jakman85andClaude Opus 4.8
1a98429434
Per ADR-0013: platform/vpn-egress/ = a single shared Gluetun gateway (PIA over WireGuard, built-in kill-switch FIREWALL=on, native port forwarding), namespace (non-app, NET_ADMIN + /dev/net/tun), control-API Service, and a pre-wired (commented) pia-credentials SOPS line. Defined the PIA secret location (platform/vpn-egress, keys username/password → OPENVPN_USER/ OPENVPN_PASSWORD) and updated the SOPS template accordingly. NOT wired into platform/kustomization.yaml (Phase 3, author-first) — deploy needs PIA creds + validation of the egress-steering mechanism (Cilium Egress Gateway → the Gluetun node's wg0; documented in README with options + a fail-closed rationale, deliberately NOT committed as an untested CiliumEgressGatewayPolicy). WireGuard chosen (UDP, protocol != TCP); PIA supports it on all regions and the secret stays username/password. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
27 lines
1.3 KiB
Plaintext
27 lines
1.3 KiB
Plaintext
# =============================================================================
|
|
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
|
|
# and never auto-encrypted by SOPS). Reference scaffold only.
|
|
#
|
|
# (a) Copy to: platform/vpn-egress/pia-credentials.sops.yaml
|
|
# (b) kustomization: uncomment `- pia-credentials.sops.yaml` in platform/vpn-egress/kustomization.yaml
|
|
# (c) Encrypt: sops -e -i platform/vpn-egress/pia-credentials.sops.yaml
|
|
# (d) Consumed by: the Phase-3 Gluetun VPN egress gateway (platform/vpn-egress/gluetun-gateway.yaml),
|
|
# which maps username->OPENVPN_USER, password->OPENVPN_PASSWORD. [Phase 3]
|
|
#
|
|
# VALUE NOTES:
|
|
# - username: PIA (Private Internet Access) user, form pNNNNNNN.
|
|
# - password: PIA password.
|
|
# - Protocol is WireGuard (VPN_TYPE=wireguard, UDP — satisfies "not TCP"). PIA on WireGuard STILL
|
|
# authenticates with the username/password below (Gluetun derives the WireGuard config from PIA's
|
|
# API at runtime), so these two keys are correct as-is — no extra WireGuard key material needed.
|
|
# =============================================================================
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: pia-credentials
|
|
namespace: vpn-egress
|
|
type: Opaque
|
|
stringData:
|
|
username: REPLACE-ME
|
|
password: REPLACE-ME
|