homelab/k8s-ng/apps/shadowsocks

Shadowsocks on spb

One shadowsocks-rust pod runs on spb, exposing 8388/TCP and 8388/UDP through host ports. Client settings:

• Server: spb.hexor.cy
• Port: 8388
• Method: chacha20-ietf-poly1305
• Password: the Password custom field of the Vaultwarden item named k8s/shadowsocks/secrets (exact name, not an item UUID).

Create that item in the server secrets vault accessible to the External Secrets bot. Use a long random password, for example generated with openssl rand -base64 32. External Secrets creates shadowsocks-config; Reloader restarts the deployment when the Secret changes. No persistent storage is required.

The spb NixOS configuration opens port 8388 for both protocols. Apply that configuration when deploying this application for the first time.