Will Anderson
8a43279164
The protonvpn provider mode uses gluetun's embedded server database which doesn't contain US-TX#253 or US-TX#34. Our WireGuard keys are registered for specific ProtonVPN servers, so connecting to other servers (US-TX#179, US-TX#220) results in successful WireGuard handshake but ProtonVPN drops all internet-bound traffic. Fix: use VPN_SERVICE_PROVIDER=custom to directly configure the correct server peer public key and endpoint IP for each worker. ExternalSecrets updated to also pull public_key and endpoint_ip from Vault. - tx253: endpoint=95.173.217.29, peer=mngiSxBpH7GU24nnWdBEcnhDnCPn2jq5+ZP3zwPwISA= - tx34: endpoint=146.70.58.130, peer=wqJcz4akzVFxx35aJ5B7G/IJ9qsRvpcGNub3rLHcqXo=
56 lines
1.5 KiB
YAML
56 lines
1.5 KiB
YAML
# Fornax worker VPN credentials — one ExternalSecret per worker, each pulls its own private key
|
|
# Vault paths: secret/fornax/worker-tx253, secret/fornax/worker-tx34
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: fornax-worker-tx253-secrets
|
|
namespace: media
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: fornax-worker-tx253-secrets
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: PROTONVPN_PRIVATE_KEY
|
|
remoteRef:
|
|
key: secret/data/fornax/worker-tx253
|
|
property: private_key
|
|
- secretKey: PROTONVPN_PEER_PUBLIC_KEY
|
|
remoteRef:
|
|
key: secret/data/fornax/worker-tx253
|
|
property: public_key
|
|
- secretKey: PROTONVPN_ENDPOINT_IP
|
|
remoteRef:
|
|
key: secret/data/fornax/worker-tx253
|
|
property: endpoint_ip
|
|
---
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: fornax-worker-tx34-secrets
|
|
namespace: media
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: fornax-worker-tx34-secrets
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: PROTONVPN_PRIVATE_KEY
|
|
remoteRef:
|
|
key: secret/data/fornax/worker-tx34
|
|
property: private_key
|
|
- secretKey: PROTONVPN_PEER_PUBLIC_KEY
|
|
remoteRef:
|
|
key: secret/data/fornax/worker-tx34
|
|
property: public_key
|
|
- secretKey: PROTONVPN_ENDPOINT_IP
|
|
remoteRef:
|
|
key: secret/data/fornax/worker-tx34
|
|
property: endpoint_ip
|