Amend ADR-0013: VPN protocol WireGuard -> OpenVPN-UDP (Gluetun lacks PIA+WG)

Gluetun does not support Private Internet Access over WireGuard (upstream:
native support "cannot be added... slow work in progress"; confirmed live
rejecting the provider on v3.40/v3.41/latest). PIA in Gluetun is OpenVPN-only.

Amend ADR-0013 to PIA over OpenVPN-UDP. The egress ARCHITECTURE is unchanged
(single shared gateway, central kill-switch/fail-closed, native PF, Cilium
egress steering, active/standby) and R-NET-05/06/07 remain met; only the tunnel
protocol changes. OpenVPN-UDP satisfies "non-TCP", and Gluetun's HTTP control
API (health + forwarded-port lookup) is what the shared-gateway topology needs.
thrnz/docker-wireguard-pia retained as a documented WireGuard fallback.

Propagated the protocol correction to all active specs: ADR-0013 (+amendment
note), decisions/README, docs/00, docs/01, docs/03, docs/07, agents/task-board.
Superseded ADR-0008/0012 left immutable as historical record.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

docs/00-vision-and-scope.md

@@ -209,7 +209,7 @@ implementation.
   metadata DB still lives on replicated Longhorn. The **off-cluster DR backup target** (for app
   config, Nextcloud, Gitea, etc.) remains to be chosen at Phase 4. See [`04`](04-storage-and-state.md).
 - **OQ-3 (VPN)** — **RESOLVED**: **PIA** via Gluetun, cluster-provisioned, **single shared
-  in-cluster tunnel** over **WireGuard** (non-TCP), native port forwarding, rules enforced outside
+  in-cluster tunnel** over **OpenVPN-UDP** (non-TCP), native port forwarding, rules enforced outside
   the service (ADR-0013, supersedes ADR-0012's ExpressVPN choice). See
   [`03`](03-networking-isolation-and-egress.md).
 

docs/01-architecture-overview.md

@@ -15,7 +15,7 @@ choice here without a superseding ADR.**
 | VM workloads (IaaS) | **KubeVirt** (+ CDI) | R-PLAT-03 | [ADR-0005](../decisions/adr-0005-vm-workloads-kubevirt.md) | [06](06-vm-workloads-kubevirt.md) |
 | TLS | **cert-manager** + Let's Encrypt (DNS-01) | R-TLS-01..03 | [ADR-0006](../decisions/adr-0006-tls-cert-manager-letsencrypt.md) | [08](08-tls-and-certificates.md) |
 | Secrets | **SOPS + age** (Flux-native) | R-SEC-01 | [ADR-0007](../decisions/adr-0007-secrets-sops-age.md) | [07](07-security-and-secrets.md) |
-| VPN egress | **Single shared in-cluster PIA/Gluetun gateway** (WireGuard + native PF) + Cilium Egress Gateway | R-NET-05/06/07 | [ADR-0013](../decisions/adr-0013-vpn-provider-pia-gluetun-wireguard.md) (supersedes 0012/0008) | [03](03-networking-isolation-and-egress.md) |
+| VPN egress | **Single shared in-cluster PIA/Gluetun gateway** (OpenVPN-UDP + native PF) + Cilium Egress Gateway | R-NET-05/06/07 | [ADR-0013](../decisions/adr-0013-vpn-provider-pia-gluetun-wireguard.md) (supersedes 0012/0008) | [03](03-networking-isolation-and-egress.md) |
 | Automated updates | **Flux image-update-automation** (images) + **Renovate** (charts) | R-UPD-01..03 | [ADR-0009](../decisions/adr-0009-automated-image-updates.md) | [11](11-automated-updates.md) |
 | DNS records | **ExternalDNS** (public via Cloudflare) + **PiHole** (internal) | R-DNS-01..03 | — | [09](09-dns-and-ingress.md) |
 | Ingress (north-south) | **Gateway API** implemented by Cilium | R-DNS-01, R-TLS-01 | [ADR-0002](../decisions/adr-0002-cni-cilium.md) | [09](09-dns-and-ingress.md) |

docs/03-networking-isolation-and-egress.md

@@ -93,7 +93,8 @@ shared VPN connection** — not a per-service sidecar — so that **network rule
 the service**:
 
 - **One in-cluster VPN egress gateway** (an HA-capable Deployment) runs **Gluetun** configured for
-  **PIA over WireGuard** (UDP — "non-TCP or better"). The cluster provisions and controls the tunnel
+  **PIA over OpenVPN-UDP** ("non-TCP or better"; WireGuard is not supported for PIA in Gluetun —
+  ADR-0013 amendment). The cluster provisions and controls the tunnel
   (nothing on the edge router). Gluetun provides the built-in **kill-switch/firewall**, health
   checks, and auto-reconnect.
 - **`vpn`-class pods are steered through the gateway** (Cilium Egress Gateway / routing); they have
@@ -138,7 +139,7 @@ Exposure is a declared property: `internal` (LAN-only) vs `public` (port-forward
 ## Resolved
 - **OQ-1** — one commercial WAN, no multi-ISP plans; dumb SOHO edge (no VLAN/VPN/services). All
   segmentation + VPN in-cluster; edge does NAT + port-forward only. Multi-ISP routing out of scope.
-- **OQ-3** — **PIA** via Gluetun, single shared in-cluster tunnel over **WireGuard**, native port
+- **OQ-3** — **PIA** via Gluetun, single shared in-cluster tunnel over **OpenVPN-UDP**, native port
   forwarding, rules enforced outside the service (ADR-0013, supersedes ADR-0012's ExpressVPN choice).
 
 ## Open questions

docs/07-security-and-secrets.md

@@ -47,7 +47,7 @@ Defense in depth with declarative, auditable controls:
   [AGENTS.md §5](../AGENTS.md)).
 
 ### Secret categories to manage
-- VPN credentials (PIA username/password; WireGuard) for the egress model (ADR-0013).
+- VPN credentials (PIA username/password; OpenVPN-UDP) for the egress model (ADR-0013).
 - Keycloak admin credential and per-service **OIDC client secrets** ([15](15-identity-and-access.md)).
 - DNS provider API token (Cloudflare) for ACME DNS-01 + ExternalDNS.
 - SMTP credentials for Alertmanager email.