Ben Duncan 7ddcac53bb feat: block outbound SMTP egress via platform OVN ACL (#1001) ...

* feat: block outbound SMTP egress via platform OVN ACL

Add a platform egress ACL that drops outbound TCP to 25/465/587 for public
destinations on every guest, matching AWS's default outbound-SMTP block. The
control is global by default with an operator-held per-VPC exemption; tenants
cannot open the ports via a security group because the block sits above the
tenant-allow priority band. Private destinations are always exempt.

Config exposes blocked_ports_wan (nil defaults to [25,465,587], [] disables)
and egress_block_exempt_vpcs. Adds unit tests for the ACL builder, the SG
manager wiring and the config resolution, plus an e2e that digs gmail.com MX
and confirms a 5s SMTP connect is blocked while other WAN egress works.

* docs: note the multi-node sync + restart requirement for the egress block

2026-09-04 16:45:26 -05:00

..

gpu-passthrough

docs: bring doc titles and descriptions into SEO length limits (#831)

2026-08-19 12:05:59 +10:00

launching-instances

docs: bring doc titles and descriptions into SEO length limits (#831)

2026-08-19 12:05:59 +10:00

placement-groups

docs: bring doc titles and descriptions into SEO length limits (#831)

2026-08-19 12:05:59 +10:00

vpc-networking

feat: block outbound SMTP egress via platform OVN ACL (#1001)

2026-09-04 16:45:26 -05:00