apiVersion: v1
data:
  GROUP: "Standard VPN servers"
  RANDOM_TOP: "10"
  RECREATE_VPN_CRON: "5 */3 * * *"
  OPENVPN_OPTS: "--mute-replay-warnings"
kind: ConfigMap
metadata:
  name: nordvpn-conf
  namespace: default

---

apiVersion: v1
kind: ConfigMap
metadata:
  name: nordvpn-danted-conf
data:
  PreInit: |
    #!/bin/sh
    sed -i "s/pull$/pull\npull-filter ignore \"dhcp-option DNS\"/g" /etc/nordvpn/template.ovpn
  FixDNSRoute: |
    #!/bin/sh
    for i in $( grep "nameserver" /etc/resolv.conf | cut -d ' ' -f2 ); do
      ip route add $i via 10.244.0.1 dev eth0
    done
  ConfigFile: |
    logoutput: stderr
    internal: 0.0.0.0 port = 43421
    external: tun0

    socksmethod: none
    clientmethod: none

    user.privileged: root
    user.unprivileged: nobody

    client pass {
        from: 0.0.0.0/0 to: 0.0.0.0/0
        log: error
    }

    socks pass {
        from: 0.0.0.0/0 to: 0.0.0.0/0
        command: bind connect udpassociate
        log: error
        socksmethod: none
    }

    socks pass {
        from: 0.0.0.0/0 to: 0.0.0.0/0
        command: bindreply udpreply
        log: error # connect disconnect iooperation
    }

---

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: default
  labels:
    app: nordvpn-ja
  name: nordvpn-ja
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nordvpn-ja
  template:
    metadata:
      labels:
        app: nordvpn-ja
    spec:
      imagePullSecrets:
        - name: registry-auth
      containers:
      - image: registry.k8s.astropenguin.net/danted:2024.04.07.06
        name: danted
        volumeMounts:
          - name: danted-conf
            mountPath: "/etc/danted-runtime.conf"
            subPath: danted.conf
      - image: azinchen/nordvpn
        name: nordvpn
        securityContext:
          capabilities:
            add: [ "NET_ADMIN" ]
        envFrom:
          - configMapRef:
              name: nordvpn-conf
          - secretRef:
              name: nordvpn-auth
        command:
          - "sh"
          - "-c"
          - "/pre-init && /init"
        env:
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: COUNTRY
            value: "Japan"
        volumeMounts:
          - mountPath: /dev/net/tun
            readOnly: true
            name: tun-device
          - name: danted-conf
            mountPath: "/pre-init"
            subPath: pre-init
          - name: danted-conf
            mountPath: "/etc/nordvpn/init/49-fixdnsroute.sh"
            subPath: fix-dns-route
      volumes:
        - name: tun-device
          hostPath:
            path: /dev/net/tun
        - name: danted-conf
          configMap:
            items:
            - key: ConfigFile
              path: danted.conf
            - key: PreInit
              path: pre-init
              mode: 0755
            - key: FixDNSRoute
              path: fix-dns-route
              mode: 0755
            name: nordvpn-danted-conf

---

apiVersion: v1
kind: Service
metadata:
  name: nordvpn-ja-socks5
spec:
  selector:
    app: nordvpn-ja
  type: NodePort
  ports:
    - name: app
      port: 43421
      targetPort: 43421
      nodePort: 31486