fix(vpn): shrink OpenVPN tun-mtu/mssfix to 1350 (Cilium VXLAN pod MTU 1450)

Actual root cause (operator-directed layered MTU check): Cilium runs VXLAN (routing-mode tunnel) so pods get MTU 1450 (1500-50 encap) while node, hypervisor, and the Google Fiber WAN are all 1500. OpenVPN's ~1500-byte handshake packets exceed 1450 and are dropped (PMTUD broken). The ports were a red herring. Fix: OPENVPN_MTU=1350 + OPENVPN_MSSFIX=1350 so encrypted packets (~1402) fit under 1450. Keeps OpenVPN + VXLAN unchanged. Re-enable vpn-egress. Full layered trace (pod/node/host) in DECISIONS-LOG. Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-22 18:03:46 -05:00
1 parent 5a8fd4f20a
commit f17c46b767
@@ -17,13 +17,11 @@ resources:
  - cert-manager       # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
  - externaldns        # auto DNS records — needs SOPS `cloudflare-api-token`
  - gateway            # Gateway API listeners (ingress; replaces Traefik)
-  # ---- Phase 3 — Egress / VPN — DISABLED, ESCALATED for an architect decision. OpenVPN via Gluetun
-  #      cannot connect on this network: 1197 conflicts with the home OpenVPN server; 53 is DNS-
-  #      intercepted; 8080 reaches TLS but the handshake fails across servers (MTU on WiFi+triple-NAT).
-  #      NTP/123 works, so it's OpenVPN-specific, not a UDP block. Recommendation: pivot to WireGuard
-  #      via thrnz/docker-wireguard-pia (PIA WG = UDP 1337, small MTU-robust handshake, ADR-0013's
-  #      documented fallback, operator's original preference). See DECISIONS-LOG "Phase 3 VPN". ----
-  # - vpn-egress       # re-enable after the architect decision (thrnz/WireGuard build)
+  # ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP, ADR-0013 amendment). Root cause of earlier failures:
+  #      Cilium VXLAN gives pods MTU 1450 (node/host/WAN all 1500), so OpenVPN's 1500-byte handshake
+  #      packets were dropped. Fix: OPENVPN_MTU/MSSFIX=1350 in gluetun-gateway.yaml so packets fit 1450.
+  #      See DECISIONS-LOG "Phase 3 VPN". ----
+  - vpn-egress         # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)
  # ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
  - monitoring         # kube-prometheus-stack + Loki + Alloy + Alertmanager
  # ---- Later phases: enabled when their phase opens ----