chore(vpn): disable vpn-egress, escalate OpenVPN→WireGuard decision

OpenVPN can't connect on this network (each port fails differently, so it's
OpenVPN-specific not a UDP block — NTP/123 works): 1197 = home OpenVPN-server
conflict; 53 = DNS interception; 8080 = TLS handshake fails across servers (MTU
on WiFi+triple-NAT). Recommend pivoting to WireGuard via thrnz/docker-wireguard-pia
(UDP 1337, MTU-robust, ADR-0013 fallback, operator's original preference) — a
spec-level (ADR-0013) change, so escalated. Disabled meanwhile. Full trace in
DECISIONS-LOG.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

DECISIONS-LOG.md

@@ -525,3 +525,22 @@ arbitrary non-53 UDP works bidirectionally, so it's port-specific (1197 conflict
 UDP block. Moved `OPENVPN_ENDPOINT_PORT` to **8080** (community-verified for PIA, non-DNS, non-1197).
 Also hit the `${VAR}`→int-coercion gotcha (k8s "expected string, got 53") — the port is hardcoded as a
 quoted string in gluetun-gateway.yaml (Longhorn-fix precedent), not a cluster-var.
+
+### Phase 3 VPN — OpenVPN unusable on this network → ESCALATE to WireGuard (thrnz) (2026-08-22)
+Tested three PIA OpenVPN UDP ports; each fails for a **different** reason (so it's OpenVPN-specific, not a
+UDP block — a raw NTP/123 probe from the host returns fine):
+- **1197** — outbound leaves, zero replies. Conflicts with the home OpenVPN server NAT'd on WAN:1197.
+- **53** — outbound leaves, zero replies. This network transparently intercepts outbound :53 (DNS), so
+  `dig` succeeds but OpenVPN-over-53 is swallowed.
+- **8080** — PIA **responds** (OpenVPN reaches the TLS handshake) but `TLS handshake failed` repeatedly
+  across servers → classic **MTU/fragmentation** (OpenVPN's large TLS handshake packets dropped on the
+  WiFi + triple-NAT path: pod→Cilium→node→libvirt-NAT→WiFi→home-NAT).
+
+**Recommendation (ESCALATED — spec-level, ADR-0013):** pivot to **WireGuard via `thrnz/docker-wireguard-pia`**
+(PIA WG = **UDP/1337**): a different port (no 1197 conflict, no 53 intercept), and WireGuard's handshake is
+small fixed-size packets → **not MTU-sensitive** like OpenVPN's TLS handshake, so it should succeed where
+8080 fails. It's ADR-0013's documented WG fallback and the operator's original preference. Trade-offs
+(per the ADR): different single-maintainer image, and PF is file-based (`/pia-shared/port.dat`) rather than
+Gluetun's control API — matters only when qBittorrent/natmap is built (Phase 6), not now. `vpn-egress`
+disabled meanwhile (crashloop would fire false alerts). Awaiting operator's architect decision before the
+container swap.

platform/kustomization.yaml

@@ -17,10 +17,13 @@ resources:
   - cert-manager       # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
   - externaldns        # auto DNS records — needs SOPS `cloudflare-api-token`
   - gateway            # Gateway API listeners (ingress; replaces Traefik)
-  # ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port 8080, ADR-0013 amendment).
-  #      NOT 1197 (home NATs its own OpenVPN server there) and NOT 53 (network intercepts DNS/:53);
-  #      both tcpdump-confirmed. See DECISIONS-LOG. ----
-  - vpn-egress         # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)
+  # ---- Phase 3 — Egress / VPN — DISABLED, ESCALATED for an architect decision. OpenVPN via Gluetun
+  #      cannot connect on this network: 1197 conflicts with the home OpenVPN server; 53 is DNS-
+  #      intercepted; 8080 reaches TLS but the handshake fails across servers (MTU on WiFi+triple-NAT).
+  #      NTP/123 works, so it's OpenVPN-specific, not a UDP block. Recommendation: pivot to WireGuard
+  #      via thrnz/docker-wireguard-pia (PIA WG = UDP 1337, small MTU-robust handshake, ADR-0013's
+  #      documented fallback, operator's original preference). See DECISIONS-LOG "Phase 3 VPN". ----
+  # - vpn-egress       # re-enable after the architect decision (thrnz/WireGuard build)
   # ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
   - monitoring         # kube-prometheus-stack + Loki + Alloy + Alertmanager
   # ---- Later phases: enabled when their phase opens ----