From a735784f94bac34c25b345da2a6ef5db8a0256de Mon Sep 17 00:00:00 2001
From: Keith Jackson <keithallenjackson@gmail.com>
Date: Sat, 22 Aug 2026 23:14:42 -0500
Subject: [PATCH] fix(vpn): initContainer fetches PIA's current server list
 (bundled list stale)

UPDATER_PERIOD only refreshes AFTER the tunnel is ready (chicken-and-egg: can't
connect with stale servers), and gluetun's bundled PIA Sweden list is retired
46.246.x (current is 158.173.x). Add an `update-servers` initContainer running
`gluetun update -providers "private internet access"` into a shared /gluetun
emptyDir the main container reads, so it dials current servers. UPDATER_PERIOD
raised to 720h (docs-compliant) for ongoing in-pod refresh.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 platform/vpn-egress/gluetun-gateway.yaml | 25 +++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml
index ef8f81b..2c61991 100644
--- a/platform/vpn-egress/gluetun-gateway.yaml
+++ b/platform/vpn-egress/gluetun-gateway.yaml
@@ -27,6 +27,19 @@ spec:
       labels:
         app: gluetun
     spec:
+      initContainers:
+        # gluetun's BUNDLED PIA server list is STALE (retired 46.246.x IPs → timeouts; current PIA Sweden
+        # is 158.173.x), and UPDATER_PERIOD only refreshes AFTER the tunnel is ready (chicken-and-egg). So
+        # fetch PIA's CURRENT list into the shared /gluetun volume BEFORE the main container starts.
+        - name: update-servers
+          image: qmcgaw/gluetun:v3.41.0
+          args: ["update", "-providers", "private internet access"]
+          resources:
+            requests: { cpu: 25m, memory: 32Mi }
+            limits: { memory: 128Mi }
+          volumeMounts:
+            - name: gluetun-data
+              mountPath: /gluetun
       containers:
         - name: gluetun
           image: qmcgaw/gluetun:v3.41.0        # pinned; Renovate bumps. PIA is OpenVPN-only in Gluetun
@@ -40,12 +53,10 @@ spec:
               value: "private internet access"
             - name: VPN_TYPE
               value: "openvpn"               # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
-            # Root cause of the connection failures: gluetun's BUNDLED PIA server list was STALE — it dialed
-            # retired IPs (46.246.x → timeouts, which I initially mis-read as a network block). PIA's CURRENT
-            # Sweden servers are 158.173.x and are reachable; a fresh .ovpn connects fine. Enable the updater
-            # so gluetun fetches PIA's current server list at startup + periodically:
+            # Fresh server list comes from the update-servers initContainer (see above). UPDATER_PERIOD then
+            # keeps it fresh for long-running pods (gluetun docs: >=360h to be nice to the provider API):
             - name: UPDATER_PERIOD
-              value: "24h"
+              value: "720h"
             # Pod MTU is 1450 (Cilium VXLAN: 1500 − 50 encap; node/host/WAN are 1500). Shrink OpenVPN so
             # DATA-channel packets fit (the handshake is small so this wasn't the connect blocker, but the
             # data channel needs it). Hardcoded strings (int-coercion gotcha). See DECISIONS-LOG.
@@ -90,11 +101,15 @@ spec:
           volumeMounts:
             - name: tun
               mountPath: /dev/net/tun
+            - name: gluetun-data
+              mountPath: /gluetun            # shared with update-servers initContainer (fresh servers.json)
       volumes:
         - name: tun
           hostPath:
             path: /dev/net/tun
             type: CharDevice
+        - name: gluetun-data
+          emptyDir: {}
 ---
 # Control API Service — the port-sync helper (qbittorrent-natmap, README) reads the PIA-assigned
 # forwarded port from here; also used for tunnel-state health/alerting (ADR-0013 "alert on tunnel state").