# pia-custom-ovpn — the operator's PIA OpenVPN .ovpn file for gluetun custom-provider mode.
#
# WHY: gluetun's PIA-provider server selection random-picks server IPs, many of which don't answer
# this cluster's flows (intermittent TLS timeouts). The downloaded PIA .ovpn targets the load-balanced
# hostname `sweden.privacy.network`, which always lands on a healthy server (reliable on the host).
# See DECISIONS-LOG "Phase 3 VPN — custom .ovpn".
#
# The .ovpn should use `auth-user-pass` (no inline creds) — gluetun injects OPENVPN_USER/OPENVPN_PASSWORD
# from the pia-credentials Secret. It contains only the (public) CA cert + config, but we keep it in a
# SOPS-encrypted Secret for consistency.
#
# PROVISION (operator runs SOPS; agents never handle secret values):
#   1. Generate the Secret manifest straight from your .ovpn file:
#        kubectl create secret generic pia-custom-ovpn -n vpn-egress \
#          --from-file=pia.ovpn=/path/to/your-pia.ovpn \
#          --dry-run=client -o yaml > platform/vpn-egress/pia-custom-ovpn.sops.yaml
#   2. Encrypt in place (matches .sops.yaml creation_rules for *.sops.yaml):
#        sops -e -i platform/vpn-egress/pia-custom-ovpn.sops.yaml
#   3. Commit. Flux + the SOPS decryption provider apply it; gluetun mounts it at /config/pia.ovpn.
#
# The generated (pre-encryption) shape looks like:
apiVersion: v1
kind: Secret
metadata:
  name: pia-custom-ovpn
  namespace: vpn-egress
data:
  pia.ovpn: <base64 of the .ovpn file>   # `kubectl create secret --from-file` fills this in for you