Update helm-values/gluetun_values.yaml:
- env.WIREGUARD_ADDRESSES -> WireGuard tunnel address(es) (IPv4 /32 and optional IPv6)
- env.SERVER_HOSTNAMES -> stable AirVPN server hostname
Create a Secret named gluetun-wireguard with key WIREGUARD_PRIVATE_KEY from your AirVPN WireGuard config (do not commit the key).
- Add WIREGUARD_PRESHARED_KEY from the same AirVPN WireGuard config.
- helm-values/gluetun_values.yaml sets secret.create: false so the chart does not create a placeholder secret.

Validation:

ArgoCD health: argocd app get gluetun and argocd app get nzbget
WireGuard up: kubectl -n default logs deploy/gluetun | rg -i "wireguard|tunnel"
VPN egress from NZBGet: kubectl -n default exec deploy/nzbget -- curl -s ifconfig.me
NZBGet UI: kubectl -n default port-forward deploy/nzbget 6789:6789

Note: NZBGet is configured to use the HTTP proxy via HTTP_PROXY/HTTPS_PROXY. If your NNTP traffic does not honor proxy settings, consider using a proxy-aware downloader or running the downloader in the same pod as Gluetun.