helm

proxy-ipsec

A Helm chart for deploying the proxy-ipsec VPN proxy on Kubernetes. It runs Nginx and StrongSwan (IPsec IKEv2) inside a single pod: Nginx proxies TCP traffic on port 8080 through an IPsec tunnel to a remote service that is only reachable via the VPN.

Requirements

• Kubernetes cluster with Linux nodes (e.g., AKS)
• An IPsec VPN server with IKEv2 and PSK authentication
• The container needs the NET_ADMIN capability and access to the host's /lib/modules (mounted read-only) — both are configured in the chart

Install

The chart is published to GHCR as an OCI artifact. Install it directly from the registry:

helm install my-proxy oci://ghcr.io/treboada/proxy-ipsec \
  --version 1.0.11 \
  --set vpn.remoteAddrs="203.0.113.10" \
  --set vpn.localId="my-client" \
  --set vpn.psk="your-psk-secret" \
  --set nginx.upstreamIp="10.0.0.50" \
  --set nginx.upstreamPort="443" \
  --set probes.strongswanIp="10.0.0.50" \
  --set probes.strongswanPort="443"

Or install from a local checkout while developing:

helm install my-proxy ./helm -f my-values.yaml

The pod exposes a ClusterIP service on port 8080 within the cluster.

Configuration

Parameter	Description	Default
vpn.remoteAddrs	VPN server IP address	""
vpn.localId	Local identifier for PSK auth	""
vpn.remoteTs	Remote traffic subnet	0.0.0.0/0
vpn.localTs	Local traffic subnet	0.0.0.0/0
vpn.espProposals	ESP encryption proposal	aes256-sha256-modp2048
vpn.proposals	IKE key exchange proposal	aes256-sha256-modp2048
vpn.psk	Pre-shared key (plaintext — testing only)	""
vpn.existingSecret.name	Existing Secret holding the PSK	""
vpn.existingSecret.key	Key within the Secret that holds the PSK	psk
nginx.upstreamIp	Remote service IP reachable via VPN	""
nginx.upstreamPort	Remote service port	443
probes.strongswanIp	Tunnel health check target IP (skipped if empty)	""
probes.strongswanPort	Tunnel health check target port	443
probes.nginxIp	Local Nginx probe IP (skipped if empty)	127.0.0.1
probes.nginxPort	Local Nginx probe port	8080
image.repository	Container image repository	docker.io/caligari/proxy-ipsec
service.type	Service type	ClusterIP
service.port	Service port	8080
replicaCount	Number of pod replicas	1
resources	Container resource requests/limits	see values.yaml

See values.yaml for the full list of options, including probe timing and security context settings.

Security notes

• The deployment enables readOnlyRootFilesystem: true; only explicitly mounted emptyDir volumes are writable.
• runAsNonRoot is not supported because StrongSwan requires root for kernel-level IPsec operations.
• For production, reference the PSK via vpn.existingSecret instead of vpn.psk.

License

Apache-2.0 — see LICENSE.