Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

chore(vpn): disable vpn-egress, escalate OpenVPN→WireGuard decision

Browse Source 
OpenVPN can't connect on this network (each port fails differently, so it's
OpenVPN-specific not a UDP block — NTP/123 works): 1197 = home OpenVPN-server
conflict; 53 = DNS interception; 8080 = TLS handshake fails across servers (MTU
on WiFi+triple-NAT). Recommend pivoting to WireGuard via thrnz/docker-wireguard-pia
(UDP 1337, MTU-robust, ADR-0013 fallback, operator's original preference) — a
spec-level (ADR-0013) change, so escalated. Disabled meanwhile. Full trace in
DECISIONS-LOG.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-22 16:47:18 -05:00
1 parent 5674458754
commit 0aab1702e0
2 files changed
+26 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

platform/kustomization.yaml
+7 -4
View File
@@ -17,10 +17,13 @@ resources:
- cert-manager # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
- externaldns # auto DNS records — needs SOPS `cloudflare-api-token`
- gateway # Gateway API listeners (ingress; replaces Traefik)
# ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port 8080, ADR-0013 amendment).
# NOT 1197 (home NATs its own OpenVPN server there) and NOT 53 (network intercepts DNS/:53);
# both tcpdump-confirmed. See DECISIONS-LOG. ----
- vpn-egress # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)
# ---- Phase 3 — Egress / VPN — DISABLED, ESCALATED for an architect decision. OpenVPN via Gluetun
# cannot connect on this network: 1197 conflicts with the home OpenVPN server; 53 is DNS-
# intercepted; 8080 reaches TLS but the handshake fails across servers (MTU on WiFi+triple-NAT).
# NTP/123 works, so it's OpenVPN-specific, not a UDP block. Recommendation: pivot to WireGuard
# via thrnz/docker-wireguard-pia (PIA WG = UDP 1337, small MTU-robust handshake, ADR-0013's
# documented fallback, operator's original preference). See DECISIONS-LOG "Phase 3 VPN". ----
# - vpn-egress # re-enable after the architect decision (thrnz/WireGuard build)
# ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
- monitoring # kube-prometheus-stack + Loki + Alloy + Alertmanager
# ---- Later phases: enabled when their phase opens ----