will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch fornax workers to custom WireGuard provider with correct server keys

Browse Source 
The protonvpn provider mode uses gluetun's embedded server database which
doesn't contain US-TX#253 or US-TX#34. Our WireGuard keys are registered
for specific ProtonVPN servers, so connecting to other servers (US-TX#179,
US-TX#220) results in successful WireGuard handshake but ProtonVPN drops all
internet-bound traffic.

Fix: use VPN_SERVICE_PROVIDER=custom to directly configure the correct server
peer public key and endpoint IP for each worker. ExternalSecrets updated to
also pull public_key and endpoint_ip from Vault.

- tx253: endpoint=95.173.217.29, peer=mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA=
- tx34: endpoint=146.70.58.130, peer=wqJcz4akzVFxx35aJ5B7G/IJ9qsRvpcGNub3rLHcqXo=
This commit is contained in:
Will Anderson
2026-04-15 03:21:26 -05:00
parent 8a111a13b9
commit 8a43279164
2 changed files with 46 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/legion/k8s/media/fornax-external-secrets.yaml
+16
View File
@@ -18,6 +18,14 @@ spec:
remoteRef:
key: secret/data/fornax/worker-tx253
property: private_key
- secretKey: PROTONVPN_PEER_PUBLIC_KEY
remoteRef:
key: secret/data/fornax/worker-tx253
property: public_key
- secretKey: PROTONVPN_ENDPOINT_IP
remoteRef:
key: secret/data/fornax/worker-tx253
property: endpoint_ip
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
@@ -37,3 +45,11 @@ spec:
remoteRef:
key: secret/data/fornax/worker-tx34
property: private_key
- secretKey: PROTONVPN_PEER_PUBLIC_KEY
remoteRef:
key: secret/data/fornax/worker-tx34
property: public_key
- secretKey: PROTONVPN_ENDPOINT_IP
remoteRef:
key: secret/data/fornax/worker-tx34
property: endpoint_ip
servers/legion/k8s/media/fornax-workers.yaml
+30 -12
View File
@@ -92,7 +92,7 @@ spec:
add: ["NET_ADMIN"]
env:
- name: VPN_SERVICE_PROVIDER
value: "protonvpn"
value: "custom"
- name: VPN_TYPE
value: "wireguard"
- name: WIREGUARD_PRIVATE_KEY
@@ -100,12 +100,20 @@ spec:
secretKeyRef:
name: fornax-worker-tx253-secrets
key: PROTONVPN_PRIVATE_KEY
- name: SERVER_NAMES
value: "US-TX#179"
- name: VPN_PORT_FORWARDING
value: "off"
- name: UPDATER_PERIOD
value: "2m"
- name: WIREGUARD_PUBLIC_KEY
valueFrom:
secretKeyRef:
name: fornax-worker-tx253-secrets
key: PROTONVPN_PEER_PUBLIC_KEY
- name: WIREGUARD_ENDPOINT_IP
valueFrom:
secretKeyRef:
name: fornax-worker-tx253-secrets
key: PROTONVPN_ENDPOINT_IP
- name: WIREGUARD_ENDPOINT_PORT
value: "51820"
- name: WIREGUARD_ADDRESSES
value: "10.2.0.2/32"
- name: DOT
value: "off"
- name: DNS_UPSTREAM_RESOLVER_TYPE
@@ -344,7 +352,7 @@ spec:
add: ["NET_ADMIN"]
env:
- name: VPN_SERVICE_PROVIDER
value: "protonvpn"
value: "custom"
- name: VPN_TYPE
value: "wireguard"
- name: WIREGUARD_PRIVATE_KEY
@@ -352,10 +360,20 @@ spec:
secretKeyRef:
name: fornax-worker-tx34-secrets
key: PROTONVPN_PRIVATE_KEY
- name: SERVER_NAMES
value: "US-TX#220"
- name: VPN_PORT_FORWARDING
value: "on"
- name: WIREGUARD_PUBLIC_KEY
valueFrom:
secretKeyRef:
name: fornax-worker-tx34-secrets
key: PROTONVPN_PEER_PUBLIC_KEY
- name: WIREGUARD_ENDPOINT_IP
valueFrom:
secretKeyRef:
name: fornax-worker-tx34-secrets
key: PROTONVPN_ENDPOINT_IP
- name: WIREGUARD_ENDPOINT_PORT
value: "51820"
- name: WIREGUARD_ADDRESSES
value: "10.2.0.2/32"
- name: DOT
value: "off"
- name: DNS_UPSTREAM_RESOLVER_TYPE