fix(k3s): deny credential-bearing host ports to pod sources (#399)

* fix(k3s): deny credential-bearing host ports to pod sources

* test: assert the k3s pod firewall drops sensitive ports

* docs(security): record the pod firewall boundary

lib/genK3sAgentModule.nix

@@ -25,10 +25,16 @@ in
     enableIPv6 = true;
   };
 
-  # Cilium pods reach host services (e.g. the API server) from the pod CIDR.
-  # `mkAfter` keeps this after the shared base rules (incl. the node_exporter
-  # drop), so pods cannot scrape node_exporter either.
+  # Pods may reach the host services they need, but they are not part of the
+  # host's trusted LAN. Deny the credential-bearing host ports before the broad
+  # pod-network accept below, so a compromised pod cannot reach NFS, the
+  # database, the backup server, the VNC consoles, or an exporter. `mkAfter`
+  # keeps this after the shared base rules (incl. the node_exporter drop).
+  # Ports 80/443 stay reachable so in-cluster calls through the ingress are not
+  # broken; the ingress is the authentication boundary there.
   networking.firewall.extraInputRules = pkgs.lib.mkAfter ''
+    ip  saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
+    ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
     ip  saddr 10.0.0.0/8 accept
     ip6 saddr fd00::/104 accept
   '';

lib/genK3sServerModule.nix

@@ -52,10 +52,16 @@ in
     enableIPv6 = true;
   };
 
-  # Cilium pods reach host services (e.g. the API server) from the pod CIDR.
-  # `mkAfter` keeps this after the shared base rules (incl. the node_exporter
-  # drop), so pods cannot scrape node_exporter either.
+  # Pods may reach the host services they need, but they are not part of the
+  # host's trusted LAN. Deny the credential-bearing host ports before the broad
+  # pod-network accept below, so a compromised pod cannot reach NFS, the
+  # database, the backup server, the VNC consoles, or an exporter. `mkAfter`
+  # keeps this after the shared base rules (incl. the node_exporter drop).
+  # Ports 80/443 stay reachable so in-cluster calls through the ingress are not
+  # broken; the ingress is the authentication boundary there.
   networking.firewall.extraInputRules = lib.mkAfter ''
+    ip  saddr 10.0.0.0/8 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
+    ip6 saddr fd00::/104 tcp dport { 22, 2049, 2283, 5432, 5900, 5901, 5902, 5903, 8000, 8081, 8082, 9090, 9093, 9100, 9633, 9835 } drop
     ip  saddr 10.0.0.0/8 accept
     ip6 saddr fd00::/104 accept
   '';