fix: worker gluetun endpoint IP approach, add VPN key secrets

servers/legion/k8s/fornax/worker/base/deployment.yaml

@@ -25,12 +25,13 @@ spec:
           command:
             - sh
             - -c
-            - |
-              mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && \
-              chmod 666 /dev/net/tun && \
-              sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true && \
-              ip route flush table 51820 2>/dev/null || true && \
-              ip rule del priority 101 2>/dev/null || true && \
+            - >-
+              mkdir -p /dev/net &&
+              [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 &&
+              chmod 666 /dev/net/tun &&
+              sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true &&
+              ip route flush table 51820 2>/dev/null || true &&
+              ip rule del priority 101 2>/dev/null || true &&
               ip rule del table 51820 2>/dev/null || true
         - name: qbt-config-patch
           image: busybox:latest
@@ -70,8 +71,18 @@ spec:
                 secretKeyRef:
                   name: fornax-worker-WORKER_ID-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            - name: SERVER_NAMES
-              value: PROTONVPN_SERVER
+            - name: WIREGUARD_PUBLIC_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: fornax-worker-WORKER_ID-secrets
+                  key: PROTONVPN_PUBLIC_KEY
+            - name: WIREGUARD_ENDPOINT_IP
+              valueFrom:
+                secretKeyRef:
+                  name: fornax-worker-WORKER_ID-secrets
+                  key: PROTONVPN_ENDPOINT_IP
+            - name: WIREGUARD_ENDPOINT_PORT
+              value: "51820"
             - name: VPN_PORT_FORWARDING
               value: "on"
             - name: FIREWALL_OUTBOUND_SUBNETS
@@ -102,7 +113,7 @@ spec:
                 if [ -f /tmp/gluetun/forwarded_port ]; then
                   PORT=$(cat /tmp/gluetun/forwarded_port)
                   if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
-                    echo "$(date): Forwarded port: $PORT — updating qBittorrent"
+                    echo "$(date): Forwarded port: $PORT - updating qBittorrent"
                     curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
                       -d "username=admin&password=adminadmin" >/dev/null 2>&1
                     curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \