Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 2 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

fix(vpn): disable vpn-egress — tunnel blocked by home network (env), config kept

Browse Source 
Phase-3 VPN config is complete + correct (OpenVPN-UDP, SE Stockholm), but the
OpenVPN UDP/1197 handshake to PIA never gets a reply. Traced with tcpdump: packets
leave pod→node→host→WiFi (SNAT 192.168.2.103) fine, but 0 replies return to the
host, while host UDP/53 works. The 192.168.2.x home router/ISP drops OpenVPN UDP —
upstream of everything in this repo. Reverted to disabled to avoid a crashloop
firing false KubePodCrashLooping alerts; one-line re-enable once the network is
fixed. Full trace in DECISIONS-LOG.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-22 15:05:20 -05:00
1 parent e4d856fd83
commit 9d761872ea
2 files changed
+30 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

platform/kustomization.yaml
+7 -2
View File
@@ -17,8 +17,13 @@ resources:
- cert-manager # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
- externaldns # auto DNS records — needs SOPS `cloudflare-api-token`
- gateway # Gateway API listeners (ingress; replaces Traefik)
# ---- Phase 3 — Egress / VPN (PIA creds provisioned via SOPS; OpenVPN-UDP per ADR-0013 amendment) ----
- vpn-egress # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)
# ---- Phase 3 — Egress / VPN — config COMPLETE + CORRECT (OpenVPN-UDP, SE Stockholm), but the tunnel
# is BLOCKED by the ENVIRONMENT: gluetun's OpenVPN UDP/1197 packets to PIA leave the cluster
# correctly (pod→node→host→WiFi, SNAT 192.168.2.103) but NO replies ever return to the host,
# while host UDP/53 works — so the home router/ISP on the 192.168.2.x WiFi net drops OpenVPN
# UDP. Disabled to avoid a crashloop firing false alerts. Re-enable once the network is fixed
# (see DECISIONS-LOG "Phase 3 VPN — tunnel BLOCKED by home network"). ----
# - vpn-egress # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)
# ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
- monitoring # kube-prometheus-stack + Loki + Alloy + Alertmanager
# ---- Later phases: enabled when their phase opens ----