# Signal CLI REST API Deployment

## Overview
Signal CLI REST API deployed in the `connections` namespace, accessible at `connections.local.mk-labs.cloud` with automatic TLS certificate management.

## Infrastructure Details

### Namespace
- **Name**: `connections`
- **Theme**: EPCOT Connections (Communication & World Showcase)

### Deployment
- **Name**: `signal-cli-rest-api`
- **Image**: `bbernhard/signal-cli-rest-api:0.85`
- **Replicas**: 1 (MUST be 1 - signal-cli state is not multi-instance safe)
- **Strategy**: Recreate (prevents dual mount of PVC)
- **Mode**: json-rpc

### Service
- **Name**: `connections`
- **Type**: ClusterIP
- **Port**: 8080
- **Selector**: `app.kubernetes.io/name: signal-cli-rest-api`

### Ingress
- **Name**: `connections`
- **Class**: nginx
- **Hostname**: `connections.local.mk-labs.cloud`
- **TLS**: Enabled with cert-manager
- **Certificate**: Auto-provisioned via Let's Encrypt (letsencrypt-prod ClusterIssuer)
- **DNS Challenge**: Cloudflare DNS-01

### Storage
- **PVC**: `signal-cli-data`
- **Mount Path**: `/home/.local/share/signal-cli`

## ArgoCD Deployment

### Application
- **Name**: `signal-cli`
- **Namespace**: `argocd`
- **Sync Wave**: 8
- **Source Path**: `cluster/applications/signal-cli/`
- **Auto Sync**: Enabled
- **Auto Prune**: Enabled
- **Self Heal**: Enabled

## SSL/TLS Status

### External Access (Ingress)
✅ **Working** - TLS certificate successfully issued by Let's Encrypt
- Certificate CN: `connections.local.mk-labs.cloud`
- Issuer: Let's Encrypt (YR2)
- Valid until: September 10, 2026
- DNS-01 challenge completed successfully via Cloudflare

### Signal Server Communication
✅ **Working** - No SSL errors detected
- Signal-cli uses Java's built-in truststore (OpenJDK 21)
- Java truststore includes Signal's CA certificates
- No custom CA injection needed

### Note on curl SSL Errors
The initial SSL error encountered with curl was due to the system CA bundle being outdated in the container. This does NOT affect signal-cli functionality because:
1. Signal-cli uses Java's truststore, not the system CA bundle
2. Java's truststore is properly maintained and includes Signal's root CA
3. All signal-cli operations work correctly without SSL errors

## Endpoints

### Health Check
```bash
GET https://connections.local.mk-labs.cloud/v1/health
```

### About/Version
```bash
GET https://connections.local.mk-labs.cloud/v1/about
```

Expected response:
```json
{
  "versions": ["v1", "v2"],
  "build": 2,
  "mode": "json-rpc",
  "version": "0.85",
  "capabilities": {
    "v2/send": ["quotes", "mentions"]
  }
}
```

## Migration from cluster/platform/connections

Files were moved from `cluster/platform/connections/` to `cluster/applications/signal-cli/`:
- ✅ namespace.yaml
- ✅ deployment.yaml
- ✅ service.yaml
- ✅ persistentvolumeclaim.yaml
- ✅ application.yaml (updated source path)
- ✅ ingress.yaml (newly created)

## Next Steps

1. **DNS Configuration**: Ensure `connections.local.mk-labs.cloud` resolves to the nginx-ingress controller IP
2. **Registration**: Register a Signal phone number via the REST API
3. **Integration**: Configure Hermes to use this endpoint for Signal notifications

## Monitoring

Check deployment status:
```bash
kubectl get all,ingress,certificate -n connections
```

Check ArgoCD sync status:
```bash
kubectl get application signal-cli -n argocd
```

View logs:
```bash
kubectl logs -n connections deployment/signal-cli-rest-api -f
```