[aperolschpritz]

Summary

Add an independent Traefik Access egress flag to App and Agent network policies. It lets a workload reach other Apps and Agents through their exposed Traefik Domains even when general internet egress is disabled.

AppNetworkPolicy / AgentNetworkPolicy
+ allowTraefikAccess: boolean (default false)

egress
  DNS
  Internet Access (public CIDRs, private excluded)   [if enabled]
+ Traefik pods in kube-system, no port restriction   [if enabled]
  explicit App / Agent rules

• App UI: Traefik Access toggle in the Egress section.
• Agent UI: Allow Traefik access toggle on the Network Policy card.
• Project Network Graph: context-menu toggles for Apps and Agents.
• REST/Write schemas: field is optional and defaults to false.
• Glossary entry and ADR 0016-traefik-access-egress.md.

The rule targets the Traefik pods without ports because the k3s Traefik pods listen on 8000/8443; restricting to 80/443 would miss the translated pod port. Internet access stays unchanged and still excludes private CIDRs.

Evidence

• Before: an App with internet egress disabled cannot reach another App's exposed domain because the Traefik backend is inside a private CIDR.
• After: enabling Traefik Access adds the Traefik pod peer; internet access can stay disabled.

Verification:

• Relevant unit tests: 9 files, 75 tests passed.
• Relevant integration tests: 3 files, 23 tests passed.
• Full jsdom suite: 124/125 suites passed; the only failure is git.service.unit.spec.ts because no container runtime is available.
• ESLint on changed files: clean.
• tsc --noEmit: no new errors.
• Migration applied successfully against a scratch SQLite database.

Deploy note: run yarn prisma-deploy. Existing workloads keep the previous isolation; Traefik access is opt-in per App or Agent.

Merge Danger

Door: two-way

The migration only adds boolean columns with false, so existing workloads keep their current behavior. Reverting the code leaves the unused columns harmless.

Blast Radius: network-policy

Changes the egress rules only for workloads where the new flag is explicitly enabled. API changes are additive.