Fix port forwarding: read file instead of HTTP API, fix server names

- portforward-helper now reads /tmp/gluetun/forwarded_port via shared emptyDir
  volume instead of polling gluetun HTTP API (which returned Unauthorized)
- Main qbt: SERVER_NAMES=US-IL#1 (valid entry in gluetun server list)
- Both manifests cleaned up

servers/legion/k8s/media/fornax-workers.yaml

@@ -1,10 +1,10 @@
 # Fornax distributed torrent workers — each is a gluetun+qBittorrent pod on a different VPN server
-# Worker TX#253: US-TX#253, NAT-PMP via gluetun native ProtonVPN port forwarding
+# Worker TX#179: US-TX#179, NAT-PMP via gluetun native ProtonVPN port forwarding
-# Worker TX#34:  US-TX#34,  NAT-PMP via gluetun native ProtonVPN port forwarding
+# Worker TX#220: US-TX#220, NAT-PMP via gluetun native ProtonVPN port forwarding
 # Both workers share the media-data PVC; each has its own config PVC and VPN credentials
-# The Fornax coordinator proxy (TBD) routes work across these workers
+# Port file shared via emptyDir: gluetun writes /tmp/gluetun/forwarded_port, helper reads it
 
-# ── Worker TX#253 ─────────────────────────────────────────────────────────────
+# ── Worker TX#179 ─────────────────────────────────────────────────────────────
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -13,7 +13,7 @@ metadata:
   labels:
     app: fornax-worker-tx253
     fornax-role: worker
-    fornax-server: us-tx-253
+    fornax-server: us-tx-179
 spec:
   replicas: 1
   strategy:
@@ -26,7 +26,7 @@ spec:
       labels:
         app: fornax-worker-tx253
         fornax-role: worker
-        fornax-server: us-tx-253
+        fornax-server: us-tx-179
     spec:
       initContainers:
         - name: tun-setup
@@ -41,7 +41,6 @@ spec:
             capabilities:
               add: ["NET_ADMIN"]
           env:
-            # Use protonvpn provider so gluetun handles NAT-PMP natively
             - name: VPN_SERVICE_PROVIDER
               value: "protonvpn"
             - name: VPN_TYPE
@@ -51,17 +50,17 @@ spec:
                 secretKeyRef:
                   name: fornax-worker-tx253-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            # US-TX#179 — from gluetun's built-in ProtonVPN server list
             - name: SERVER_NAMES
               value: "US-TX#179"
-            # gluetun handles NAT-PMP internally, exposes port at :8000/v1/openvpn/portforwarded
             - name: VPN_PORT_FORWARDING
               value: "on"
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: "10.42.0.0/16,10.43.0.0/16"
+          volumeMounts:
+            - name: gluetun-data
+              mountPath: /tmp/gluetun
           ports:
-            - containerPort: 8000  # gluetun control server
+            - containerPort: 8888
-            - containerPort: 8888  # gluetun HTTP proxy
           resources:
             requests:
               memory: 128Mi
@@ -70,31 +69,36 @@ spec:
               memory: 512Mi
               cpu: 200m
 
-        # Port forwarding helper — polls gluetun's control API for the assigned port,
+        # Port forwarding helper — reads port from file gluetun writes to /tmp/gluetun/forwarded_port
-        # then updates qBittorrent. No natpmpc needed; gluetun handles the NAT-PMP exchange.
         - name: portforward-helper
           image: alpine:latest
           command:
             - sh
             - -c
             - |
-              echo "Waiting for gluetun to assign a forwarded port..."
               until apk add -q curl 2>/dev/null; do sleep 5; done
+              echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
               while true; do
-                RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null)
+                if [ -f /tmp/gluetun/forwarded_port ]; then
-                PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$')
+                  PORT=$(cat /tmp/gluetun/forwarded_port)
-                if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
+                  if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
-                  echo "$(date): Forwarded port: $PORT — updating qBittorrent"
+                    echo "$(date): Forwarded port: $PORT — updating qBittorrent"
-                  curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
+                    curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
-                    -d "username=admin&password=adminadmin" >/dev/null 2>&1
+                      -d "username=admin&password=adminadmin" >/dev/null 2>&1
-                  curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
+                    curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
-                    -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
+                      -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
-                  echo "$(date): qBittorrent listen port set to $PORT"
+                    echo "$(date): qBittorrent listen port set to $PORT"
+                  else
+                    echo "$(date): Port file empty, waiting..."
+                  fi
                 else
-                  echo "$(date): No port yet (gluetun response: $RESP)"
+                  echo "$(date): Waiting for gluetun to write port file..."
                 fi
                 sleep 45
               done
+          volumeMounts:
+            - name: gluetun-data
+              mountPath: /tmp/gluetun
           resources:
             requests:
               memory: 32Mi
@@ -129,6 +133,8 @@ spec:
               memory: 1Gi
               cpu: 500m
       volumes:
+        - name: gluetun-data
+          emptyDir: {}
         - name: config
           persistentVolumeClaim:
             claimName: fornax-worker-tx253-config
@@ -154,7 +160,7 @@ spec:
   type: ClusterIP
 
 ---
-# ── Worker TX#34 ──────────────────────────────────────────────────────────────
+# ── Worker TX#220 ─────────────────────────────────────────────────────────────
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -163,7 +169,7 @@ metadata:
   labels:
     app: fornax-worker-tx34
     fornax-role: worker
-    fornax-server: us-tx-34
+    fornax-server: us-tx-220
 spec:
   replicas: 1
   strategy:
@@ -176,7 +182,7 @@ spec:
       labels:
         app: fornax-worker-tx34
         fornax-role: worker
-        fornax-server: us-tx-34
+        fornax-server: us-tx-220
     spec:
       initContainers:
         - name: tun-setup
@@ -200,15 +206,16 @@ spec:
                 secretKeyRef:
                   name: fornax-worker-tx34-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            # US-TX#220 — from gluetun's built-in ProtonVPN server list
             - name: SERVER_NAMES
               value: "US-TX#220"
             - name: VPN_PORT_FORWARDING
               value: "on"
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: "10.42.0.0/16,10.43.0.0/16"
+          volumeMounts:
+            - name: gluetun-data
+              mountPath: /tmp/gluetun
           ports:
-            - containerPort: 8000
             - containerPort: 8888
           resources:
             requests:
@@ -224,23 +231,29 @@ spec:
             - sh
             - -c
             - |
-              echo "Waiting for gluetun to assign a forwarded port..."
               until apk add -q curl 2>/dev/null; do sleep 5; done
+              echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
               while true; do
-                RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null)
+                if [ -f /tmp/gluetun/forwarded_port ]; then
-                PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$')
+                  PORT=$(cat /tmp/gluetun/forwarded_port)
-                if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
+                  if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
-                  echo "$(date): Forwarded port: $PORT — updating qBittorrent"
+                    echo "$(date): Forwarded port: $PORT — updating qBittorrent"
-                  curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
+                    curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
-                    -d "username=admin&password=adminadmin" >/dev/null 2>&1
+                      -d "username=admin&password=adminadmin" >/dev/null 2>&1
-                  curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
+                    curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
-                    -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
+                      -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
-                  echo "$(date): qBittorrent listen port set to $PORT"
+                    echo "$(date): qBittorrent listen port set to $PORT"
+                  else
+                    echo "$(date): Port file empty, waiting..."
+                  fi
                 else
-                  echo "$(date): No port yet (gluetun response: $RESP)"
+                  echo "$(date): Waiting for gluetun to write port file..."
                 fi
                 sleep 45
               done
+          volumeMounts:
+            - name: gluetun-data
+              mountPath: /tmp/gluetun
           resources:
             requests:
               memory: 32Mi
@@ -275,6 +288,8 @@ spec:
               memory: 1Gi
               cpu: 500m
       volumes:
+        - name: gluetun-data
+          emptyDir: {}
         - name: config
           persistentVolumeClaim:
             claimName: fornax-worker-tx34-config

servers/legion/k8s/media/gluetun-qbittorrent.yaml

@@ -1,7 +1,7 @@
 # gluetun + qBittorrent — all torrent traffic routed through ProtonVPN WireGuard
-# gluetun runs as the VPN container; qBittorrent shares its network namespace (same pod)
 # Port forwarding via gluetun's native ProtonVPN support (VPN_PORT_FORWARDING=on)
-# — gluetun handles NAT-PMP internally, exposes port at :8000/v1/openvpn/portforwarded
+# gluetun writes the assigned port to /tmp/gluetun/forwarded_port (shared emptyDir)
+# portforward-helper reads that file and updates qBittorrent's listen port
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -22,14 +22,12 @@ spec:
         app: qbittorrent
     spec:
       initContainers:
-        # Ensure /dev/net/tun exists on the node
         - name: tun-setup
           image: busybox:latest
           command: ["sh", "-c", "mkdir -p /dev/net && [ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200 && chmod 666 /dev/net/tun && sysctl -w net.ipv6.conf.all.disable_ipv6=1 || true && ip route flush table 51820 2>/dev/null || true && ip rule del priority 101 2>/dev/null || true && ip rule del table 51820 2>/dev/null || true"]
           securityContext:
             privileged: true
       containers:
-        # VPN container — protonvpn provider with native port forwarding support
         - name: gluetun
           image: ghcr.io/qdm12/gluetun:latest
           securityContext:
@@ -45,18 +43,17 @@ spec:
                 secretKeyRef:
                   name: media-secrets
                   key: PROTONVPN_PRIVATE_KEY
-            # Pick any US-IL server that supports port forwarding
+            - name: SERVER_NAMES
-            - name: SERVER_REGIONS
+              value: "US-IL#1"
-              value: "Illinois"
-            # gluetun handles NAT-PMP exchange natively for protonvpn provider
             - name: VPN_PORT_FORWARDING
               value: "on"
-            # Allow cluster-internal traffic to bypass VPN (for Radarr/Sonarr → qBittorrent API)
             - name: FIREWALL_OUTBOUND_SUBNETS
               value: "10.42.0.0/16,10.43.0.0/16"
+          volumeMounts:
+            - name: gluetun-data
+              mountPath: /tmp/gluetun
           ports:
-            - containerPort: 8000  # gluetun control server
+            - containerPort: 8888
-            - containerPort: 8888  # gluetun HTTP proxy
           resources:
             requests:
               memory: 128Mi
@@ -65,40 +62,43 @@ spec:
               memory: 512Mi
               cpu: 200m
 
-        # Port forwarding helper — polls gluetun's control API for the assigned port,
-        # then updates qBittorrent. No natpmpc needed; gluetun handles the NAT-PMP exchange.
         - name: portforward-helper
           image: alpine:latest
           command:
             - sh
             - -c
             - |
-              echo "Waiting for gluetun port forwarding to initialize..."
               until apk add -q curl 2>/dev/null; do sleep 5; done
+              echo "Watching /tmp/gluetun/forwarded_port for assigned port..."
               while true; do
-                RESP=$(curl -s http://localhost:8000/v1/openvpn/portforwarded 2>/dev/null)
+                if [ -f /tmp/gluetun/forwarded_port ]; then
-                PORT=$(echo "$RESP" | grep -oE '"port":[0-9]+' | grep -oE '[0-9]+$')
+                  PORT=$(cat /tmp/gluetun/forwarded_port)
-                if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
+                  if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
-                  echo "$(date): Forwarded port: $PORT — updating qBittorrent"
+                    echo "$(date): Forwarded port: $PORT — updating qBittorrent"
-                  curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
+                    curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
-                    -d "username=admin&password=adminadmin" >/dev/null 2>&1
+                      -d "username=admin&password=adminadmin" >/dev/null 2>&1
-                  curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
+                    curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
-                    -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
+                      -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
-                  echo "$(date): qBittorrent listen port set to $PORT"
+                    echo "$(date): qBittorrent listen port set to $PORT"
+                  else
+                    echo "$(date): Port file empty, waiting..."
+                  fi
                 else
-                  echo "$(date): No port yet (gluetun response: $RESP)"
+                  echo "$(date): Waiting for gluetun to write port file..."
                 fi
                 sleep 45
               done
+          volumeMounts:
+            - name: gluetun-data
+              mountPath: /tmp/gluetun
           resources:
             requests:
-              memory: 16Mi
+              memory: 32Mi
               cpu: 10m
             limits:
-              memory: 32Mi
+              memory: 96Mi
               cpu: 50m
 
-        # qBittorrent — shares gluetun's network namespace, all traffic through VPN
         - name: qbittorrent
           image: lscr.io/linuxserver/qbittorrent:latest
           env:
@@ -125,6 +125,8 @@ spec:
               memory: 1Gi
               cpu: 500m
       volumes:
+        - name: gluetun-data
+          emptyDir: {}
         - name: config
           persistentVolumeClaim:
             claimName: qbittorrent-config