From c88f7022c68bb996587781eda3632646ea0e63bc Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Wed, 15 Apr 2026 02:24:40 -0500
Subject: [PATCH] Fix YAML: replace heredoc with inline Python for NAT-PMP
 portforward-helper

---
 servers/legion/k8s/media/fornax-workers.yaml | 78 ++++++++------------
 1 file changed, 29 insertions(+), 49 deletions(-)

diff --git a/servers/legion/k8s/media/fornax-workers.yaml b/servers/legion/k8s/media/fornax-workers.yaml
index 7719f62..d5efb7c 100644
--- a/servers/legion/k8s/media/fornax-workers.yaml
+++ b/servers/legion/k8s/media/fornax-workers.yaml
@@ -149,47 +149,32 @@ spec:
               # Install curl and python3 for NAT-PMP port forwarding
               until apk add -q curl python3 2>/dev/null; do sleep 5; done
 
-              # Request port forwarding via ProtonVPN NAT-PMP (gateway 10.2.0.1, UDP 5351)
-              # ProtonVPN supports NAT-PMP for port forwarding on p2p-enabled servers
-              get_natpmp_port() {
-                python3 - <<'PYEOF'
-import socket, struct, time
-gateway = "10.2.0.1"
-port = 5351
-# NAT-PMP external address request (version=0, opcode=0)
-s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+              # NAT-PMP: request TCP port mapping from ProtonVPN gateway 10.2.0.1 UDP:5351
+              # opcode=2 (TCP map), internal=0, external=0 (any), lifetime=7776000s
+              NATPMP='import socket,struct
+s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
 s.settimeout(5)
 try:
-    # Request TCP port mapping (version=0, opcode=2, reserved=0, internal_port=0, external_port=0, lifetime=7776000)
-    req = struct.pack("!BBHHHI", 0, 2, 0, 0, 0, 7776000)
-    s.sendto(req, (gateway, port))
-    data, _ = s.recvfrom(256)
-    if len(data) >= 16:
-        version, opcode, result, epoch, int_port, ext_port, lifetime = struct.unpack("!BBHIHHH", data[:16])
-        if result == 0:
-            print(ext_port)
-        else:
-            print(0)
-    else:
-        print(0)
-except Exception as e:
-    print(0)
+ s.sendto(struct.pack("!BBHHHI",0,2,0,0,0,7776000),("10.2.0.1",5351))
+ d,_=s.recvfrom(256)
+ r=struct.unpack("!BBHIHHH",d[:16]) if len(d)>=16 else None
+ print(r[5] if r and r[2]==0 else 0)
+except:
+ print(0)
 finally:
-    s.close()
-PYEOF
-              }
+ s.close()'
+
+              get_natpmp_port() { python3 -c "$NATPMP"; }
 
               echo "Requesting port via NAT-PMP..."
               PORT=$(get_natpmp_port)
               if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
-                echo "$(date): NAT-PMP assigned port: $PORT"
+                echo "$(date): NAT-PMP port: $PORT"
                 echo "$PORT" > /tmp/gluetun/forwarded_port
               else
                 echo "$(date): NAT-PMP failed, will retry..."
               fi
 
-              # Loop: refresh port every 4 minutes (lifetime 7776000s, renewal every 4min for safety)
-              # Also sync to qBittorrent whenever port is known
               LAST_PORT=""
               while true; do
                 PORT=$(get_natpmp_port)
@@ -418,32 +403,27 @@ spec:
 
               until apk add -q curl python3 2>/dev/null; do sleep 5; done
 
-              get_natpmp_port() {
-                python3 - <<'PYEOF'
-import socket, struct
-gateway = "10.2.0.1"
-port = 5351
-s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+              NATPMP='import socket,struct
+s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
 s.settimeout(5)
 try:
-    req = struct.pack("!BBHHHI", 0, 2, 0, 0, 0, 7776000)
-    s.sendto(req, (gateway, port))
-    data, _ = s.recvfrom(256)
-    if len(data) >= 16:
-        version, opcode, result, epoch, int_port, ext_port, lifetime = struct.unpack("!BBHIHHH", data[:16])
-        print(ext_port if result == 0 else 0)
-    else:
-        print(0)
-except Exception:
-    print(0)
+ s.sendto(struct.pack("!BBHHHI",0,2,0,0,0,7776000),("10.2.0.1",5351))
+ d,_=s.recvfrom(256)
+ r=struct.unpack("!BBHIHHH",d[:16]) if len(d)>=16 else None
+ print(r[5] if r and r[2]==0 else 0)
+except:
+ print(0)
 finally:
-    s.close()
-PYEOF
-              }
+ s.close()'
+
+              get_natpmp_port() { python3 -c "$NATPMP"; }
 
               echo "Requesting port via NAT-PMP..."
               PORT=$(get_natpmp_port)
-              [ -n "$PORT" ] && [ "$PORT" != "0" ] && echo "$(date): NAT-PMP port: $PORT" && echo "$PORT" > /tmp/gluetun/forwarded_port
+              if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
+                echo "$(date): NAT-PMP port: $PORT"
+                echo "$PORT" > /tmp/gluetun/forwarded_port
+              fi
 
               LAST_PORT=""
               while true; do