# Postgres: accepts connections from foxhunt app pods, GitLab, Grafana, and Gitea
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: postgres
  namespace: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: postgres
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchExpressions:
              - key: app.kubernetes.io/part-of
                operator: In
                values: ["foxhunt", "argo-workflows"]
        - podSelector:
            matchLabels:
              release: gitlab
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: grafana
        - podSelector:                          # Gitea (Phase 2B) reuses the in-cluster postgres
            matchLabels:
              app.kubernetes.io/name: gitea
      ports:
        - protocol: TCP
          port: 5432
---
# Redis: accepts connections from foxhunt app pods + GitLab (Helm release)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: redis
  namespace: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: redis
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchExpressions:
              - key: app.kubernetes.io/part-of
                operator: In
                values: ["foxhunt"]
        - podSelector:
            matchLabels:
              release: gitlab
      ports:
        - protocol: TCP
          port: 6379
---
# Minio: accepts connections from foxhunt app pods, GitLab, and init jobs
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: minio
  namespace: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: minio
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchExpressions:
              - key: app.kubernetes.io/part-of
                operator: In
                values: ["foxhunt", "foxhunt-ci", "argo-workflows"]
        - podSelector:
            matchLabels:
              release: gitlab
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: minio-init
        - podSelector:                              # tailscale proxy fronts minio.fxhnt.ai (S3 API)
            matchLabels:
              app.kubernetes.io/name: tailscale-gitlab-proxy
      ports:
        - protocol: TCP
          port: 9000
---
# QuestDB: accepts ILP writes from trading-service + Prometheus metrics scrape
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: questdb
  namespace: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: questdb
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: trading-service
        - podSelector:
            matchLabels:
              foxhunt/job-type: training
      ports:
        - protocol: TCP
          port: 9009
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: prometheus
      ports:
        - protocol: TCP
          port: 9003
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: grafana
      ports:
        - protocol: TCP
          port: 8812
