# Usenet stack (Gluetun + NZBGet)

Service endpoints:
- NZBGet UI: nzbget.default.svc.cluster.local:6789
- Gluetun HTTP proxy: gluetun.default.svc.cluster.local:8888

AirVPN WireGuard values:
- Update `helm-values/gluetun_values.yaml`:
  - `env.WIREGUARD_ADDRESSES` -> WireGuard tunnel address(es) (IPv4 /32 and optional IPv6)
  - `env.SERVER_COUNTRIES` -> recommended AirVPN server selection (e.g. Netherlands)
  - If your cluster does not support IPv6, remove the IPv6 address from `env.WIREGUARD_ADDRESSES`.
- Create a Secret named `gluetun-wireguard` with key `WIREGUARD_PRIVATE_KEY` from your AirVPN WireGuard config (do not commit the key).
  - Add `WIREGUARD_PRESHARED_KEY` from the same AirVPN WireGuard config.
  - `helm-values/gluetun_values.yaml` sets `secret.create: false` so the chart does not create a placeholder secret.

Validation:
- ArgoCD health: `argocd app get gluetun` and `argocd app get nzbget`
- WireGuard up: `kubectl -n default logs deploy/gluetun | rg -i "wireguard|tunnel"`
- VPN egress from NZBGet: `kubectl -n default exec deploy/nzbget -- curl -s ifconfig.me`
- NZBGet UI: `kubectl -n default port-forward deploy/nzbget 6789:6789`

Note: NZBGet is configured to use the HTTP proxy via `HTTP_PROXY`/`HTTPS_PROXY`. If your NNTP traffic does not honor proxy settings, consider using a proxy-aware downloader or running the downloader in the same pod as Gluetun.