From eebd0226de58727b66f43de178001d5300219ed9 Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Tue, 14 Apr 2026 00:01:43 +0000 Subject: [PATCH] fix: worker gluetun endpoint IP approach, add VPN key secrets --- .../k8s/fornax/worker/base/deployment.yaml | 29 +++++++++++++------ .../fornax/worker/base/externalsecret.yaml | 8 +++++ .../overlays/worker-tx253/kustomization.yaml | 18 ++++++++---- .../overlays/worker-tx34/kustomization.yaml | 15 ++++++++-- 4 files changed, 52 insertions(+), 18 deletions(-) diff --git a/servers/legion/k8s/fornax/worker/base/deployment.yaml b/servers/legion/k8s/fornax/worker/base/deployment.yaml index 7f1276d..4c01ff6 100644 --- a/servers/legion/k8s/fornax/worker/base/deployment.yaml +++ b/servers/legion/k8s/fornax/worker/base/deployment.yaml @@ -25,12 +25,13 @@ spec: command: - sh - -c - - | - mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && \ - chmod 666 /dev/net/tun && \ - sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true && \ - ip route flush table 51820 2>/dev/null || true && \ - ip rule del priority 101 2>/dev/null || true && \ + - >- + mkdir -p /dev/net && + [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && + chmod 666 /dev/net/tun && + sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true && + ip route flush table 51820 2>/dev/null || true && + ip rule del priority 101 2>/dev/null || true && ip rule del table 51820 2>/dev/null || true - name: qbt-config-patch image: busybox:latest @@ -70,8 +71,18 @@ spec: secretKeyRef: name: fornax-worker-WORKER_ID-secrets key: PROTONVPN_PRIVATE_KEY - - name: SERVER_NAMES - value: PROTONVPN_SERVER + - name: WIREGUARD_PUBLIC_KEY + valueFrom: + secretKeyRef: + name: fornax-worker-WORKER_ID-secrets + key: PROTONVPN_PUBLIC_KEY + - name: WIREGUARD_ENDPOINT_IP + valueFrom: + secretKeyRef: + name: fornax-worker-WORKER_ID-secrets + key: PROTONVPN_ENDPOINT_IP + - name: WIREGUARD_ENDPOINT_PORT + value: "51820" - name: VPN_PORT_FORWARDING value: "on" - name: FIREWALL_OUTBOUND_SUBNETS @@ -102,7 +113,7 @@ spec: if [ -f /tmp/gluetun/forwarded_port ]; then PORT=$(cat /tmp/gluetun/forwarded_port) if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then - echo "$(date): Forwarded port: $PORT — updating qBittorrent" + echo "$(date): Forwarded port: $PORT - updating qBittorrent" curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \ -d "username=admin&password=adminadmin" >/dev/null 2>&1 curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \ diff --git a/servers/legion/k8s/fornax/worker/base/externalsecret.yaml b/servers/legion/k8s/fornax/worker/base/externalsecret.yaml index c50f289..8b70173 100644 --- a/servers/legion/k8s/fornax/worker/base/externalsecret.yaml +++ b/servers/legion/k8s/fornax/worker/base/externalsecret.yaml @@ -16,3 +16,11 @@ spec: remoteRef: key: secret/data/fornax/worker-WORKER_ID property: private_key + - secretKey: PROTONVPN_ENDPOINT_IP + remoteRef: + key: secret/data/fornax/worker-WORKER_ID + property: endpoint_ip + - secretKey: PROTONVPN_PUBLIC_KEY + remoteRef: + key: secret/data/fornax/worker-WORKER_ID + property: public_key diff --git a/servers/legion/k8s/fornax/worker/overlays/worker-tx253/kustomization.yaml b/servers/legion/k8s/fornax/worker/overlays/worker-tx253/kustomization.yaml index 3a92399..b2efff3 100644 --- a/servers/legion/k8s/fornax/worker/overlays/worker-tx253/kustomization.yaml +++ b/servers/legion/k8s/fornax/worker/overlays/worker-tx253/kustomization.yaml @@ -3,9 +3,6 @@ kind: Kustomization resources: - ../../base -namePrefix: "" -nameSuffix: "" - patches: - target: kind: Deployment @@ -23,12 +20,15 @@ patches: - op: replace path: /spec/template/metadata/labels/app value: fornax-worker-tx253 - - op: replace - path: /spec/template/spec/containers/0/env/3/value - value: US-TX#253 - op: replace path: /spec/template/spec/containers/0/env/2/valueFrom/secretKeyRef/name value: fornax-worker-tx253-secrets + - op: replace + path: /spec/template/spec/containers/0/env/3/valueFrom/secretKeyRef/name + value: fornax-worker-tx253-secrets + - op: replace + path: /spec/template/spec/containers/0/env/4/valueFrom/secretKeyRef/name + value: fornax-worker-tx253-secrets - op: replace path: /spec/template/spec/volumes/1/persistentVolumeClaim/claimName value: fornax-worker-tx253-config @@ -65,3 +65,9 @@ patches: - op: replace path: /spec/data/0/remoteRef/key value: secret/data/fornax/worker-tx253 + - op: replace + path: /spec/data/1/remoteRef/key + value: secret/data/fornax/worker-tx253 + - op: replace + path: /spec/data/2/remoteRef/key + value: secret/data/fornax/worker-tx253 diff --git a/servers/legion/k8s/fornax/worker/overlays/worker-tx34/kustomization.yaml b/servers/legion/k8s/fornax/worker/overlays/worker-tx34/kustomization.yaml index e987044..4eaf92f 100644 --- a/servers/legion/k8s/fornax/worker/overlays/worker-tx34/kustomization.yaml +++ b/servers/legion/k8s/fornax/worker/overlays/worker-tx34/kustomization.yaml @@ -20,12 +20,15 @@ patches: - op: replace path: /spec/template/metadata/labels/app value: fornax-worker-tx34 - - op: replace - path: /spec/template/spec/containers/0/env/3/value - value: US-TX#34 - op: replace path: /spec/template/spec/containers/0/env/2/valueFrom/secretKeyRef/name value: fornax-worker-tx34-secrets + - op: replace + path: /spec/template/spec/containers/0/env/3/valueFrom/secretKeyRef/name + value: fornax-worker-tx34-secrets + - op: replace + path: /spec/template/spec/containers/0/env/4/valueFrom/secretKeyRef/name + value: fornax-worker-tx34-secrets - op: replace path: /spec/template/spec/volumes/1/persistentVolumeClaim/claimName value: fornax-worker-tx34-config @@ -62,3 +65,9 @@ patches: - op: replace path: /spec/data/0/remoteRef/key value: secret/data/fornax/worker-tx34 + - op: replace + path: /spec/data/1/remoteRef/key + value: secret/data/fornax/worker-tx34 + - op: replace + path: /spec/data/2/remoteRef/key + value: secret/data/fornax/worker-tx34