chore: add networkpolicy.yaml to ollama kustomization

.github/workflows/sync-to-forgejo.yml

@@ -0,0 +1,38 @@
+name: sync-to-forgejo
+
+on:
+  push:
+    branches:
+      - main
+      - high-performance
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sync-to-forgejo-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Push to Forgejo
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+        run: |
+          set -euo pipefail
+          git remote add forgejo "https://admin:${FORGEJO_TOKEN}@ci.nxtgauge.com/ashwin/${{ github.event.repository.name }}.git" 2>/dev/null || \
+            git remote set-url forgejo "https://admin:${FORGEJO_TOKEN}@ci.nxtgauge.com/ashwin/${{ github.event.repository.name }}.git"
+          git push forgejo "HEAD:${GITHUB_REF#refs/heads/}" --force

apps/ollama/base/kustomization.yaml

@@ -4,4 +4,5 @@ resources:
   - namespace.yaml
   - pvc.yaml
   - deployment.yaml
-  - service.yaml
+  - service.yaml
+  - networkpolicy.yaml

apps/ollama/base/networkpolicy.yaml

@@ -0,0 +1,53 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ollama-ingress-restriction
+  namespace: nxtgauge-ai
+  labels:
+    app: ollama
+spec:
+  podSelector:
+    matchLabels:
+      app: ollama
+  policyTypes:
+    - Ingress
+  ingress:
+    # Allow traffic from users service (port 11434)
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: default
+          podSelector:
+            matchLabels:
+              app: users
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from payments service
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: default
+          podSelector:
+            matchLabels:
+              app: payments
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from nxtgauge-ai-assistant service
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: nxtgauge-ai
+          podSelector:
+            matchLabels:
+              app: nxtgauge-ai-assistant
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from within the same namespace (for health checks, etc.)
+    - from:
+        - podSelector: {}
+      ports:
+        - protocol: TCP
+          port: 11434