fix: worker gluetun endpoint IP approach, add VPN key secrets

servers/legion/k8s/fornax/worker/base/deployment.yaml

@@ -25,12 +25,13 @@ spec:
           command:
             - sh
             - -c
-            - |
+            - >-
-              mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && \
+              mkdir -p /dev/net &&
-              chmod 666 /dev/net/tun && \
+              [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 &&
-              sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true && \
+              chmod 666 /dev/net/tun &&
-              ip route flush table 51820 2>/dev/null || true && \
+              sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true &&
-              ip rule del priority 101 2>/dev/null || true && \
+              ip route flush table 51820 2>/dev/null || true &&
+              ip rule del priority 101 2>/dev/null || true &&
               ip rule del table 51820 2>/dev/null || true
         - name: qbt-config-patch
           image: busybox:latest
@@ -70,8 +71,18 @@ spec:
                 secretKeyRef:
                   name: fornax-worker-WORKER_ID-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            - name: SERVER_NAMES
+            - name: WIREGUARD_PUBLIC_KEY
-              value: PROTONVPN_SERVER
+              valueFrom:
+                secretKeyRef:
+                  name: fornax-worker-WORKER_ID-secrets
+                  key: PROTONVPN_PUBLIC_KEY
+            - name: WIREGUARD_ENDPOINT_IP
+              valueFrom:
+                secretKeyRef:
+                  name: fornax-worker-WORKER_ID-secrets
+                  key: PROTONVPN_ENDPOINT_IP
+            - name: WIREGUARD_ENDPOINT_PORT
+              value: "51820"
             - name: VPN_PORT_FORWARDING
               value: "on"
             - name: FIREWALL_OUTBOUND_SUBNETS
@@ -102,7 +113,7 @@ spec:
                 if [ -f /tmp/gluetun/forwarded_port ]; then
                   PORT=$(cat /tmp/gluetun/forwarded_port)
                   if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
-                    echo "$(date): Forwarded port: $PORT — updating qBittorrent"
+                    echo "$(date): Forwarded port: $PORT - updating qBittorrent"
                     curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
                       -d "username=admin&password=adminadmin" >/dev/null 2>&1
                     curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \

servers/legion/k8s/fornax/worker/base/externalsecret.yaml

@@ -16,3 +16,11 @@ spec:
       remoteRef:
         key: secret/data/fornax/worker-WORKER_ID
         property: private_key
+    - secretKey: PROTONVPN_ENDPOINT_IP
+      remoteRef:
+        key: secret/data/fornax/worker-WORKER_ID
+        property: endpoint_ip
+    - secretKey: PROTONVPN_PUBLIC_KEY
+      remoteRef:
+        key: secret/data/fornax/worker-WORKER_ID
+        property: public_key

servers/legion/k8s/fornax/worker/overlays/worker-tx253/kustomization.yaml

@@ -3,9 +3,6 @@ kind: Kustomization
 resources:
   - ../../base
 
-namePrefix: ""
-nameSuffix: ""
-
 patches:
   - target:
       kind: Deployment
@@ -23,12 +20,15 @@ patches:
       - op: replace
         path: /spec/template/metadata/labels/app
         value: fornax-worker-tx253
-      - op: replace
-        path: /spec/template/spec/containers/0/env/3/value
-        value: US-TX#253
       - op: replace
         path: /spec/template/spec/containers/0/env/2/valueFrom/secretKeyRef/name
         value: fornax-worker-tx253-secrets
+      - op: replace
+        path: /spec/template/spec/containers/0/env/3/valueFrom/secretKeyRef/name
+        value: fornax-worker-tx253-secrets
+      - op: replace
+        path: /spec/template/spec/containers/0/env/4/valueFrom/secretKeyRef/name
+        value: fornax-worker-tx253-secrets
       - op: replace
         path: /spec/template/spec/volumes/1/persistentVolumeClaim/claimName
         value: fornax-worker-tx253-config
@@ -65,3 +65,9 @@ patches:
       - op: replace
         path: /spec/data/0/remoteRef/key
         value: secret/data/fornax/worker-tx253
+      - op: replace
+        path: /spec/data/1/remoteRef/key
+        value: secret/data/fornax/worker-tx253
+      - op: replace
+        path: /spec/data/2/remoteRef/key
+        value: secret/data/fornax/worker-tx253

servers/legion/k8s/fornax/worker/overlays/worker-tx34/kustomization.yaml

@@ -20,12 +20,15 @@ patches:
       - op: replace
         path: /spec/template/metadata/labels/app
         value: fornax-worker-tx34
-      - op: replace
-        path: /spec/template/spec/containers/0/env/3/value
-        value: US-TX#34
       - op: replace
         path: /spec/template/spec/containers/0/env/2/valueFrom/secretKeyRef/name
         value: fornax-worker-tx34-secrets
+      - op: replace
+        path: /spec/template/spec/containers/0/env/3/valueFrom/secretKeyRef/name
+        value: fornax-worker-tx34-secrets
+      - op: replace
+        path: /spec/template/spec/containers/0/env/4/valueFrom/secretKeyRef/name
+        value: fornax-worker-tx34-secrets
       - op: replace
         path: /spec/template/spec/volumes/1/persistentVolumeClaim/claimName
         value: fornax-worker-tx34-config
@@ -62,3 +65,9 @@ patches:
       - op: replace
         path: /spec/data/0/remoteRef/key
         value: secret/data/fornax/worker-tx34
+      - op: replace
+        path: /spec/data/1/remoteRef/key
+        value: secret/data/fornax/worker-tx34
+      - op: replace
+        path: /spec/data/2/remoteRef/key
+        value: secret/data/fornax/worker-tx34