jakman85andClaude Opus 4.8
1a98429434
Per ADR-0013: platform/vpn-egress/ = a single shared Gluetun gateway (PIA over WireGuard, built-in kill-switch FIREWALL=on, native port forwarding), namespace (non-app, NET_ADMIN + /dev/net/tun), control-API Service, and a pre-wired (commented) pia-credentials SOPS line. Defined the PIA secret location (platform/vpn-egress, keys username/password → OPENVPN_USER/ OPENVPN_PASSWORD) and updated the SOPS template accordingly. NOT wired into platform/kustomization.yaml (Phase 3, author-first) — deploy needs PIA creds + validation of the egress-steering mechanism (Cilium Egress Gateway → the Gluetun node's wg0; documented in README with options + a fail-closed rationale, deliberately NOT committed as an untested CiliumEgressGatewayPolicy). WireGuard chosen (UDP, protocol != TCP); PIA supports it on all regions and the secret stays username/password. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
12 lines
492 B
YAML
12 lines
492 B
YAML
---
|
|
# vpn-egress — the single shared VPN egress gateway namespace (ADR-0013, docs/03).
|
|
# Platform INFRA, not an application namespace: the Gluetun gateway needs NET_ADMIN + /dev/net/tun,
|
|
# so this ns is deliberately NOT labeled `app-namespace=true` (Kyverno restrict-host-namespaces /
|
|
# require-*-label policies scope to app namespaces only — see platform/kyverno).
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: vpn-egress
|
|
labels:
|
|
homelab.keithjackson.dev/app-namespace: "false"
|