tommy/homelab-configs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gluetun-pia: CA-pinned regen + CA-aware region auto-pick (fix legacy-CN break)

Browse Source 
Replaces the Go pia-wg-config (Go 1.23 rejects PIA legacy-CN no-SAN certs) with
PIA's official CA-pinned curl flow. Adds CA-aware region auto-pick so ExpressVPN-CA
migrated regions (e.g. us_chicago) auto-skip; region moved to us_denver. Tunnel
restored + egress verified 2026-06-30.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
tommy
2026-06-30 22:01:16 -05:00
parent 6af09ef9c6
commit 0f3973023a
5 changed files with 196 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gluetun-pia/Dockerfile
+10
View File
@@ -0,0 +1,10 @@
# PIA WireGuard peer regenerator for gluetun custom mode.
# Uses PIA's official CA-pinned curl flow (token + addKey) instead of the Go
# pia-wg-config binary, which modern-Go TLS breaks on PIA's legacy-CommonName
# (no-SAN) server certs. See regen-entrypoint.sh / memory pia-wg-regen-broken-go-legacy-cn.
FROM alpine:3.20
RUN apk add --no-cache bash curl jq wireguard-tools ca-certificates
COPY ca.rsa.4096.crt /etc/pia/ca.rsa.4096.crt
COPY regen-entrypoint.sh /usr/local/bin/regen-entrypoint.sh
RUN chmod +x /usr/local/bin/regen-entrypoint.sh
ENTRYPOINT ["/usr/local/bin/regen-entrypoint.sh"]