fix(vpn): PIA OpenVPN on UDP/53 (avoid home WAN:1197 conflict); re-enable vpn-egress

Operator identified the block: the home network NATs its own OpenVPN server on
WAN:1197, colliding with the cluster's outbound PIA-on-1197 flow (port-specific,
not a general UDP block — UDP/53 worked in tcpdump). PIA accepts OpenVPN on
53/1194/1197/1198/8080/9201; chose 53 (empirically proven to traverse this net).

- cluster-vars: add PIA_OPENVPN_PORT="53"
- gluetun: OPENVPN_ENDPOINT_PORT=${PIA_OPENVPN_PORT}
- re-enable vpn-egress; DECISIONS-LOG resolution noted

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/kustomization.yaml

@@ -17,13 +17,10 @@ resources:
   - cert-manager       # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
   - externaldns        # auto DNS records — needs SOPS `cloudflare-api-token`
   - gateway            # Gateway API listeners (ingress; replaces Traefik)
-  # ---- Phase 3 — Egress / VPN — config COMPLETE + CORRECT (OpenVPN-UDP, SE Stockholm), but the tunnel
-  #      is BLOCKED by the ENVIRONMENT: gluetun's OpenVPN UDP/1197 packets to PIA leave the cluster
-  #      correctly (pod→node→host→WiFi, SNAT 192.168.2.103) but NO replies ever return to the host,
-  #      while host UDP/53 works — so the home router/ISP on the 192.168.2.x WiFi net drops OpenVPN
-  #      UDP. Disabled to avoid a crashloop firing false alerts. Re-enable once the network is fixed
-  #      (see DECISIONS-LOG "Phase 3 VPN — tunnel BLOCKED by home network"). ----
-  # - vpn-egress       # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)
+  # ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port ${PIA_OPENVPN_PORT}=53, ADR-0013 amendment).
+  #      NOT PIA's default 1197 — this home network NATs its own OpenVPN server on WAN:1197, which
+  #      collided with the outbound PIA-on-1197 flow (tcpdump-confirmed; DECISIONS-LOG). ----
+  - vpn-egress         # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)
   # ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
   - monitoring         # kube-prometheus-stack + Loki + Alloy + Alertmanager
   # ---- Later phases: enabled when their phase opens ----

platform/vpn-egress/gluetun-gateway.yaml

@@ -40,6 +40,9 @@ spec:
               value: "private internet access"
             - name: VPN_TYPE
               value: "openvpn"               # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
+            - name: OPENVPN_ENDPOINT_PORT
+              value: "${PIA_OPENVPN_PORT}"   # NOT 1197 — the home network NATs its own OpenVPN server there,
+                                             # so PIA-on-1197 replies never return (see cluster-vars + DECISIONS-LOG)
             # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
             - name: OPENVPN_USER
               valueFrom: