From 41234b85f594bc6a8f91c0a396e69548b16f6857 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sat, 22 Aug 2026 23:30:46 -0500 Subject: [PATCH] fix(vpn): PIA strong encryption preset (RSA-4096/AES-256-CBC/SHA256, port 1197) Operator's working config is sweden.privacy.network:1197 with RSA-4096, AES-256-CBC, SHA256 = PIA's 'strong' preset. gluetun defaults PIA to 'normal' (AES-128-GCM), a cipher mismatch against the 1197 (strong) endpoint, so the handshake never completed (silent after UDP link). PIA_ENCRYPTION_PRESET=strong matches it and selects 1197. Reverts the 8080 port red herring. Co-Authored-By: Claude Opus 4.8 --- platform/vpn-egress/gluetun-gateway.yaml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml index 6e19fb0..4f47db1 100644 --- a/platform/vpn-egress/gluetun-gateway.yaml +++ b/platform/vpn-egress/gluetun-gateway.yaml @@ -53,10 +53,11 @@ spec: value: "private internet access" - name: VPN_TYPE value: "openvpn" # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended - - name: OPENVPN_ENDPOINT_PORT - value: "8080" # NOT 1197: with live servers, PIA's replies FROM src-port 1197 get - # no return here — the home OpenVPN server / port-forward on 1197 - # appears to swallow them. 8080 avoids that (PIA serves it too). + - name: PIA_ENCRYPTION_PRESET + value: "strong" # operator's working .ovpn (sweden.privacy.network:1197) uses PIA's + # STRONG preset: RSA-4096 + AES-256-CBC + SHA256. gluetun defaults + # to "normal" (AES-128-GCM) → cipher mismatch, so the 1197 endpoint + # never completes the handshake. "strong" also selects port 1197. # Fresh server list comes from the update-servers initContainer (see above). UPDATER_PERIOD then # keeps it fresh for long-running pods (gluetun docs: >=360h to be nice to the provider API): - name: UPDATER_PERIOD