This was meant to be a quick swap of Newt, the Pangolin tunnel agent running in my cluster, for a tinier WireGuard pod I wrote in 30 lines of shell. It turned into an end-to-end teardown of Pangolin itself, replaced with Caddy, Authelia and CrowdSec on the VPS. This is the long version.