- Stage and prod deployments scaled to 0 — not yet promoted, no need for running pods
- Dev memory requests reduced from 384Mi to 256Mi to allow scheduling on memory-constrained node
Completes the three-env setup (dev was added previously). Each env has
deployments, services, ingress, PVC, ConfigMap, and ExternalSecret pulling
from Vault. Prod has larger resource limits and 10Gi PVC. Vault secret at
secret/neuron-technologies/prod seeded separately.
Add service URLs as env vars and pull API keys from Vault via ESO.
The coordinator now has everything it needs to call catalog providers
on torrent delete/complete events.
Google OAuth gate on the public dashboard. Allows andersonwilliam85@gmail.com
and 1timlingo@gmail.com. Auto-redirects to Google; 24h session.
Sonarr/Radarr use the internal cluster service so are unaffected.
ProtonVPN returns 16-byte success responses (last field is uint32 lifetime,
not uint16). The previous !BBHIHHH format expected 14 bytes causing unpack
failure. Fixed to !BBHIHHI (16 bytes).
ProtonVPN grants 60s leases; request 60s and renew every 45s instead of
sleeping 240s which let leases expire between renewals.
The protonvpn provider mode uses gluetun's embedded server database which
doesn't contain US-TX#253 or US-TX#34. Our WireGuard keys are registered
for specific ProtonVPN servers, so connecting to other servers (US-TX#179,
US-TX#220) results in successful WireGuard handshake but ProtonVPN drops all
internet-bound traffic.
Fix: use VPN_SERVICE_PROVIDER=custom to directly configure the correct server
peer public key and endpoint IP for each worker. ExternalSecrets updated to
also pull public_key and endpoint_ip from Vault.
- tx253: endpoint=95.173.217.29, peer=mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA=
- tx34: endpoint=146.70.58.130, peer=wqJcz4akzVFxx35aJ5B7G/IJ9qsRvpcGNub3rLHcqXo=
Will refresh gluetun's embedded server list from ProtonVPN API.
Need to extract public key for US-TX#253 (95.173.217.29) which
is not in gluetun's embedded database but should be in the live list.
US-TX#253 and US-TX#34 not in gluetun embedded server list — gluetun
crashes on startup. Reverted to valid names while investigating correct
server mapping. Need to find server public keys for Vault endpoint IPs.
Keys in Vault are registered for US-TX#253 (tx253 worker) and US-TX#34
(tx34 worker), but deployment was connecting to US-TX#179 and US-TX#220.
WireGuard handshake succeeded globally but ProtonVPN only routes internet
traffic through the server the key was registered with.
With VPN_PORT_FORWARDING=off, gluetun startup check fails with TLS EOF
for generic IP-check services. Previous session showed startup check
PASSED with VPN_PORT_FORWARDING=on (only port-forwarding API failed).
Testing to confirm VPN routing works when startup check uses ProtonVPN
API instead of generic HTTPS services.
eth0 MTU in pods is 1450 (Flannel VXLAN). gluetun's MTU discovery
was setting tun0 to 1440, making WireGuard outer packets ~1500 bytes
which exceeds the 1450 limit. TLS ClientHello gets dropped, causing
startup check to fail and loop. Fix: set MTU=1320 so WireGuard UDP
packets stay well under 1450.
Multiline NATPMP variable in tx34 had column-0 lines that broke
Go's YAML parser (same bug that was fixed in tx253). Replace with
identical single-line python3 -c approach.
Will Anderson