Ultradesu
29d95cd853
1.3 KiB
MTProxy
Argo CD deploys this directory through the mtproxy entry in
core-state/values.yaml. Two telemt DaemonSets run on every node labeled
homelab.hexor.cy/exposure=external: classic MTProxy on 30443/TCP and
fake-TLS on 30444/TCP. The classic listener replaces the old amd64-only
telegrammessenger/proxy image so the arm64 spb node is covered.
Vaultwarden item k8s/mtproxy/secret must contain a custom field named
Secret with the existing 32-character hexadecimal MTProxy secret. External
Secrets renders both configurations from that field. Reloader restarts the
DaemonSets when it changes. Changing this value invalidates existing links.
mtproxy-link-reconciler lists external nodes every five minutes and creates
mtproxy-links and telemt-links Secrets. A node's public DNS name must be
<node>.hexor.cy and must point to that node. The reader at proxy.hexor.cy
has read-only access to those two Secrets and is protected by Keycloak's
forward auth; its access policy is in terraform/keycloak/terraform.tfvars.
The proxy Pods have no Kubernetes API access.
Before traffic is switched over, allow inbound 30443/TCP and 30444/TCP on every external node and verify both DNS and connectivity on each node. Neither the cluster nor host firewall is changed by these manifests.