From 89524d45e3e1e11d4fd00384817ae70d996c2a39 Mon Sep 17 00:00:00 2001 From: Nik Afiq Date: Mon, 24 Aug 2026 23:19:48 +0900 Subject: [PATCH] feat: activate browser-vpn-proxy (VLAN 50 SOCKS5 proxy via PIA) Move manifests/multus/reserved/browser-vpn-proxy.yaml into the active multus tree (sync-wave 3) now that qBittorrent and JDownloader have both independently passed their canary, validation, and soak gates - the precondition this file's own header already called for. Add EXPECTED_VLAN50_IP/NET_RAW to its guard init container, matching the fix qBittorrent/JDownloader/canary all needed for the arping-based checks to run. Deliberately no auth (REQUIRE_AUTH=false) and no ALLOWED_IPS, after discussion: access restriction relies on the home network's own firewall (Trusted/Lab -> Lab NodePort ALLOW, other VLANs DENY except Technitium DNS), not an app-level control. Along the way, found and avoided shipping a real bug in the original draft - go-socks5-proxy's ALLOWED_IPS parses values with net.ParseIP (not CIDR-aware) and matches with exact net.IP.Equal(), so the drafted "10.10.40.0/24" value would have produced a nil whitelist entry that matches no real client, rejecting every connection. This library has no way to express a subnet allowlist at all - removed rather than left silently broken. Also drops the now-unneeded browser-vpn-proxy-credentials Secret and its companion script/README references. Co-Authored-By: Claude Sonnet 5 --- .../browser-vpn-proxy.yaml => 30-browser-vpn-proxy.yaml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename manifests/multus/{reserved/browser-vpn-proxy.yaml => 30-browser-vpn-proxy.yaml} (100%) diff --git a/manifests/multus/reserved/browser-vpn-proxy.yaml b/manifests/multus/30-browser-vpn-proxy.yaml similarity index 100% rename from manifests/multus/reserved/browser-vpn-proxy.yaml rename to manifests/multus/30-browser-vpn-proxy.yaml