tommy
0f3973023a
Replaces the Go pia-wg-config (Go 1.23 rejects PIA legacy-CN no-SAN certs) with PIA's official CA-pinned curl flow. Adds CA-aware region auto-pick so ExpressVPN-CA migrated regions (e.g. us_chicago) auto-skip; region moved to us_denver. Tunnel restored + egress verified 2026-06-30. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
11 lines
594 B
Docker
11 lines
594 B
Docker
# PIA WireGuard peer regenerator for gluetun custom mode.
|
|
# Uses PIA's official CA-pinned curl flow (token + addKey) instead of the Go
|
|
# pia-wg-config binary, which modern-Go TLS breaks on PIA's legacy-CommonName
|
|
# (no-SAN) server certs. See regen-entrypoint.sh / memory pia-wg-regen-broken-go-legacy-cn.
|
|
FROM alpine:3.20
|
|
RUN apk add --no-cache bash curl jq wireguard-tools ca-certificates
|
|
COPY ca.rsa.4096.crt /etc/pia/ca.rsa.4096.crt
|
|
COPY regen-entrypoint.sh /usr/local/bin/regen-entrypoint.sh
|
|
RUN chmod +x /usr/local/bin/regen-entrypoint.sh
|
|
ENTRYPOINT ["/usr/local/bin/regen-entrypoint.sh"]
|