@siax/network-policy (0.1.0)
Installation
@siax:registry=https://git.cloud.siax.io/api/packages/sax3l/npm/npm install @siax/network-policy@0.1.0"@siax/network-policy": "0.1.0"About this package
@siax/network-policy
P012 (Network/DB/Event/Idempotency/SLO Standards, new P000-P049 masterplan):
checkNetworkPolicy() — a real, runnable network-policy test — plus
generateCapabilityAccessIntents(), the minimal working half of a
"generate policy from capability dependencies" mechanism. Zero external
dependencies beyond @siax/schemas (workspace-internal). Node ESM
(.mjs), Node ≥ 20.
Why this package exists
P012 recon found zero network/firewall-as-code files anywhere in the
estate. Grounded in P004's real, committed findings
(siax-cloud-infra-work/docs/SNOWFLAKES.md, entry #2, BEFORE_STATE.md
root-SSH recon across all 7 live fleet nodes, 2026-09-01, read-only):
server6 and server8 run raw-protocol socat relays (relay-pg-ts,
relay-redis-ts, ch-proxy-tailnet) forwarding Postgres (5432), Redis
(6379) and ClickHouse directly onto the tailnet, "with no auth layer
beyond whatever the proxied service itself enforces" — SNOWFLAKES.md's
own words. None of this drift had been captured as policy-as-code or a
test anywhere before this pass.
This pass builds the STANDARD/library/test — it does NOT touch the real fleet. No live network/firewall reconfiguration was attempted; every check here is pure policy-as-code, run against declared JSON records, never a live socket probe against the real infrastructure. That boundary is P004's domain (already done) and stays out of scope here.
checkNetworkPolicy(rules) — the real, runnable test
Enforces one hard invariant and one grounded regression:
NETPOL-PUBLIC-DB(critical): a known database port (src/db-ports.mjs— postgres/mysql/mongo/redis/clickhouse/qdrant/ elasticsearch/… at their standard ports) withexposure: "public". This is literally "no database port should be externally reachable" — P012's own prompt wording — expressed as a policy-as-code assertion.NETPOL-NOAUTH-RELAY(warning): a known database port scoped to"tailnet"/"internal-only"withauthLayer: "none". Deliberately weaker than the public case — Tailscale/internal-network scoping IS a real boundary, just not an application-level auth layer — and this is exactly the real, documented SNOWFLAKES.md #2 finding, not a hypothetical.
test/check-policy.test.mjs proves both: a synthetic "hypothetical open
Postgres on the internet" case (critical), and a grounded case running
the checker against data/siax.network-policy.seed.json — a real,
schema-valid conversion of SNOWFLAKES.md #2's three named relays — and
asserting it finds exactly the three documented gaps as warnings and zero
critical violations (nothing in what's actually documented running today
puts a database port on the open internet).
generateCapabilityAccessIntents() — the "generate policy from
capability dependencies" mechanism, honestly scoped
P012's prompt asked: build a minimal working version if genuinely
buildable from SIAX_DEPENDENCY_GRAPH.md + SIAX_CAPABILITY_OWNERSHIP.md
(P001, merged 2026-09-02); otherwise build the schema/contract and document
the generator as a worklist item rather than fake it. Both halves
apply, split honestly:
- Genuinely buildable today, and built: a CAPABILITY-LEVEL default-deny
allow-list.
parseDependencyGraphMarkdown()reads the real, committed "Full engine consumption table" inSIAX_DEPENDENCY_GRAPH.md;generateCapabilityAccessIntents()inverts it into{provider, allowedConsumers[]}— e.g. "only act0, cl0ud, l0re, … may reach AUD0".test/generate-capability-policy.test.mjsparses the REAL file (not a fixture) and cross-checks the result against the doc's own already- published "Reverse index" section — they agree exactly (one real discovery along the way:n0tify's row is the only one in the whole file declaring lowercase engine codes (aud0vs. everyone else'sAUD0) — case-normalized here, since it's plainly the same capability, confirmed by the doc's own reverse index already treating it as such). - NOT genuinely buildable today, and NOT faked: a real
siax.network-policyrule needshost+port+protocol— concrete deployment-location facts.standard/estate/ SIAX_DATASTORE_INVENTORY.md(same P001 pass) is explicit that 78 of 79 repos have UNKNOWN datastore ownership, with no independent host/port inventory anywhere in the estate. EveryCapabilityAccessIntentthis generator emits carries an explicithostPortStatus: "UNKNOWN-requires-deployment-inventory"marker instead of a guessed port — the same "does not invent a guess" disciplinepackages/secret-resolver/README.mdalready applies to InfisicalprojectId.
Worklist item, not attempted here: once a real deployment/datastore
inventory exists (a future P0xx pass closing the SIAX_DATASTORE_INVENTORY.md
gap), extend generateCapabilityAccessIntents() — or add a sibling
function — to emit real, schema-valid siax.network-policy rows with
actual host/port/protocol instead of CapabilityAccessIntent stubs.
The siax.network-policy schema
New in P012 (schema/siax.network-policy.schema.json,
packages/schemas/src/siax.network-policy.mjs) — a default-deny
{id, service, host?, port, protocol, exposure, authLayer?, allowedConsumers?, source?, notes?} rule. A rule NOT present in a policy
file is implicitly denied; this schema never expresses an allow-everything
default. exposure: "unknown" is a valid, honest value — never silently
defaulted to "internal-only".
Usage
import { checkNetworkPolicy } from '@siax/network-policy';
import policyRules from './my-network-policy.json' with { type: 'json' };
const { violations, criticalCount } = checkNetworkPolicy(policyRules);
if (criticalCount > 0) {
console.error('Public database port(s) found:', violations.filter((v) => v.severity === 'critical'));
process.exit(1);
}
Not done this pass
- No
siax-doctor network-policyCLI subcommand — this package's functions are directly importable and unit-tested, but not yet wired into thesiax-doctorCLI dispatcher the waysiax-doctor dependencies/engines/firewallare. A natural, small follow-up. - No real host/port rule generation (see above) — blocked on a real deployment/datastore inventory that does not exist yet anywhere in the estate.
- No live-fleet firewall changes of any kind — out of this pass's boundary, P004's domain.
Dependencies
Dependencies
| ID | Version |
|---|---|
| @siax/schemas | workspace:* |