Files

Hermes Agent service account 12d0a75b3a docs(signal-cli): Add deployment documentation

Document infrastructure setup, TLS configuration, and SSL certificate status
for the Signal CLI REST API deployment at connections.local.mk-labs.cloud

2026-06-12 16:56:13 -05:00

3.4 KiB

Raw Blame History

Signal CLI REST API Deployment

Overview

Signal CLI REST API deployed in the connections namespace, accessible at connections.local.mk-labs.cloud with automatic TLS certificate management.

Infrastructure Details

Namespace

Name: connections
Theme: EPCOT Connections (Communication & World Showcase)

Deployment

Name: signal-cli-rest-api
Image: bbernhard/signal-cli-rest-api:0.85
Replicas: 1 (MUST be 1 - signal-cli state is not multi-instance safe)
Strategy: Recreate (prevents dual mount of PVC)
Mode: json-rpc

Service

Name: connections
Type: ClusterIP
Port: 8080
Selector: app.kubernetes.io/name: signal-cli-rest-api

Ingress

Name: connections
Class: nginx
Hostname: connections.local.mk-labs.cloud
TLS: Enabled with cert-manager
Certificate: Auto-provisioned via Let's Encrypt (letsencrypt-prod ClusterIssuer)
DNS Challenge: Cloudflare DNS-01

Storage

PVC: signal-cli-data
Mount Path: /home/.local/share/signal-cli

ArgoCD Deployment

Application

Name: signal-cli
Namespace: argocd
Sync Wave: 8
Source Path: cluster/applications/signal-cli/
Auto Sync: Enabled
Auto Prune: Enabled
Self Heal: Enabled

SSL/TLS Status

External Access (Ingress)

✅ Working - TLS certificate successfully issued by Let's Encrypt

Certificate CN: connections.local.mk-labs.cloud
Issuer: Let's Encrypt (YR2)
Valid until: September 10, 2026
DNS-01 challenge completed successfully via Cloudflare

Signal Server Communication

✅ Working - No SSL errors detected

Signal-cli uses Java's built-in truststore (OpenJDK 21)
Java truststore includes Signal's CA certificates
No custom CA injection needed

Note on curl SSL Errors

The initial SSL error encountered with curl was due to the system CA bundle being outdated in the container. This does NOT affect signal-cli functionality because:

Signal-cli uses Java's truststore, not the system CA bundle
Java's truststore is properly maintained and includes Signal's root CA
All signal-cli operations work correctly without SSL errors

Endpoints

Health Check

GET https://connections.local.mk-labs.cloud/v1/health

About/Version

GET https://connections.local.mk-labs.cloud/v1/about

Expected response:

{
  "versions": ["v1", "v2"],
  "build": 2,
  "mode": "json-rpc",
  "version": "0.85",
  "capabilities": {
    "v2/send": ["quotes", "mentions"]
  }
}

Migration from cluster/platform/connections

Files were moved from cluster/platform/connections/ to cluster/applications/signal-cli/:

✅ namespace.yaml
✅ deployment.yaml
✅ service.yaml
✅ persistentvolumeclaim.yaml
✅ application.yaml (updated source path)
✅ ingress.yaml (newly created)

Next Steps

DNS Configuration: Ensure connections.local.mk-labs.cloud resolves to the nginx-ingress controller IP
Registration: Register a Signal phone number via the REST API
Integration: Configure Hermes to use this endpoint for Signal notifications

Monitoring

Check deployment status:

kubectl get all,ingress,certificate -n connections

Check ArgoCD sync status:

kubectl get application signal-cli -n argocd

View logs:

kubectl logs -n connections deployment/signal-cli-rest-api -f

3.4 KiB Raw Blame History