Change AmneziaWG port to 5848

k8s/apps/amnezia/configmap-scripts.yaml

@@ -8,7 +8,7 @@ data:
     #!/usr/bin/env bash
     set -euo pipefail
 
-    PORT="${1:-443}"
+    PORT="${1:-5848}"
     VPN_CIDR="${2:-10.8.0.0/16}"
     POLICY_FILE="${3:-/run/amnezia/policy/policy.conf}"
     FORWARD_CHAIN="AMNEZIAWG-FORWARD"
@@ -187,7 +187,7 @@ data:
     #!/usr/bin/env bash
     set -euo pipefail
 
-    PORT="${1:-443}"
+    PORT="${1:-5848}"
     VPN_CIDR="${2:-10.8.0.0/16}"
     FORWARD_CHAIN="AMNEZIAWG-FORWARD"
     POLICY_CHAIN_A="AMNEZIAWG-POLICY-A"
@@ -245,7 +245,7 @@ data:
     #!/usr/bin/env bash
     set -euo pipefail
 
-    PORT="${1:-443}"
+    PORT="${1:-5848}"
     VPN_CIDR="${2:-10.8.0.0/16}"
     FORWARD_CHAIN="AMNEZIAWG-FORWARD"
     IPTABLES=(iptables -w 5)
@@ -372,12 +372,12 @@ data:
     apply_live_config() {
       # Fail closed during a peer/key and policy transition. /dev/null produces
       # an Internet-only policy with all awg0-to-awg0 traffic isolated.
-      /scripts/firewall-up.sh 443 10.8.0.0/16 /dev/null
+      /scripts/firewall-up.sh 5848 10.8.0.0/16 /dev/null
       render_config
       awg-quick strip "${RUNTIME_CONFIG}" > "${SYNC_CONFIG}"
       chmod 0600 "${SYNC_CONFIG}"
       awg syncconf awg0 "${SYNC_CONFIG}"
-      /scripts/firewall-up.sh 443 10.8.0.0/16 "${POLICY_FILE}"
+      /scripts/firewall-up.sh 5848 10.8.0.0/16 "${POLICY_FILE}"
     }
 
     watch_client_config() {

k8s/apps/amnezia/daemonset.yaml

@@ -52,7 +52,7 @@ spec:
                 fieldRef:
                   fieldPath: spec.nodeName
             - name: PORT
-              value: "443"
+              value: "5848"
           command:
             - /bin/bash
             - -lc
@@ -116,14 +116,14 @@ spec:
             - /scripts/run.sh
           ports:
             - name: awg
-              containerPort: 443
+              containerPort: 5848
               protocol: UDP
           readinessProbe:
             exec:
               command:
                 - /bin/bash
                 - -lc
-                - /scripts/firewall-check.sh 443 10.8.0.0/16
+                - /scripts/firewall-check.sh 5848 10.8.0.0/16
             initialDelaySeconds: 5
             periodSeconds: 10
             timeoutSeconds: 8
@@ -133,7 +133,7 @@ spec:
               command:
                 - /bin/bash
                 - -lc
-                - /scripts/firewall-check.sh 443 10.8.0.0/16 || /scripts/firewall-up.sh 443 10.8.0.0/16
+                - /scripts/firewall-check.sh 5848 10.8.0.0/16 || /scripts/firewall-up.sh 5848 10.8.0.0/16
             periodSeconds: 5
             timeoutSeconds: 15
             failureThreshold: 12
@@ -142,7 +142,7 @@ spec:
               command:
                 - /bin/bash
                 - -lc
-                - /scripts/firewall-check.sh 443 10.8.0.0/16 || /scripts/firewall-up.sh 443 10.8.0.0/16
+                - /scripts/firewall-check.sh 5848 10.8.0.0/16 || /scripts/firewall-up.sh 5848 10.8.0.0/16
             initialDelaySeconds: 30
             periodSeconds: 30
             timeoutSeconds: 15

k8s/apps/amnezia/external-secrets.yaml

@@ -16,7 +16,7 @@ spec:
           [Interface]
           PrivateKey = {{ .server_private_key }}
           Address = 10.8.0.1/16
-          ListenPort = 443
+          ListenPort = 5848
           MTU = 1376
           Jc = 5
           Jmin = 96
@@ -29,8 +29,8 @@ spec:
           H2 = 1956534873
           H3 = 886504771
           H4 = 1623791047
-          PostUp = /scripts/firewall-up.sh 443 10.8.0.0/16
-          PostDown = /scripts/firewall-down.sh 443 10.8.0.0/16
+          PostUp = /scripts/firewall-up.sh 5848 10.8.0.0/16
+          PostDown = /scripts/firewall-down.sh 5848 10.8.0.0/16
   data:
     - secretKey: server_private_key
       sourceRef: