Argo CD deploys this directory through the mtproxy entry in core-state/values.yaml. Two telemt DaemonSets run on every node labeled homelab.hexor.cy/exposure=external: classic MTProxy on 30443/TCP and fake-TLS on 30444/TCP. The classic listener replaces the old amd64-only telegrammessenger/proxy image so the arm64 spb node is covered.

Vaultwarden item k8s/mtproxy/secret must contain a custom field named Secret with the existing 32-character hexadecimal MTProxy secret. External Secrets renders both configurations from that field. Reloader restarts the DaemonSets when it changes. Changing this value invalidates existing links.

mtproxy-link-reconciler lists external nodes every five minutes and creates mtproxy-links and telemt-links Secrets. A node's public DNS name must be <node>.hexor.cy and must point to that node. The reader at proxy.hexor.cy has read-only access to those two Secrets and is protected by Keycloak's forward auth; its access policy is in terraform/keycloak/terraform.tfvars. The proxy Pods have no Kubernetes API access.

Before traffic is switched over, allow inbound 30443/TCP and 30444/TCP on every external node and verify both DNS and connectivity on each node. Neither the cluster nor host firewall is changed by these manifests.