fix(vpn): disable vpn-egress — network blackholes PIA IPs (not ports/MTU/cluster)

Decisive diagnosis: OpenVPN's outbound init packets are 14 bytes with zero
replies (so MTU was never the blocker), pod UDP egress is healthy (NTP replies),
but TCP 501/443 to PIA IPs time out while Google/Cloudflare are OPEN — across many
PIA servers. This 192.168.2.x WiFi segment blackholes PIA's IP ranges (and
intercepts DNS). Not code-fixable. Reverted the port/MTU red-herring env to PIA
defaults; disabled vpn-egress pending an operator network fix (move to the
unfiltered 192.168.1.x LAN, or unblock PIA on the router). Full trace in
DECISIONS-LOG.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kustomization.yaml

@@ -17,11 +17,13 @@ resources:
   - cert-manager       # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
   - externaldns        # auto DNS records — needs SOPS `cloudflare-api-token`
   - gateway            # Gateway API listeners (ingress; replaces Traefik)
-  # ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP, ADR-0013 amendment). Root cause of earlier failures:
-  #      Cilium VXLAN gives pods MTU 1450 (node/host/WAN all 1500), so OpenVPN's 1500-byte handshake
-  #      packets were dropped. Fix: OPENVPN_MTU/MSSFIX=1350 in gluetun-gateway.yaml so packets fit 1450.
-  #      See DECISIONS-LOG "Phase 3 VPN". ----
-  - vpn-egress         # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)
+  # ---- Phase 3 — Egress / VPN — DISABLED: BLOCKED at the network (operator action needed). Definitive
+  #      finding: this 192.168.2.x WiFi segment BLACKHOLES traffic to PIA's IP ranges — TCP 501/443 to PIA
+  #      time out, UDP + ICMP get no reply across many PIA servers, while Google/Cloudflare work on all.
+  #      It also intercepts DNS/:53. Not MTU, not ports, not the cluster — the config is correct. Fix at
+  #      the network (move to the unfiltered 192.168.1.x LAN / wired, or unblock PIA on the router), then
+  #      re-enable. See DECISIONS-LOG "Phase 3 VPN — network blocks PIA". ----
+  # - vpn-egress       # re-enable once the network permits PIA (no code change needed)
   # ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
   - monitoring         # kube-prometheus-stack + Loki + Alloy + Alertmanager
   # ---- Later phases: enabled when their phase opens ----

platform/vpn-egress/gluetun-gateway.yaml

@@ -40,18 +40,10 @@ spec:
               value: "private internet access"
             - name: VPN_TYPE
               value: "openvpn"               # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
-            - name: OPENVPN_ENDPOINT_PORT
-              value: "8080"                  # 8080: PIA confirmed responding here; avoid 53 (this network
-                                             # intercepts DNS/:53). Port is NOT the root cause — MTU is (below).
-                                             # Hardcoded string (not ${var}): Flux/kustomize strips quotes on
-                                             # "${VAR}" → int coercion k8s rejects (Longhorn-fix gotcha).
-            # --- MTU: Cilium runs VXLAN (routing-mode tunnel), so pods get MTU 1450 (1500 − 50 encap) while
-            #     the node/host/WAN are all 1500. OpenVPN's default 1500-byte packets exceed 1450 and are
-            #     dropped (PMTUD broken). Shrink tun-mtu so packets fit: 1350 + ~52 overhead ≈ 1402 < 1450. ---
-            - name: OPENVPN_MTU
-              value: "1350"                  # tun-mtu; keeps encrypted UDP packets under the 1450 pod MTU
-            - name: OPENVPN_MSSFIX
-              value: "1350"                  # clamp TCP-in-tunnel to match, avoid in-tunnel fragmentation
+            # NOTE (2026-08-22): PIA's default OpenVPN UDP (1197) is used. Earlier port/MTU overrides were
+            # removed — they were chasing symptoms. The real blocker is that this network BLACKHOLES traffic
+            # to PIA's IP ranges (TCP 501/443 time out, UDP/ICMP no reply — while Google/Cloudflare work).
+            # Fixable only at the network, not here. See DECISIONS-LOG "Phase 3 VPN — network blocks PIA".
             # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
             - name: OPENVPN_USER
               valueFrom: