From 998b46df3d9c8e3885810a0b8c5f6a05222cd97f Mon Sep 17 00:00:00 2001
From: Keith Jackson <keithallenjackson@gmail.com>
Date: Sun, 23 Aug 2026 00:46:31 -0500
Subject: [PATCH] fix(vpn): map .ovpn secret key (filename) to /config/pia.ovpn

Operator's kubectl create secret keyed the file by its name
(sweden-aes-128-cbc-udp-dns.ovpn); mount item now references that key -> pia.ovpn.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 platform/vpn-egress/gluetun-gateway.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml
index 269748a..1de8b4f 100644
--- a/platform/vpn-egress/gluetun-gateway.yaml
+++ b/platform/vpn-egress/gluetun-gateway.yaml
@@ -101,7 +101,8 @@ spec:
           secret:
             secretName: pia-custom-ovpn
             items:
-              - key: pia.ovpn
+              # the operator's secret keyed the .ovpn by its filename; map it to /config/pia.ovpn
+              - key: sweden-aes-128-cbc-udp-dns.ovpn
                 path: pia.ovpn
 ---
 # Control API Service — used for tunnel-state health/alerting (ADR-0013 "alert on tunnel state").