Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 2 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Merge feature/vpn-port-8080 into main

Browse Source
This commit is contained in:
jakman85 committed 2026-08-22 16:39:30 -05:00
2 parents 7a88863f71 4cde690008
commit 5674458754
4 files changed
+20 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

DECISIONS-LOG.md
+8
View File
@@ -517,3 +517,11 @@ traverse this network (the `dig @9.9.9.9` test) and no conflict. Added cluster-v
wired to gluetun `OPENVPN_ENDPOINT_PORT`, and re-enabled `vpn-egress`. Port-forwarding is an over-tunnel PIA
API call, unaffected by the transport port. (WireGuard fallback would also have worked — PIA WG is UDP/1337,
not 1197 — but staying on Gluetun+OpenVPN is the smaller change.)
**Correction: 53 didn't work either → settled on 8080.** Deploying on 53 still got no PIA replies —
this network **transparently intercepts outbound :53 (DNS)**, so `dig` succeeds (proxy forwards it) but
OpenVPN-over-53 is swallowed. Cheap decisive test: a raw **NTP/123** probe from the host got a reply →
arbitrary non-53 UDP works bidirectionally, so it's port-specific (1197 conflict + 53 DNS-intercept), not a
UDP block. Moved `OPENVPN_ENDPOINT_PORT` to **8080** (community-verified for PIA, non-DNS, non-1197).
Also hit the `${VAR}`→int-coercion gotcha (k8s "expected string, got 53") — the port is hardcoded as a
quoted string in gluetun-gateway.yaml (Longhorn-fix precedent), not a cluster-var.
clusters/base/cluster-vars.yaml
+3 -2
View File
@@ -43,9 +43,10 @@ data:
# which lacks PF; NOT a US region, which also lack PF)
CLUSTER_POD_CIDR: "10.0.0.0/8" # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun
# FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel
# NOTE: PIA OpenVPN port is HARDCODED "53" in gluetun-gateway.yaml, not a cluster-var — Flux/kustomize
# NOTE: PIA OpenVPN port is HARDCODED "8080" in gluetun-gateway.yaml, not a cluster-var — Flux/kustomize
# strips quotes around a bare "${VAR}" so a numeric value coerces to int, which k8s rejects for an env
# value (same gotcha as the Longhorn numberOfReplicas fix). See DECISIONS-LOG.
# value (same gotcha as the Longhorn numberOfReplicas fix). 8080 chosen: 1197 conflicts with the home
# OpenVPN server, 53 is DNS-intercepted here; both confirmed by tcpdump. See DECISIONS-LOG.
# --- identity / auth (ADR-0014) ---
KEYCLOAK_REPLICAS: "1" # dev 1 | prod 2 (HA)
platform/kustomization.yaml
+3 -3
View File
@@ -17,9 +17,9 @@ resources:
- cert-manager # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
- externaldns # auto DNS records — needs SOPS `cloudflare-api-token`
- gateway # Gateway API listeners (ingress; replaces Traefik)
# ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port 53, ADR-0013 amendment).
# NOT PIA's default 1197 — this home network NATs its own OpenVPN server on WAN:1197, which
# collided with the outbound PIA-on-1197 flow (tcpdump-confirmed; DECISIONS-LOG). ----
# ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port 8080, ADR-0013 amendment).
# NOT 1197 (home NATs its own OpenVPN server there) and NOT 53 (network intercepts DNS/:53);
# both tcpdump-confirmed. See DECISIONS-LOG. ----
- vpn-egress # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)
# ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
- monitoring # kube-prometheus-stack + Loki + Alloy + Alertmanager
platform/vpn-egress/gluetun-gateway.yaml
+6 -5
View File
@@ -41,11 +41,12 @@ spec:
- name: VPN_TYPE
value: "openvpn" # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
- name: OPENVPN_ENDPOINT_PORT
value: "53" # NOT 1197 — the home network NATs its own OpenVPN server there,
# so PIA-on-1197 replies never return (tcpdump-confirmed; DECISIONS-LOG).
# Hardcoded (not a ${var}): Flux/kustomize strips quotes on "${VAR}"
# → int coercion, which k8s rejects for env value (Longhorn-fix gotcha).
# Valid PIA ports: 53, 1194, 1197, 1198, 8080, 9201.
value: "8080" # NOT 1197 (home NATs its own OpenVPN server there → replies never
# return) and NOT 53 (this network transparently intercepts :53 DNS,
# swallowing OpenVPN-over-53). 8080 verified: arbitrary UDP works here
# (NTP/123 test). Hardcoded string (not ${var}): Flux/kustomize strips
# quotes on "${VAR}" → int coercion k8s rejects (Longhorn-fix gotcha).
# Valid PIA ports: 53, 1194, 1197, 1198, 8080, 9201. See DECISIONS-LOG.
# PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
- name: OPENVPN_USER
valueFrom: