Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 2 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(vpn): custom mode with IP-based .ovpn; gluetun v3.41.0 -> v3.41.3

Browse Source 
Operator provides a new .ovpn with an IP remote (gluetun's custom parser rejects
hostnames), so drop the resolve-remote initContainer/VPN_ENDPOINT_IP attempts and
mount the .ovpn directly (key pia.ovpn). Bump image to latest v3.41.3.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-23 00:57:01 -05:00
1 parent 3787644c48
commit c8b9653e33
1 file changed
+9 -18
Download Patch File Download Diff File Expand all files Collapse all files
platform/vpn-egress/gluetun-gateway.yaml
+9 -18
View File
@@ -5,14 +5,13 @@
#
# CUSTOM-PROVIDER mode (DECISIONS-LOG "Phase 3 VPN — custom .ovpn"): gluetun's PIA-provider server
# selection random-picks server IPs, many of which don't answer this cluster's flows (intermittent
# TLS timeouts — verified by packet capture: the pod CAN complete a full handshake, but only against
# responsive servers). The operator's downloaded PIA `.ovpn` targets `sweden.privacy.network` — a
# load-balanced hostname that always lands on a healthy server (reliable in GNOME on the host). So we
# feed gluetun that exact `.ovpn`. Trade-off: custom mode loses gluetun's PIA-native port forwarding
# (needed only at Phase 6 for qBittorrent) — revisit then.
# TLS timeouts — verified by packet capture: the pod CAN complete a full handshake, only against
# responsive servers). So we feed gluetun the operator's own PIA `.ovpn`, which pins a known-healthy
# Stockholm server IP (gluetun's custom parser requires an IP `remote`, not a hostname). Trade-off:
# custom mode loses gluetun's PIA-native port forwarding (Phase-6/qBittorrent concern) — revisit then.
#
# Credentials: `pia-credentials` SOPS Secret (username/password) → OPENVPN_USER/OPENVPN_PASSWORD (the
# .ovpn uses auth-user-pass). Config: `pia-custom-ovpn` SOPS Secret (the .ovpn file), mounted at
# .ovpn uses auth-user-pass). Config: `pia-custom-ovpn` SOPS Secret (key `pia.ovpn`), mounted at
# /config/pia.ovpn. Both operator-provisioned.
apiVersion: apps/v1
kind: Deployment
@@ -35,24 +34,17 @@ spec:
spec:
containers:
- name: gluetun
image: qmcgaw/gluetun:v3.41.0 # pinned; Renovate bumps.
image: qmcgaw/gluetun:v3.41.3 # pinned; Renovate bumps.
securityContext:
capabilities:
add: ["NET_ADMIN"] # required for the tunnel + firewall
env:
- name: VPN_SERVICE_PROVIDER
value: "custom" # custom .ovpn (sweden.privacy.network) — see header + DECISIONS-LOG
value: "custom" # custom .ovpn — see header + DECISIONS-LOG
- name: VPN_TYPE
value: "openvpn"
- name: OPENVPN_CUSTOM_CONFIG
value: "/config/pia.ovpn" # the operator's PIA .ovpn (pia-custom-ovpn Secret)
# gluetun's custom parser needs an IP (not the .ovpn's `remote sweden.privacy.network`
# hostname). sweden.privacy.network's load-balanced pool is 158.173.241.{22,34,55,112,239};
# pin a currently-healthy one. NOTE: if PIA rotates it out, re-resolve + update.
- name: VPN_ENDPOINT_IP
value: "158.173.241.22"
- name: VPN_ENDPOINT_PORT
value: "1198"
value: "/config/pia.ovpn" # the operator's PIA .ovpn (pia-custom-ovpn Secret, IP remote)
# PIA username/password for the .ovpn's auth-user-pass (pia-credentials SOPS Secret):
- name: OPENVPN_USER
valueFrom:
@@ -108,8 +100,7 @@ spec:
secret:
secretName: pia-custom-ovpn
items:
# the operator's secret keyed the .ovpn by its filename; map it to /config/pia.ovpn
- key: sweden-aes-128-cbc-udp-dns.ovpn
- key: pia.ovpn
path: pia.ovpn
---
# Control API Service — used for tunnel-state health/alerting (ADR-0013 "alert on tunnel state").