From be1e31745648ebdf314eddc60bdb5c37fd49b6bd Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sun, 23 Aug 2026 00:18:03 -0500 Subject: [PATCH] fix(vpn): correct env name PRIVATE_INTERNET_ACCESS_OPENVPN_ENCRYPTION_PRESET MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gluetun silently ignored PIA_ENCRYPTION_PRESET (renamed) and defaulted to strong (RSA-4096) the whole time. The correct v3.x var is PRIVATE_INTERNET_ACCESS_OPENVPN_ENCRYPTION_PRESET=normal → RSA-2048/AES-128-CBC/1198, the smaller handshake that fits the 1450 pod MTU. Co-Authored-By: Claude Opus 4.8 --- platform/vpn-egress/gluetun-gateway.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml index ed4ebb7..92f95dd 100644 --- a/platform/vpn-egress/gluetun-gateway.yaml +++ b/platform/vpn-egress/gluetun-gateway.yaml @@ -53,7 +53,7 @@ spec: value: "private internet access" - name: VPN_TYPE value: "openvpn" # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended - - name: PIA_ENCRYPTION_PRESET + - name: PRIVATE_INTERNET_ACCESS_OPENVPN_ENCRYPTION_PRESET value: "normal" # PIA "normal": RSA-2048 + AES-128-CBC + SHA1, port 1198 (matches the # operator's downloaded lower-encryption .ovpn). Chosen over "strong" # (RSA-4096): the smaller handshake fits the pod's 1450 MTU (Cilium