23 lines
1.3 KiB
Markdown
23 lines
1.3 KiB
Markdown
|
# MTProxy
|
||
|
|
|
||
|
|
Argo CD deploys this directory through the `mtproxy` entry in
|
||
|
|
`core-state/values.yaml`. Two telemt DaemonSets run on every node labeled
|
||
|
|
`homelab.hexor.cy/exposure=external`: classic MTProxy on 30443/TCP and
|
||
|
|
fake-TLS on 30444/TCP. The classic listener replaces the old amd64-only
|
||
|
|
`telegrammessenger/proxy` image so the arm64 `spb` node is covered.
|
||
|
|
|
||
|
|
Vaultwarden item `k8s/mtproxy/secret` must contain a custom field named
|
||
|
|
`Secret` with the existing 32-character hexadecimal MTProxy secret. External
|
||
|
|
Secrets renders both configurations from that field. Reloader restarts the
|
||
|
|
DaemonSets when it changes. Changing this value invalidates existing links.
|
||
|
|
|
||
|
|
`mtproxy-link-reconciler` lists external nodes every five minutes and creates
|
||
|
|
`mtproxy-links` and `telemt-links` Secrets. A node's public DNS name must be
|
||
|
|
`<node>.hexor.cy` and must point to that node. The reader at `proxy.hexor.cy`
|
||
|
|
has read-only access to those two Secrets and is protected by Keycloak's
|
||
|
|
forward auth; its access policy is in `terraform/keycloak/terraform.tfvars`.
|
||
|
|
The proxy Pods have no Kubernetes API access.
|
||
|
|
|
||
|
|
Before traffic is switched over, allow inbound 30443/TCP and 30444/TCP on
|
||
|
|
every external node and verify both DNS and connectivity on each node.
|
||
|
|
Neither the cluster nor host firewall is changed by these manifests.
|