docs(signal-cli): Add deployment documentation

Document infrastructure setup, TLS configuration, and SSL certificate status
for the Signal CLI REST API deployment at connections.local.mk-labs.cloud

cluster/applications/signal-cli/DEPLOYMENT.md

@@ -0,0 +1,125 @@
+# Signal CLI REST API Deployment
+
+## Overview
+Signal CLI REST API deployed in the `connections` namespace, accessible at `connections.local.mk-labs.cloud` with automatic TLS certificate management.
+
+## Infrastructure Details
+
+### Namespace
+- **Name**: `connections`
+- **Theme**: EPCOT Connections (Communication & World Showcase)
+
+### Deployment
+- **Name**: `signal-cli-rest-api`
+- **Image**: `bbernhard/signal-cli-rest-api:0.85`
+- **Replicas**: 1 (MUST be 1 - signal-cli state is not multi-instance safe)
+- **Strategy**: Recreate (prevents dual mount of PVC)
+- **Mode**: json-rpc
+
+### Service
+- **Name**: `connections`
+- **Type**: ClusterIP
+- **Port**: 8080
+- **Selector**: `app.kubernetes.io/name: signal-cli-rest-api`
+
+### Ingress
+- **Name**: `connections`
+- **Class**: nginx
+- **Hostname**: `connections.local.mk-labs.cloud`
+- **TLS**: Enabled with cert-manager
+- **Certificate**: Auto-provisioned via Let's Encrypt (letsencrypt-prod ClusterIssuer)
+- **DNS Challenge**: Cloudflare DNS-01
+
+### Storage
+- **PVC**: `signal-cli-data`
+- **Mount Path**: `/home/.local/share/signal-cli`
+
+## ArgoCD Deployment
+
+### Application
+- **Name**: `signal-cli`
+- **Namespace**: `argocd`
+- **Sync Wave**: 8
+- **Source Path**: `cluster/applications/signal-cli/`
+- **Auto Sync**: Enabled
+- **Auto Prune**: Enabled
+- **Self Heal**: Enabled
+
+## SSL/TLS Status
+
+### External Access (Ingress)
+✅ **Working** - TLS certificate successfully issued by Let's Encrypt
+- Certificate CN: `connections.local.mk-labs.cloud`
+- Issuer: Let's Encrypt (YR2)
+- Valid until: September 10, 2026
+- DNS-01 challenge completed successfully via Cloudflare
+
+### Signal Server Communication
+✅ **Working** - No SSL errors detected
+- Signal-cli uses Java's built-in truststore (OpenJDK 21)
+- Java truststore includes Signal's CA certificates
+- No custom CA injection needed
+
+### Note on curl SSL Errors
+The initial SSL error encountered with curl was due to the system CA bundle being outdated in the container. This does NOT affect signal-cli functionality because:
+1. Signal-cli uses Java's truststore, not the system CA bundle
+2. Java's truststore is properly maintained and includes Signal's root CA
+3. All signal-cli operations work correctly without SSL errors
+
+## Endpoints
+
+### Health Check
+```bash
+GET https://connections.local.mk-labs.cloud/v1/health
+```
+
+### About/Version
+```bash
+GET https://connections.local.mk-labs.cloud/v1/about
+```
+
+Expected response:
+```json
+{
+  "versions": ["v1", "v2"],
+  "build": 2,
+  "mode": "json-rpc",
+  "version": "0.85",
+  "capabilities": {
+    "v2/send": ["quotes", "mentions"]
+  }
+}
+```
+
+## Migration from cluster/platform/connections
+
+Files were moved from `cluster/platform/connections/` to `cluster/applications/signal-cli/`:
+- ✅ namespace.yaml
+- ✅ deployment.yaml
+- ✅ service.yaml
+- ✅ persistentvolumeclaim.yaml
+- ✅ application.yaml (updated source path)
+- ✅ ingress.yaml (newly created)
+
+## Next Steps
+
+1. **DNS Configuration**: Ensure `connections.local.mk-labs.cloud` resolves to the nginx-ingress controller IP
+2. **Registration**: Register a Signal phone number via the REST API
+3. **Integration**: Configure Hermes to use this endpoint for Signal notifications
+
+## Monitoring
+
+Check deployment status:
+```bash
+kubectl get all,ingress,certificate -n connections
+```
+
+Check ArgoCD sync status:
+```bash
+kubectl get application signal-cli -n argocd
+```
+
+View logs:
+```bash
+kubectl logs -n connections deployment/signal-cli-rest-api -f
+```