will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch workers to custom WireGuard provider with correct endpoint IPs

Browse Source 
gluetun's bundled protonvpn server list has stale IPs for US-TX#179
(37.19.200.26) and US-TX#220 (95.173.217.2). The WIREGUARD_ENDPOINT_IP
env var is a filter not an override, so there's no way to redirect
protonvpn provider to a new IP.

Switch to custom WireGuard provider with hardcoded endpoint IPs from
fresh ProtonVPN configs (95.173.217.29 / 146.70.58.130). Add
DNS_KEEP_NAMESERVER=on so gluetun leaves k8s DNS intact instead of
routing DNS through its own proxy (which breaks in-cluster).

Port forwarding is not available with custom provider; will restore
once gluetun releases an updated server list image.
This commit is contained in:
Will Anderson
2026-04-14 21:29:29 -05:00
parent 0688700ebc
commit 741191a7e6
4 changed files with 38 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/legion/k8s/fornax/worker/base/deployment.yaml
+10 -4
View File
@@ -63,7 +63,7 @@ spec:
- NET_ADMIN
env:
- name: VPN_SERVICE_PROVIDER
value: protonvpn
value: custom
- name: VPN_TYPE
value: wireguard
- name: WIREGUARD_PRIVATE_KEY
@@ -71,9 +71,15 @@ spec:
secretKeyRef:
name: fornax-worker-WORKER_ID-secrets
key: PROTONVPN_PRIVATE_KEY
- name: SERVER_NAMES
value: PLACEHOLDER_SERVER_NAME
- name: VPN_PORT_FORWARDING
- name: WIREGUARD_PUBLIC_KEY
value: PLACEHOLDER_PUBLIC_KEY
- name: WIREGUARD_ADDRESSES
value: 10.2.0.2/32
- name: VPN_ENDPOINT_IP
value: PLACEHOLDER_ENDPOINT_IP
- name: VPN_ENDPOINT_PORT
value: "51820"
- name: DNS_KEEP_NAMESERVER
value: "on"
- name: FIREWALL_OUTBOUND_SUBNETS
value: 10.42.0.0/16,10.43.0.0/16
servers/legion/k8s/fornax/worker/overlays/worker-tx253/kustomization.yaml
+4 -6
View File
@@ -25,12 +25,10 @@ patches:
value: fornax-worker-tx253-secrets
- op: replace
path: /spec/template/spec/containers/0/env/3/value
value: US-TX#179
- op: add
path: /spec/template/spec/containers/0/env/-
value:
name: WIREGUARD_ENDPOINT_IP
value: "95.173.217.29"
value: mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA=
- op: replace
path: /spec/template/spec/containers/0/env/5/value
value: "95.173.217.29"
- op: replace
path: /spec/template/spec/containers/1/env/1/value
value: tx253
servers/legion/k8s/fornax/worker/overlays/worker-tx34/kustomization.yaml
+4 -6
View File
@@ -25,12 +25,10 @@ patches:
value: fornax-worker-tx34-secrets
- op: replace
path: /spec/template/spec/containers/0/env/3/value
value: US-TX#220
- op: add
path: /spec/template/spec/containers/0/env/-
value:
name: WIREGUARD_ENDPOINT_IP
value: "146.70.58.130"
value: wqJcz4akzVFxx35aJ5B7G/IJ9qsRvpcGNub3rLHcqXo=
- op: replace
path: /spec/template/spec/containers/0/env/5/value
value: "146.70.58.130"
- op: replace
path: /spec/template/spec/containers/1/env/1/value
value: tx34
servers/legion/k8s/media/fornax-workers.yaml
+20 -12
View File
@@ -92,7 +92,7 @@ spec:
add: ["NET_ADMIN"]
env:
- name: VPN_SERVICE_PROVIDER
value: "protonvpn"
value: "custom"
- name: VPN_TYPE
value: "wireguard"
- name: WIREGUARD_PRIVATE_KEY
@@ -100,14 +100,18 @@ spec:
secretKeyRef:
name: fornax-worker-tx253-secrets
key: PROTONVPN_PRIVATE_KEY
- name: SERVER_NAMES
value: "US-TX#179"
- name: VPN_PORT_FORWARDING
- name: WIREGUARD_PUBLIC_KEY
value: "mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA="
- name: WIREGUARD_ADDRESSES
value: "10.2.0.2/32"
- name: VPN_ENDPOINT_IP
value: "95.173.217.29"
- name: VPN_ENDPOINT_PORT
value: "51820"
- name: DNS_KEEP_NAMESERVER
value: "on"
- name: FIREWALL_OUTBOUND_SUBNETS
value: "10.42.0.0/16,10.43.0.0/16"
- name: WIREGUARD_ENDPOINT_IP
value: "95.173.217.29"
volumeMounts:
- name: gluetun-data
mountPath: /tmp/gluetun
@@ -300,7 +304,7 @@ spec:
add: ["NET_ADMIN"]
env:
- name: VPN_SERVICE_PROVIDER
value: "protonvpn"
value: "custom"
- name: VPN_TYPE
value: "wireguard"
- name: WIREGUARD_PRIVATE_KEY
@@ -308,14 +312,18 @@ spec:
secretKeyRef:
name: fornax-worker-tx34-secrets
key: PROTONVPN_PRIVATE_KEY
- name: SERVER_NAMES
value: "US-TX#220"
- name: VPN_PORT_FORWARDING
- name: WIREGUARD_PUBLIC_KEY
value: "wqJcz4akzVFxx35aJ5B7G/IJ9qsRvpcGNub3rLHcqXo="
- name: WIREGUARD_ADDRESSES
value: "10.2.0.2/32"
- name: VPN_ENDPOINT_IP
value: "146.70.58.130"
- name: VPN_ENDPOINT_PORT
value: "51820"
- name: DNS_KEEP_NAMESERVER
value: "on"
- name: FIREWALL_OUTBOUND_SUBNETS
value: "10.42.0.0/16,10.43.0.0/16"
- name: WIREGUARD_ENDPOINT_IP
value: "146.70.58.130"
volumeMounts:
- name: gluetun-data
mountPath: /tmp/gluetun