VPN makes the machine appear offline

[Offbeatmammal]

I have a machine that's happily communicating with the hub, but when the user activates their VPN connection (quite common as they're testing from different GeoIPs throughout the day) Beszel reports the machine has gone offline.
Annoyingly on this particular config we can't enable split tunnels.
Any suggestions on a way to continue to monitor health without the VPN giving me gray hairs (I can't afford many more!) a couple of times a day?

[svenvg93]

THe only way to make this work is to ensure the that agent can reach the hub (WebSocket method) or that the Hub can reach the client (SSH Method) both via and with the VPN. From Beszel point of view there is nothing we can do on this as its normal network connectivity problem.

[Offbeatmammal]

problem turned out to actually be the VPN clobbering DNS.

DNS — let the container follow the host's resolver. PIA rewrites
/etc/resolv.conf in place (same inode), so a bind-mount tracks it live: the host's
resolver when the VPN is down, PIA's when it's up, both permitted.

services:
  beszel-agent:
    volumes:
      - /etc/resolv.conf:/etc/resolv.conf:ro

Detection lag — force a redial on each tunnel transition. systemd already tracks the
interface as a device unit, so this needs no polling loop. Adjust wgpia0 to match your
VPN's interface (tun0 for OpenVPN).

# /etc/systemd/system/vpn-redial.service
[Unit]
Description=Redial beszel-agent when the VPN tunnel appears or disappears
BindsTo=sys-subsystem-net-devices-wgpia0.device
After=sys-subsystem-net-devices-wgpia0.device docker.service
Requires=docker.service

[Service]
Type=oneshot
RemainAfterExit=yes
# Let the VPN finish installing routes, firewall and resolv.conf first.
ExecStartPre=/bin/sleep 5
ExecStart=/usr/bin/docker restart beszel-agent
ExecStop=/usr/bin/docker restart beszel-agent

[Install]
WantedBy=sys-subsystem-net-devices-wgpia0.device

and then activate
sudo systemctl daemon-reload && sudo systemctl enable vpn-redial.service

rather than staying down until the VPN it off again, I get an acceptable <10s red dot that doesn't trigger anything