From a1623eda390482e72424b1ea939d5971f927b459 Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Tue, 14 Apr 2026 21:32:57 -0500 Subject: [PATCH] Fix gluetun DNS: disable DoT, use k8s coredns as plaintext resolver DoT (port 853) to 1.1.1.1 through ProtonVPN VPN tunnel gets TCP RST, causing gluetun healthcheck to fail (can't resolve github.com / cloudflare.com). k8s coredns at 10.43.0.10 is reachable via eth0 within FIREWALL_OUTBOUND_SUBNETS, bypassing the VPN for DNS while letting all other traffic tunnel correctly. Also rename VPN_ENDPOINT_IP/PORT to WIREGUARD_ENDPOINT_IP/PORT to suppress gluetun deprecation warnings. --- .../k8s/fornax/worker/base/deployment.yaml | 10 ++++++---- servers/legion/k8s/media/fornax-workers.yaml | 20 +++++++++++-------- 2 files changed, 18 insertions(+), 12 deletions(-) diff --git a/servers/legion/k8s/fornax/worker/base/deployment.yaml b/servers/legion/k8s/fornax/worker/base/deployment.yaml index 5a3a732..866fee3 100644 --- a/servers/legion/k8s/fornax/worker/base/deployment.yaml +++ b/servers/legion/k8s/fornax/worker/base/deployment.yaml @@ -75,12 +75,14 @@ spec: value: PLACEHOLDER_PUBLIC_KEY - name: WIREGUARD_ADDRESSES value: 10.2.0.2/32 - - name: VPN_ENDPOINT_IP + - name: WIREGUARD_ENDPOINT_IP value: PLACEHOLDER_ENDPOINT_IP - - name: VPN_ENDPOINT_PORT + - name: WIREGUARD_ENDPOINT_PORT value: "51820" - - name: DNS_KEEP_NAMESERVER - value: "on" + - name: DOT + value: "off" + - name: DNS_ADDRESS + value: "10.43.0.10" - name: FIREWALL_OUTBOUND_SUBNETS value: 10.42.0.0/16,10.43.0.0/16 ports: diff --git a/servers/legion/k8s/media/fornax-workers.yaml b/servers/legion/k8s/media/fornax-workers.yaml index 8497eb1..0bad570 100644 --- a/servers/legion/k8s/media/fornax-workers.yaml +++ b/servers/legion/k8s/media/fornax-workers.yaml @@ -104,12 +104,14 @@ spec: value: "mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA=" - name: WIREGUARD_ADDRESSES value: "10.2.0.2/32" - - name: VPN_ENDPOINT_IP + - name: WIREGUARD_ENDPOINT_IP value: "95.173.217.29" - - name: VPN_ENDPOINT_PORT + - name: WIREGUARD_ENDPOINT_PORT value: "51820" - - name: DNS_KEEP_NAMESERVER - value: "on" + - name: DOT + value: "off" + - name: DNS_ADDRESS + value: "10.43.0.10" - name: FIREWALL_OUTBOUND_SUBNETS value: "10.42.0.0/16,10.43.0.0/16" volumeMounts: @@ -316,12 +318,14 @@ spec: value: "wqJcz4akzVFxx35aJ5B7G/IJ9qsRvpcGNub3rLHcqXo=" - name: WIREGUARD_ADDRESSES value: "10.2.0.2/32" - - name: VPN_ENDPOINT_IP + - name: WIREGUARD_ENDPOINT_IP value: "146.70.58.130" - - name: VPN_ENDPOINT_PORT + - name: WIREGUARD_ENDPOINT_PORT value: "51820" - - name: DNS_KEEP_NAMESERVER - value: "on" + - name: DOT + value: "off" + - name: DNS_ADDRESS + value: "10.43.0.10" - name: FIREWALL_OUTBOUND_SUBNETS value: "10.42.0.0/16,10.43.0.0/16" volumeMounts: