jakman85andClaude Opus 4.8
91aa7acab8
PIA-provider server selection is flaky here (random dead IPs); the operator's .ovpn uses sweden.privacy.network (load-balanced, reliable). Switch to custom mode (VPN_SERVICE_PROVIDER=custom, OPENVPN_CUSTOM_CONFIG=/config/pia.ovpn), mount the pia-custom-ovpn Secret, keep creds + kill-switch + tun-mtu 1300. Drops PIA-provider server list/updater and native PF (Phase-6 concern). Pending the operator-provisioned pia-custom-ovpn Secret (not merged until it exists). Co-Authored-By: Claude Opus 4.8 <[email protected]>
29 lines
1.5 KiB
Plaintext
29 lines
1.5 KiB
Plaintext
# pia-custom-ovpn — the operator's PIA OpenVPN .ovpn file for gluetun custom-provider mode.
|
|
#
|
|
# WHY: gluetun's PIA-provider server selection random-picks server IPs, many of which don't answer
|
|
# this cluster's flows (intermittent TLS timeouts). The downloaded PIA .ovpn targets the load-balanced
|
|
# hostname `sweden.privacy.network`, which always lands on a healthy server (reliable on the host).
|
|
# See DECISIONS-LOG "Phase 3 VPN — custom .ovpn".
|
|
#
|
|
# The .ovpn should use `auth-user-pass` (no inline creds) — gluetun injects OPENVPN_USER/OPENVPN_PASSWORD
|
|
# from the pia-credentials Secret. It contains only the (public) CA cert + config, but we keep it in a
|
|
# SOPS-encrypted Secret for consistency.
|
|
#
|
|
# PROVISION (operator runs SOPS; agents never handle secret values):
|
|
# 1. Generate the Secret manifest straight from your .ovpn file:
|
|
# kubectl create secret generic pia-custom-ovpn -n vpn-egress \
|
|
# --from-file=pia.ovpn=/path/to/your-pia.ovpn \
|
|
# --dry-run=client -o yaml > platform/vpn-egress/pia-custom-ovpn.sops.yaml
|
|
# 2. Encrypt in place (matches .sops.yaml creation_rules for *.sops.yaml):
|
|
# sops -e -i platform/vpn-egress/pia-custom-ovpn.sops.yaml
|
|
# 3. Commit. Flux + the SOPS decryption provider apply it; gluetun mounts it at /config/pia.ovpn.
|
|
#
|
|
# The generated (pre-encryption) shape looks like:
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: pia-custom-ovpn
|
|
namespace: vpn-egress
|
|
data:
|
|
pia.ovpn: <base64 of the .ovpn file> # `kubectl create secret --from-file` fills this in for you
|