From 8a432791646422a6ab34997e1a624147bed716f2 Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Wed, 15 Apr 2026 03:21:26 -0500 Subject: [PATCH] Switch fornax workers to custom WireGuard provider with correct server keys The protonvpn provider mode uses gluetun's embedded server database which doesn't contain US-TX#253 or US-TX#34. Our WireGuard keys are registered for specific ProtonVPN servers, so connecting to other servers (US-TX#179, US-TX#220) results in successful WireGuard handshake but ProtonVPN drops all internet-bound traffic. Fix: use VPN_SERVICE_PROVIDER=custom to directly configure the correct server peer public key and endpoint IP for each worker. ExternalSecrets updated to also pull public_key and endpoint_ip from Vault. - tx253: endpoint=95.173.217.29, peer=mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA= - tx34: endpoint=146.70.58.130, peer=wqJcz4akzVFxx35aJ5B7G/IJ9qsRvpcGNub3rLHcqXo= --- .../k8s/media/fornax-external-secrets.yaml | 16 +++++++ servers/legion/k8s/media/fornax-workers.yaml | 42 +++++++++++++------ 2 files changed, 46 insertions(+), 12 deletions(-) diff --git a/servers/legion/k8s/media/fornax-external-secrets.yaml b/servers/legion/k8s/media/fornax-external-secrets.yaml index e5d67a0..bbc8900 100644 --- a/servers/legion/k8s/media/fornax-external-secrets.yaml +++ b/servers/legion/k8s/media/fornax-external-secrets.yaml @@ -18,6 +18,14 @@ spec: remoteRef: key: secret/data/fornax/worker-tx253 property: private_key + - secretKey: PROTONVPN_PEER_PUBLIC_KEY + remoteRef: + key: secret/data/fornax/worker-tx253 + property: public_key + - secretKey: PROTONVPN_ENDPOINT_IP + remoteRef: + key: secret/data/fornax/worker-tx253 + property: endpoint_ip --- apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret @@ -37,3 +45,11 @@ spec: remoteRef: key: secret/data/fornax/worker-tx34 property: private_key + - secretKey: PROTONVPN_PEER_PUBLIC_KEY + remoteRef: + key: secret/data/fornax/worker-tx34 + property: public_key + - secretKey: PROTONVPN_ENDPOINT_IP + remoteRef: + key: secret/data/fornax/worker-tx34 + property: endpoint_ip diff --git a/servers/legion/k8s/media/fornax-workers.yaml b/servers/legion/k8s/media/fornax-workers.yaml index eecc248..bc84093 100644 --- a/servers/legion/k8s/media/fornax-workers.yaml +++ b/servers/legion/k8s/media/fornax-workers.yaml @@ -92,7 +92,7 @@ spec: add: ["NET_ADMIN"] env: - name: VPN_SERVICE_PROVIDER - value: "protonvpn" + value: "custom" - name: VPN_TYPE value: "wireguard" - name: WIREGUARD_PRIVATE_KEY @@ -100,12 +100,20 @@ spec: secretKeyRef: name: fornax-worker-tx253-secrets key: PROTONVPN_PRIVATE_KEY - - name: SERVER_NAMES - value: "US-TX#179" - - name: VPN_PORT_FORWARDING - value: "off" - - name: UPDATER_PERIOD - value: "2m" + - name: WIREGUARD_PUBLIC_KEY + valueFrom: + secretKeyRef: + name: fornax-worker-tx253-secrets + key: PROTONVPN_PEER_PUBLIC_KEY + - name: WIREGUARD_ENDPOINT_IP + valueFrom: + secretKeyRef: + name: fornax-worker-tx253-secrets + key: PROTONVPN_ENDPOINT_IP + - name: WIREGUARD_ENDPOINT_PORT + value: "51820" + - name: WIREGUARD_ADDRESSES + value: "10.2.0.2/32" - name: DOT value: "off" - name: DNS_UPSTREAM_RESOLVER_TYPE @@ -344,7 +352,7 @@ spec: add: ["NET_ADMIN"] env: - name: VPN_SERVICE_PROVIDER - value: "protonvpn" + value: "custom" - name: VPN_TYPE value: "wireguard" - name: WIREGUARD_PRIVATE_KEY @@ -352,10 +360,20 @@ spec: secretKeyRef: name: fornax-worker-tx34-secrets key: PROTONVPN_PRIVATE_KEY - - name: SERVER_NAMES - value: "US-TX#220" - - name: VPN_PORT_FORWARDING - value: "on" + - name: WIREGUARD_PUBLIC_KEY + valueFrom: + secretKeyRef: + name: fornax-worker-tx34-secrets + key: PROTONVPN_PEER_PUBLIC_KEY + - name: WIREGUARD_ENDPOINT_IP + valueFrom: + secretKeyRef: + name: fornax-worker-tx34-secrets + key: PROTONVPN_ENDPOINT_IP + - name: WIREGUARD_ENDPOINT_PORT + value: "51820" + - name: WIREGUARD_ADDRESSES + value: "10.2.0.2/32" - name: DOT value: "off" - name: DNS_UPSTREAM_RESOLVER_TYPE