Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-02-16 11:37:45

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

k8s/apps/mtproxy/Dockerfile

@@ -1,12 +1,32 @@
-FROM debian:bookworm-slim AS builder
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS builder
+
+ARG TARGETARCH
 
 RUN apt-get update && apt-get install -y \
-    git curl build-essential libssl-dev zlib1g-dev \
+    git curl make gcc libssl-dev zlib1g-dev \
     && rm -rf /var/lib/apt/lists/*
 
+RUN if [ "$(dpkg --print-architecture)" != "$TARGETARCH" ]; then \
+      dpkg --add-architecture $TARGETARCH && \
+      apt-get update && \
+      case "$TARGETARCH" in \
+        arm64) apt-get install -y gcc-aarch64-linux-gnu libssl-dev:arm64 zlib1g-dev:arm64 ;; \
+        amd64) apt-get install -y gcc-x86-64-linux-gnu libssl-dev:amd64 zlib1g-dev:amd64 ;; \
+      esac && \
+      rm -rf /var/lib/apt/lists/*; \
+    fi
+
 RUN git clone https://github.com/TelegramMessenger/MTProxy.git /src
 WORKDIR /src
-RUN make -j$(nproc)
+
+RUN NATIVE=$(dpkg --print-architecture) && \
+    if [ "$NATIVE" != "$TARGETARCH" ]; then \
+      case "$TARGETARCH" in \
+        arm64) export CC=aarch64-linux-gnu-gcc ;; \
+        amd64) export CC=x86_64-linux-gnu-gcc ;; \
+      esac; \
+    fi && \
+    make -j$(nproc)
 
 FROM debian:bookworm-slim
 

k8s/apps/mtproxy/daemonset.yaml

@@ -23,11 +23,57 @@ spec:
               - matchExpressions:
                   - key: mtproxy
                     operator: Exists
+      serviceAccountName: mtproxy
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
+      initContainers:
+        - name: register-proxy
+          image: bitnami/kubectl:latest
+          env:
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: tgproxy-secret
+                  key: SECRET
+            - name: PORT
+              valueFrom:
+                secretKeyRef:
+                  name: tgproxy-secret
+                  key: PORT
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -e
+              curl -s https://core.telegram.org/getProxySecret -o /data/proxy-secret
+              curl -s https://core.telegram.org/getProxyConfig -o /data/proxy-multi.conf
+              NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
+              SERVER=$(kubectl get node "${NODE_NAME}" -o jsonpath='{.metadata.labels.mtproxy}')
+              if [ -z "${SERVER}" ]; then
+                echo "ERROR: node ${NODE_NAME} has no mtproxy label"
+                exit 1
+              fi
+              LINK="tg://proxy?server=${SERVER}&port=${PORT}&secret=${SECRET}"
+              echo "Registering: ${SERVER} -> ${LINK}"
+              if kubectl get secret mtproxy-links -n "${NAMESPACE}" &>/dev/null; then
+                kubectl patch secret mtproxy-links -n "${NAMESPACE}" \
+                  --type merge -p "{\"stringData\":{\"${SERVER}\":\"${LINK}\"}}"
+              else
+                kubectl create secret generic mtproxy-links -n "${NAMESPACE}" \
+                  --from-literal="${SERVER}=${LINK}"
+              fi
+              echo "Done"
       containers:
         - name: mtproxy
-          image: ultradesu/mtproxy:v0.02
+          image: telegrammessenger/proxy:latest
+          # image: ultradesu/mtproxy:v0.02
           imagePullPolicy: Always
           ports:
             - name: proxy
@@ -43,8 +89,8 @@ spec:
               -H $(PORT)
               -M 1
               -S $(SECRET)
-              --aes-pwd /etc/mtproxy/proxy-secret
+              --aes-pwd /data/proxy-secret
-              /etc/mtproxy/proxy-multi.conf
+              /data/proxy-multi.conf
           env:
             - name: SECRET
               valueFrom:

k8s/apps/mtproxy/kustomization.yaml

@@ -3,7 +3,9 @@ kind: Kustomization
 
 resources:
   - ./app.yaml
+  - ./rbac.yaml
   - ./daemonset.yaml
   - ./external-secrets.yaml
+  - ./service.yaml
+  - ./secret-reader.yaml
 # - ./storage.yaml
-# - ./service.yaml

k8s/apps/mtproxy/rbac.yaml

@@ -0,0 +1,58 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mtproxy
+  labels:
+    app: mtproxy
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: mtproxy-node-reader
+  labels:
+    app: mtproxy
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: mtproxy-node-reader
+  labels:
+    app: mtproxy
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: mtproxy-node-reader
+subjects:
+  - kind: ServiceAccount
+    name: mtproxy
+    namespace: mtproxy
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: mtproxy-secret-manager
+  labels:
+    app: mtproxy
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: mtproxy-secret-manager
+  labels:
+    app: mtproxy
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: mtproxy-secret-manager
+subjects:
+  - kind: ServiceAccount
+    name: mtproxy

k8s/apps/mtproxy/secret-reader.yaml

@@ -0,0 +1,63 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: secret-reader
+  labels:
+    app: secret-reader
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: secret-reader
+  template:
+    metadata:
+      labels:
+        app: secret-reader
+    spec:
+      serviceAccountName: mtproxy
+      nodeSelector:
+        kubernetes.io/os: linux
+      containers:
+      - name: secret-reader
+        image: ultradesu/k8s-secrets:0.2.1
+        imagePullPolicy: Always
+        args:
+          - "--secrets"
+          - "mtproxy-links"
+          - "--namespace"
+          - "mtproxy"
+          - "--port"
+          - "3000"
+        ports:
+        - containerPort: 3000
+          name: http
+        env:
+        - name: RUST_LOG
+          value: "info"
+        resources:
+          requests:
+            memory: "64Mi"
+            cpu: "50m"
+          limits:
+            memory: "128Mi"
+            cpu: "150m"
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: http
+          initialDelaySeconds: 10
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: http
+          initialDelaySeconds: 5
+          periodSeconds: 5
+        securityContext:
+          runAsNonRoot: true
+          runAsUser: 1000
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL

k8s/apps/mtproxy/service.yaml

@@ -2,15 +2,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: mtproxy
+  name: secret-reader
+  labels:
+    app: secret-reader
 spec:
-  type: LoadBalancer
+  type: ClusterIP
   selector:
-    app: mtproxy
+    app: secret-reader
   ports:
-    - name: proxy
+  - port: 80
-      port: 30443
+    targetPort: 3000
-      targetPort: 30443
+    protocol: TCP
-      protocol: TCP
+    name: http
-      nodePort: 30443
-

k8s/apps/n8n/deployment-main.yaml

@@ -54,6 +54,8 @@ spec:
         ports:
         - containerPort: 5678
           name: http
+        - containerPort: 5679
+          name: task-broker
         env:
         - name: PATH
           value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
@@ -73,6 +75,10 @@ spec:
           value: "true"
         - name: N8N_RUNNERS_MODE
           value: "external"
+        - name: N8N_RUNNERS_BROKER_LISTEN_ADDRESS
+          value: "0.0.0.0"
+        - name: N8N_RUNNERS_BROKER_PORT
+          value: "5679"
         - name: EXECUTIONS_MODE
           value: "queue"
         - name: QUEUE_BULL_REDIS_HOST
@@ -127,18 +133,18 @@ spec:
           httpGet:
             path: /healthz
             port: http
-          initialDelaySeconds: 120
+          initialDelaySeconds: 240
           periodSeconds: 30
-          timeoutSeconds: 10
+          timeoutSeconds: 20
-          failureThreshold: 6
+          failureThreshold: 10
         readinessProbe:
           httpGet:
             path: /healthz/readiness
             port: http
-          initialDelaySeconds: 60
+          initialDelaySeconds: 120
           periodSeconds: 10
           timeoutSeconds: 5
-          failureThreshold: 10
+          failureThreshold: 15
       volumes:
       - name: n8n-data
         persistentVolumeClaim:

k8s/apps/n8n/deployment-runner.yaml

@@ -0,0 +1,92 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: n8n-runner
+  labels:
+    app: n8n
+    component: runner
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: n8n
+      component: runner
+  template:
+    metadata:
+      labels:
+        app: n8n
+        component: runner
+    spec:
+      serviceAccountName: n8n
+      containers:
+      - name: n8n-runner
+        image: docker.n8n.io/n8nio/n8n:latest
+        command:
+        - /bin/sh
+        - -c
+        - /usr/local/bin/task-runner-launcher javascript
+        env:
+        - name: PATH
+          value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+        - name: HOME
+          value: "/home/node"
+        - name: N8N_RUNNERS_TASK_BROKER_URI
+          value: "n8n:5679"
+        - name: N8N_RUNNERS_MODE
+          value: "external"
+        - name: N8N_RUNNERS_MAX_CONCURRENCY
+          value: "10"
+        - name: N8N_RUNNERS_AUTO_SHUTDOWN_TIMEOUT
+          value: "30"
+        - name: NODE_OPTIONS
+          value: "--max-old-space-size=1024"
+        - name: GENERIC_TIMEZONE
+          value: "Europe/Moscow"
+        - name: TZ
+          value: "Europe/Moscow"
+        - name: N8N_RUNNERS_AUTH_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: credentials
+              key: runnertoken
+        volumeMounts:
+        - name: n8n-data
+          mountPath: /home/node/.n8n
+        - name: tools
+          mountPath: /opt/tools
+        resources:
+          requests:
+            cpu: 500m
+            memory: 512Mi
+          limits:
+            cpu: 2000m
+            memory: 2048Mi
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 5680
+          initialDelaySeconds: 30
+          periodSeconds: 30
+          timeoutSeconds: 5
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: 5680
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+      volumes:
+      - name: n8n-data
+        persistentVolumeClaim:
+          claimName: n8n-data
+      - name: tools
+        persistentVolumeClaim:
+          claimName: n8n-tools
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        fsGroup: 1000

k8s/apps/n8n/deployment-worker.yaml

@@ -36,6 +36,10 @@ spec:
           value: "true"
         - name: N8N_RUNNERS_MODE
           value: "external"
+        - name: N8N_RUNNERS_BROKER_LISTEN_ADDRESS
+          value: "0.0.0.0"
+        - name: N8N_RUNNERS_BROKER_PORT
+          value: "5679"
         - name: N8N_PORT
           value: "80"
         - name: EXECUTIONS_MODE

k8s/apps/n8n/kustomization.yaml

@@ -7,8 +7,11 @@ resources:
   - rbac.yaml
   - redis-deployment.yaml
   - redis-service.yaml
+  - paddleocr-deployment.yaml
+  - paddleocr-service.yaml
   - deployment-main.yaml
-  - deployment-worker.yaml
+# - deployment-worker.yaml
+  - deployment-runner.yaml
   - service.yaml
   - ingress.yaml
 

k8s/apps/n8n/paddleocr-deployment.yaml

@@ -0,0 +1,43 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paddleocr
+  labels:
+    app: paddleocr
+    component: n8n
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: paddleocr
+      component: n8n
+  template:
+    metadata:
+      labels:
+        app: paddleocr
+        component: n8n
+    spec:
+      containers:
+      - name: paddleocr
+        image: c403/paddleocr
+        ports:
+        - containerPort: 5000
+          name: http
+        resources:
+          requests:
+            cpu: 200m
+            memory: 512Mi
+          limits:
+            cpu: 1000m
+            memory: 2Gi
+        livenessProbe:
+          tcpSocket:
+            port: 5000
+          initialDelaySeconds: 60
+          periodSeconds: 30
+        readinessProbe:
+          tcpSocket:
+            port: 5000
+          initialDelaySeconds: 30
+          periodSeconds: 10

k8s/apps/n8n/paddleocr-service.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: paddleocr
+  labels:
+    app: paddleocr
+    component: n8n
+spec:
+  selector:
+    app: paddleocr
+    component: n8n
+  ports:
+  - name: http
+    port: 80
+    targetPort: 5000
+    protocol: TCP
+  type: ClusterIP

k8s/apps/n8n/service.yaml

@@ -14,4 +14,8 @@ spec:
     port: 80
     targetPort: 5678
     protocol: TCP
+  - name: task-broker
+    port: 5679
+    targetPort: 5679
+    protocol: TCP
   type: ClusterIP

terraform/authentik/proxy-apps.tfvars

@@ -60,7 +60,23 @@ EOT
     create_group                 = true
     access_groups                = ["admins"]
   }
-
+  "mtproxy-links" = {
+    name                         = "mtproxy-links"
+    slug                         = "mtproxy-links"
+    group                        = "Core"
+    external_host                = "https://proxy.hexor.cy"
+    internal_host                = "http://secret-reader.mtproxy.svc:80"
+    internal_host_ssl_validation = false
+    meta_description             = ""
+    skip_path_regex              = <<-EOT
+/webhook
+EOT
+    meta_icon                    = "https://img.icons8.com/ios-filled/50/password.png"
+    mode                         = "proxy"
+    outpost                      = "kubernetes-outpost"
+    create_group                 = true
+    access_groups                = ["admins"]
+  }
   # Tools applications
   "vpn" = {
     name                         = "VPN"