From 0aab1702e0b7d196c92c75365e747829416bee60 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sat, 22 Aug 2026 16:47:18 -0500 Subject: [PATCH] =?UTF-8?q?chore(vpn):=20disable=20vpn-egress,=20escalate?= =?UTF-8?q?=20OpenVPN=E2=86=92WireGuard=20decision?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OpenVPN can't connect on this network (each port fails differently, so it's OpenVPN-specific not a UDP block — NTP/123 works): 1197 = home OpenVPN-server conflict; 53 = DNS interception; 8080 = TLS handshake fails across servers (MTU on WiFi+triple-NAT). Recommend pivoting to WireGuard via thrnz/docker-wireguard-pia (UDP 1337, MTU-robust, ADR-0013 fallback, operator's original preference) — a spec-level (ADR-0013) change, so escalated. Disabled meanwhile. Full trace in DECISIONS-LOG. Co-Authored-By: Claude Opus 4.8 --- DECISIONS-LOG.md | 19 +++++++++++++++++++ platform/kustomization.yaml | 11 +++++++---- 2 files changed, 26 insertions(+), 4 deletions(-) diff --git a/DECISIONS-LOG.md b/DECISIONS-LOG.md index 550b9cd..5c48f17 100644 --- a/DECISIONS-LOG.md +++ b/DECISIONS-LOG.md @@ -525,3 +525,22 @@ arbitrary non-53 UDP works bidirectionally, so it's port-specific (1197 conflict UDP block. Moved `OPENVPN_ENDPOINT_PORT` to **8080** (community-verified for PIA, non-DNS, non-1197). Also hit the `${VAR}`→int-coercion gotcha (k8s "expected string, got 53") — the port is hardcoded as a quoted string in gluetun-gateway.yaml (Longhorn-fix precedent), not a cluster-var. + +### Phase 3 VPN — OpenVPN unusable on this network → ESCALATE to WireGuard (thrnz) (2026-08-22) +Tested three PIA OpenVPN UDP ports; each fails for a **different** reason (so it's OpenVPN-specific, not a +UDP block — a raw NTP/123 probe from the host returns fine): +- **1197** — outbound leaves, zero replies. Conflicts with the home OpenVPN server NAT'd on WAN:1197. +- **53** — outbound leaves, zero replies. This network transparently intercepts outbound :53 (DNS), so + `dig` succeeds but OpenVPN-over-53 is swallowed. +- **8080** — PIA **responds** (OpenVPN reaches the TLS handshake) but `TLS handshake failed` repeatedly + across servers → classic **MTU/fragmentation** (OpenVPN's large TLS handshake packets dropped on the + WiFi + triple-NAT path: pod→Cilium→node→libvirt-NAT→WiFi→home-NAT). + +**Recommendation (ESCALATED — spec-level, ADR-0013):** pivot to **WireGuard via `thrnz/docker-wireguard-pia`** +(PIA WG = **UDP/1337**): a different port (no 1197 conflict, no 53 intercept), and WireGuard's handshake is +small fixed-size packets → **not MTU-sensitive** like OpenVPN's TLS handshake, so it should succeed where +8080 fails. It's ADR-0013's documented WG fallback and the operator's original preference. Trade-offs +(per the ADR): different single-maintainer image, and PF is file-based (`/pia-shared/port.dat`) rather than +Gluetun's control API — matters only when qBittorrent/natmap is built (Phase 6), not now. `vpn-egress` +disabled meanwhile (crashloop would fire false alerts). Awaiting operator's architect decision before the +container swap. diff --git a/platform/kustomization.yaml b/platform/kustomization.yaml index 6dddd77..beef8d2 100644 --- a/platform/kustomization.yaml +++ b/platform/kustomization.yaml @@ -17,10 +17,13 @@ resources: - cert-manager # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token` - externaldns # auto DNS records — needs SOPS `cloudflare-api-token` - gateway # Gateway API listeners (ingress; replaces Traefik) - # ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port 8080, ADR-0013 amendment). - # NOT 1197 (home NATs its own OpenVPN server there) and NOT 53 (network intercepts DNS/:53); - # both tcpdump-confirmed. See DECISIONS-LOG. ---- - - vpn-egress # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013) + # ---- Phase 3 — Egress / VPN — DISABLED, ESCALATED for an architect decision. OpenVPN via Gluetun + # cannot connect on this network: 1197 conflicts with the home OpenVPN server; 53 is DNS- + # intercepted; 8080 reaches TLS but the handshake fails across servers (MTU on WiFi+triple-NAT). + # NTP/123 works, so it's OpenVPN-specific, not a UDP block. Recommendation: pivot to WireGuard + # via thrnz/docker-wireguard-pia (PIA WG = UDP 1337, small MTU-robust handshake, ADR-0013's + # documented fallback, operator's original preference). See DECISIONS-LOG "Phase 3 VPN". ---- + # - vpn-egress # re-enable after the architect decision (thrnz/WireGuard build) # ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ---- - monitoring # kube-prometheus-stack + Loki + Alloy + Alertmanager # ---- Later phases: enabled when their phase opens ----