fix(k3s): deny credential-bearing host ports to pod sources (#399)

* fix(k3s): deny credential-bearing host ports to pod sources

* test: assert the k3s pod firewall drops sensitive ports

* docs(security): record the pod firewall boundary

outputs/x86_64-linux/tests/security-k3s-pod-firewall/expected.nix

@@ -0,0 +1,5 @@
+{
+  lib,
+  outputs,
+}:
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (_: true)

outputs/x86_64-linux/tests/security-k3s-pod-firewall/expr.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  outputs,
+}:
+let
+  # Index of the first occurrence of `needle` in `haystack`, or null.
+  firstIndex =
+    needle: haystack:
+    let
+      parts = lib.splitString needle haystack;
+    in
+    if builtins.length parts < 2 then null else builtins.stringLength (builtins.head parts);
+in
+lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
+  name:
+  let
+    cfg = outputs.nixosConfigurations.${name}.config;
+    rules = cfg.networking.firewall.extraInputRules;
+    dropAt = firstIndex "saddr 10.0.0.0/8 tcp dport" rules;
+    acceptAt = firstIndex "saddr 10.0.0.0/8 accept" rules;
+  in
+  if !(cfg.services.k3s.enable or false) then
+    true
+  else
+    # The port deny must exist and must precede the broad pod accept, because
+    # nftables takes the first matching rule.
+    dropAt != null
+    && acceptAt != null
+    && dropAt < acceptAt
+    && lib.hasInfix "2049" rules
+    && lib.hasInfix "5432" rules
+    && lib.hasInfix "5902" rules
+)