From 0bde5dd8fe50d1c11f987c67fa6ea30b36a21934 Mon Sep 17 00:00:00 2001
From: Rock <locartrock@gmail.com>
Date: Sun, 27 Sep 2026 14:13:36 +0000
Subject: [PATCH] fix(netpol): allow api-gateway egress to notifications:80
 (Gotify) (#48)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

NetworkPolicy was blocking api-gateway → gotify.notifications.svc.cluster.local:80.
Adds egress rule to `notifications` namespace on port 80.

Required for `X-Service: notification` + `X-Resource: send-message` to deliver push notifications through the gateway.

---------

Co-authored-by: Admin Bot <admin@riotpiao.com>
Reviewed-on: https://forgejo.riotpiao.com/riotpiao-poimen/homelab-frontend/pulls/48
---
 k8s/network-policy.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index 0f002f3..3da5f8d 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -130,6 +130,14 @@ spec:
     ports:
     - protocol: TCP
       port: 8080
+  # Allow to Gotify (push notifications)
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: notifications
+    ports:
+    - protocol: TCP
+      port: 80
   # Allow to MinIO (S3-compatible storage)
   # Service `minio` listens on port 80 (targetPort 9000).
   # Headless `minio-cluster-hl` is 9000. Allow both.