Merge PIA_REGION=Sweden default

clusters/base/cluster-vars.yaml

@@ -38,8 +38,8 @@ data:
   KYVERNO_ADMISSION_REPLICAS: "3"                 # dev: 1 (no HA needed to iterate)
 
   # --- egress / VPN (Phase 3, ADR-0013) — consumed by platform/vpn-egress/gluetun-gateway.yaml ---
-  PIA_REGION: "Netherlands"                  # a PORT-FORWARDING-capable PIA region (NOT a US region);
-                                             # operator: change to your preferred PF-capable region
+  PIA_REGION: "Sweden"                       # operator's choice — a PORT-FORWARDING-capable PIA region
+                                             # (Sweden is PF-capable; NOT a US region, which lack PF)
   CLUSTER_POD_CIDR: "10.0.0.0/8"             # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun
                                              # FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel
 

platform/vpn-egress/README.md

@@ -19,8 +19,8 @@ tunnel; `internet`-class services go out the normal WAN. Serves **R-NET-05/06/07
 2. cluster-vars (already defined in `clusters/base/cluster-vars.yaml`; a ConfigMap — values are plain
    strings under `data:`, injected into the `${...}` tokens by Flux `postBuild.substituteFrom`). Confirm
    or override:
-   - `PIA_REGION` — a **port-forwarding-capable** PIA region (default `Netherlands`; e.g. `CA Toronto`,
-     `Switzerland`; NOT a US region — those lack PF). Gluetun `SERVER_REGIONS`.
+   - `PIA_REGION` — a **port-forwarding-capable** PIA region (default `Sweden`; e.g. `Netherlands`,
+     `CA Toronto`, `Switzerland`; NOT a US region — those lack PF). Gluetun `SERVER_REGIONS`.
    - `CLUSTER_POD_CIDR` — the **Cilium cluster-pool** pod CIDR (default `10.0.0.0/8`; pods get `10.x`,
      confirmed live — NOT the k3s `10.42.0.0/16`). Gluetun `FIREWALL_OUTBOUND_SUBNETS`.
    Per-env overrides go in `clusters/<env>/kustomization.yaml` as a cluster-vars JSON patch