# MTProxy

Argo CD deploys this directory through the `mtproxy` entry in
`core-state/values.yaml`. Two telemt DaemonSets run on every node labeled
`homelab.hexor.cy/exposure=external`: classic MTProxy on 30443/TCP and
fake-TLS on 30444/TCP. The classic listener replaces the old amd64-only
`telegrammessenger/proxy` image so the arm64 `spb` node is covered.

Vaultwarden item `k8s/mtproxy/secret` must contain a custom field named
`Secret` with the existing 32-character hexadecimal MTProxy secret. External
Secrets renders both configurations from that field. Reloader restarts the
DaemonSets when it changes. Changing this value invalidates existing links.

`mtproxy-link-reconciler` lists external nodes every five minutes and creates
`mtproxy-links` and `telemt-links` Secrets. A node's public DNS name must be
`<node>.hexor.cy` and must point to that node. The reader at `proxy.hexor.cy`
has read-only access to those two Secrets and is protected by Keycloak's
forward auth; its access policy is in `terraform/keycloak/terraform.tfvars`.
The proxy Pods have no Kubernetes API access.

Before traffic is switched over, allow inbound 30443/TCP and 30444/TCP on
every external node and verify both DNS and connectivity on each node.
Neither the cluster nor host firewall is changed by these manifests.