Operator turned off ExpressVPN auto-renew and purchased PIA. The single-shared-
gateway model is retained; provider/client/protocol change to PIA via Gluetun
over WireGuard with native port forwarding (qbittorrent-natmap port-sync).
Simpler than ExpressVPN: no custom OpenVPN config, just PIA user/pass
SOPS-encrypted; Gluetun provides the built-in kill-switch.
Updated: ADR-0013 (new) + ADR-0012 superseded + index; docs 00,01,03,07;
task board (T-3.2p/T-3.2, OQ-3).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Operator chose Option A. cert-manager solves ACME DNS-01 and ExternalDNS
manages *.home.keithjackson.dev records via a scoped Cloudflare token
(Zone.DNS.Edit, keithjackson.dev), stored SOPS-encrypted. Operator provides
the token once (new prereq T-2.4p); T-2.4/T-2.5 unblocked. Only OQ-BKP
(off-cluster DR backup target, Phase 4) remains open.
Updated: docs 00,08,09; task board.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Fold operator answers to OQ-1/2/3 into the specs; refine OQ-4 to the one
remaining decision (ACME DNS-01 access). ADR-0012 supersedes ADR-0008.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Operator answers folded into the specs:
- OQ-3 VPN: ExpressVPN, cluster-controlled SINGLE shared in-cluster tunnel
(OpenVPN UDP / non-TCP), rules enforced outside the service. New ADR-0012
supersedes ADR-0008 (Gluetun-sidecar default dropped). Central kill-switch.
- OQ-1 WAN/edge: one commercial WAN, no multi-ISP plans; dumb SOHO edge (no
VLAN/VPN/services). Multi-WAN out of scope; segmentation + VPN in-cluster;
edge = NAT + manual port-forward. Gateway VIP resolved to Cilium L2
announcement. T-3.3 marked won't-do.
- OQ-2 storage: bulk media lives outside the cluster (backing TBD, non-blocking)
via a 'bulk' external-mount indirection; Plex metadata DB stays on Longhorn.
Split out a separate OQ-BKP for the off-cluster DR backup target (Phase 4).
- OQ-4 refined: wildcard record covers reachability but NOT ACME DNS-01 (needs
TXT-write access) and does not match *.home.* depth. Still OPEN: Cloudflare
API token (Option A) vs acme-dns delegation (Option B). T-2.4/T-2.5 blocked.
Updated: docs 00,01,03,04,08,09; ADR-0008/0012 + index; task board.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
jakman85andClaude Opus 4.8