From 741191a7e6dd0980cfcb752448f5b0e30c1d55c2 Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Tue, 14 Apr 2026 21:29:29 -0500 Subject: [PATCH] Switch workers to custom WireGuard provider with correct endpoint IPs gluetun's bundled protonvpn server list has stale IPs for US-TX#179 (37.19.200.26) and US-TX#220 (95.173.217.2). The WIREGUARD_ENDPOINT_IP env var is a filter not an override, so there's no way to redirect protonvpn provider to a new IP. Switch to custom WireGuard provider with hardcoded endpoint IPs from fresh ProtonVPN configs (95.173.217.29 / 146.70.58.130). Add DNS_KEEP_NAMESERVER=on so gluetun leaves k8s DNS intact instead of routing DNS through its own proxy (which breaks in-cluster). Port forwarding is not available with custom provider; will restore once gluetun releases an updated server list image. --- .../k8s/fornax/worker/base/deployment.yaml | 14 +++++--- .../overlays/worker-tx253/kustomization.yaml | 10 +++--- .../overlays/worker-tx34/kustomization.yaml | 10 +++--- servers/legion/k8s/media/fornax-workers.yaml | 32 ++++++++++++------- 4 files changed, 38 insertions(+), 28 deletions(-) diff --git a/servers/legion/k8s/fornax/worker/base/deployment.yaml b/servers/legion/k8s/fornax/worker/base/deployment.yaml index b1b0407..5a3a732 100644 --- a/servers/legion/k8s/fornax/worker/base/deployment.yaml +++ b/servers/legion/k8s/fornax/worker/base/deployment.yaml @@ -63,7 +63,7 @@ spec: - NET_ADMIN env: - name: VPN_SERVICE_PROVIDER - value: protonvpn + value: custom - name: VPN_TYPE value: wireguard - name: WIREGUARD_PRIVATE_KEY @@ -71,9 +71,15 @@ spec: secretKeyRef: name: fornax-worker-WORKER_ID-secrets key: PROTONVPN_PRIVATE_KEY - - name: SERVER_NAMES - value: PLACEHOLDER_SERVER_NAME - - name: VPN_PORT_FORWARDING + - name: WIREGUARD_PUBLIC_KEY + value: PLACEHOLDER_PUBLIC_KEY + - name: WIREGUARD_ADDRESSES + value: 10.2.0.2/32 + - name: VPN_ENDPOINT_IP + value: PLACEHOLDER_ENDPOINT_IP + - name: VPN_ENDPOINT_PORT + value: "51820" + - name: DNS_KEEP_NAMESERVER value: "on" - name: FIREWALL_OUTBOUND_SUBNETS value: 10.42.0.0/16,10.43.0.0/16 diff --git a/servers/legion/k8s/fornax/worker/overlays/worker-tx253/kustomization.yaml b/servers/legion/k8s/fornax/worker/overlays/worker-tx253/kustomization.yaml index b2b445a..5699521 100644 --- a/servers/legion/k8s/fornax/worker/overlays/worker-tx253/kustomization.yaml +++ b/servers/legion/k8s/fornax/worker/overlays/worker-tx253/kustomization.yaml @@ -25,12 +25,10 @@ patches: value: fornax-worker-tx253-secrets - op: replace path: /spec/template/spec/containers/0/env/3/value - value: US-TX#179 - - op: add - path: /spec/template/spec/containers/0/env/- - value: - name: WIREGUARD_ENDPOINT_IP - value: "95.173.217.29" + value: mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA= + - op: replace + path: /spec/template/spec/containers/0/env/5/value + value: "95.173.217.29" - op: replace path: /spec/template/spec/containers/1/env/1/value value: tx253 diff --git a/servers/legion/k8s/fornax/worker/overlays/worker-tx34/kustomization.yaml b/servers/legion/k8s/fornax/worker/overlays/worker-tx34/kustomization.yaml index 11fb365..1edcfea 100644 --- a/servers/legion/k8s/fornax/worker/overlays/worker-tx34/kustomization.yaml +++ b/servers/legion/k8s/fornax/worker/overlays/worker-tx34/kustomization.yaml @@ -25,12 +25,10 @@ patches: value: fornax-worker-tx34-secrets - op: replace path: /spec/template/spec/containers/0/env/3/value - value: US-TX#220 - - op: add - path: /spec/template/spec/containers/0/env/- - value: - name: WIREGUARD_ENDPOINT_IP - value: "146.70.58.130" + value: wqJcz4akzVFxx35aJ5B7G/IJ9qsRvpcGNub3rLHcqXo= + - op: replace + path: /spec/template/spec/containers/0/env/5/value + value: "146.70.58.130" - op: replace path: /spec/template/spec/containers/1/env/1/value value: tx34 diff --git a/servers/legion/k8s/media/fornax-workers.yaml b/servers/legion/k8s/media/fornax-workers.yaml index 673e27f..8497eb1 100644 --- a/servers/legion/k8s/media/fornax-workers.yaml +++ b/servers/legion/k8s/media/fornax-workers.yaml @@ -92,7 +92,7 @@ spec: add: ["NET_ADMIN"] env: - name: VPN_SERVICE_PROVIDER - value: "protonvpn" + value: "custom" - name: VPN_TYPE value: "wireguard" - name: WIREGUARD_PRIVATE_KEY @@ -100,14 +100,18 @@ spec: secretKeyRef: name: fornax-worker-tx253-secrets key: PROTONVPN_PRIVATE_KEY - - name: SERVER_NAMES - value: "US-TX#179" - - name: VPN_PORT_FORWARDING + - name: WIREGUARD_PUBLIC_KEY + value: "mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA=" + - name: WIREGUARD_ADDRESSES + value: "10.2.0.2/32" + - name: VPN_ENDPOINT_IP + value: "95.173.217.29" + - name: VPN_ENDPOINT_PORT + value: "51820" + - name: DNS_KEEP_NAMESERVER value: "on" - name: FIREWALL_OUTBOUND_SUBNETS value: "10.42.0.0/16,10.43.0.0/16" - - name: WIREGUARD_ENDPOINT_IP - value: "95.173.217.29" volumeMounts: - name: gluetun-data mountPath: /tmp/gluetun @@ -300,7 +304,7 @@ spec: add: ["NET_ADMIN"] env: - name: VPN_SERVICE_PROVIDER - value: "protonvpn" + value: "custom" - name: VPN_TYPE value: "wireguard" - name: WIREGUARD_PRIVATE_KEY @@ -308,14 +312,18 @@ spec: secretKeyRef: name: fornax-worker-tx34-secrets key: PROTONVPN_PRIVATE_KEY - - name: SERVER_NAMES - value: "US-TX#220" - - name: VPN_PORT_FORWARDING + - name: WIREGUARD_PUBLIC_KEY + value: "wqJcz4akzVFxx35aJ5B7G/IJ9qsRvpcGNub3rLHcqXo=" + - name: WIREGUARD_ADDRESSES + value: "10.2.0.2/32" + - name: VPN_ENDPOINT_IP + value: "146.70.58.130" + - name: VPN_ENDPOINT_PORT + value: "51820" + - name: DNS_KEEP_NAMESERVER value: "on" - name: FIREWALL_OUTBOUND_SUBNETS value: "10.42.0.0/16,10.43.0.0/16" - - name: WIREGUARD_ENDPOINT_IP - value: "146.70.58.130" volumeMounts: - name: gluetun-data mountPath: /tmp/gluetun