyTypes:
    - Ingress
  ingress:
    # Prometheus scrape via apiserver proxy or NodePort.
    - from:
        - namespaceSelector: {}   # any namespace
      ports:
        - port: 5000
          protocol: TCP
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: grid-rs-allow-metrics
  namespace: prop
spec:
  podSelector:
    matchLabels:
      app: prop-grid-rs
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector: {}
      ports:
        - port: 9100
          protocol: TCP
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: hrrr-point-allow-metrics
  namespace: prop
spec:
  podSelector:
    matchLabels:
      app: hrrr-point-rs
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector: {}
      ports:
        - port: 9100
          protocol: TCP
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: prop-allow-epmd
  namespace: prop
spec:
  podSelector:
    matchLabels:
      app: prop
  policyTypes:
    - Ingress
  ingress:
    # Erlang distribution within the cluster (libcluster). EPMD listens on
    # 4369; actual distribution uses ephemeral ports negotiated via EPMD.
    - from:
        - podSelector:
            matchLabels:
              app: prop
      ports:
        - port: 4369
          protocol: TCP
    - from:
        - podSelector:
            matchLabels:
              app: prop