# Gitea NetworkPolicy (foxhunt ns has default-deny-all). Egress: postgres + DNS + in-cluster webhook
# target + general HTTPS. Ingress: from platform/argo pods + the tailscale proxy → :3000 (web) and :22 (ssh).
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: gitea
  namespace: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: gitea
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # web (3000) + ssh (22) from platform + argo-workflow pods (cockpit build clones over HTTP)
    - from:
        - podSelector:
            matchExpressions:
              - key: app.kubernetes.io/part-of
                operator: In
                values: ["foxhunt", "argo-workflows"]
      ports:
        - { port: 3000, protocol: TCP }
        - { port: 2222, protocol: TCP }
    # web + ssh from the tailscale proxy (nginx + socat) that fronts git.fxhnt.ai
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: tailscale-gitlab-proxy
      ports:
        - { port: 3000, protocol: TCP }
        - { port: 2222, protocol: TCP }
  egress:
    # PostgreSQL
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: postgres
      ports:
        - { port: 5432, protocol: TCP }
    # DNS
    - ports:
        - { port: 53, protocol: UDP }
        - { port: 53, protocol: TCP }
    # Argo Events webhook target (gitea push hook → gitea-push eventsource :12000). The eventsource pod is
    # not part-of:foxhunt (stays default-allow), so allow egress to any in-namespace pod on 12000.
    - to:
        - podSelector: {}
      ports:
        - { port: 12000, protocol: TCP }
    # general HTTPS (avatars, external clones) — external only, exclude cluster CIDRs
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except: ["10.32.0.0/16", "172.16.0.0/16"]
      ports:
        - { port: 443, protocol: TCP }
