12d0a75b3a
Document infrastructure setup, TLS configuration, and SSL certificate status for the Signal CLI REST API deployment at connections.local.mk-labs.cloud
126 lines
3.4 KiB
Markdown
126 lines
3.4 KiB
Markdown
# Signal CLI REST API Deployment
|
|
|
|
## Overview
|
|
Signal CLI REST API deployed in the `connections` namespace, accessible at `connections.local.mk-labs.cloud` with automatic TLS certificate management.
|
|
|
|
## Infrastructure Details
|
|
|
|
### Namespace
|
|
- **Name**: `connections`
|
|
- **Theme**: EPCOT Connections (Communication & World Showcase)
|
|
|
|
### Deployment
|
|
- **Name**: `signal-cli-rest-api`
|
|
- **Image**: `bbernhard/signal-cli-rest-api:0.85`
|
|
- **Replicas**: 1 (MUST be 1 - signal-cli state is not multi-instance safe)
|
|
- **Strategy**: Recreate (prevents dual mount of PVC)
|
|
- **Mode**: json-rpc
|
|
|
|
### Service
|
|
- **Name**: `connections`
|
|
- **Type**: ClusterIP
|
|
- **Port**: 8080
|
|
- **Selector**: `app.kubernetes.io/name: signal-cli-rest-api`
|
|
|
|
### Ingress
|
|
- **Name**: `connections`
|
|
- **Class**: nginx
|
|
- **Hostname**: `connections.local.mk-labs.cloud`
|
|
- **TLS**: Enabled with cert-manager
|
|
- **Certificate**: Auto-provisioned via Let's Encrypt (letsencrypt-prod ClusterIssuer)
|
|
- **DNS Challenge**: Cloudflare DNS-01
|
|
|
|
### Storage
|
|
- **PVC**: `signal-cli-data`
|
|
- **Mount Path**: `/home/.local/share/signal-cli`
|
|
|
|
## ArgoCD Deployment
|
|
|
|
### Application
|
|
- **Name**: `signal-cli`
|
|
- **Namespace**: `argocd`
|
|
- **Sync Wave**: 8
|
|
- **Source Path**: `cluster/applications/signal-cli/`
|
|
- **Auto Sync**: Enabled
|
|
- **Auto Prune**: Enabled
|
|
- **Self Heal**: Enabled
|
|
|
|
## SSL/TLS Status
|
|
|
|
### External Access (Ingress)
|
|
✅ **Working** - TLS certificate successfully issued by Let's Encrypt
|
|
- Certificate CN: `connections.local.mk-labs.cloud`
|
|
- Issuer: Let's Encrypt (YR2)
|
|
- Valid until: September 10, 2026
|
|
- DNS-01 challenge completed successfully via Cloudflare
|
|
|
|
### Signal Server Communication
|
|
✅ **Working** - No SSL errors detected
|
|
- Signal-cli uses Java's built-in truststore (OpenJDK 21)
|
|
- Java truststore includes Signal's CA certificates
|
|
- No custom CA injection needed
|
|
|
|
### Note on curl SSL Errors
|
|
The initial SSL error encountered with curl was due to the system CA bundle being outdated in the container. This does NOT affect signal-cli functionality because:
|
|
1. Signal-cli uses Java's truststore, not the system CA bundle
|
|
2. Java's truststore is properly maintained and includes Signal's root CA
|
|
3. All signal-cli operations work correctly without SSL errors
|
|
|
|
## Endpoints
|
|
|
|
### Health Check
|
|
```bash
|
|
GET https://connections.local.mk-labs.cloud/v1/health
|
|
```
|
|
|
|
### About/Version
|
|
```bash
|
|
GET https://connections.local.mk-labs.cloud/v1/about
|
|
```
|
|
|
|
Expected response:
|
|
```json
|
|
{
|
|
"versions": ["v1", "v2"],
|
|
"build": 2,
|
|
"mode": "json-rpc",
|
|
"version": "0.85",
|
|
"capabilities": {
|
|
"v2/send": ["quotes", "mentions"]
|
|
}
|
|
}
|
|
```
|
|
|
|
## Migration from cluster/platform/connections
|
|
|
|
Files were moved from `cluster/platform/connections/` to `cluster/applications/signal-cli/`:
|
|
- ✅ namespace.yaml
|
|
- ✅ deployment.yaml
|
|
- ✅ service.yaml
|
|
- ✅ persistentvolumeclaim.yaml
|
|
- ✅ application.yaml (updated source path)
|
|
- ✅ ingress.yaml (newly created)
|
|
|
|
## Next Steps
|
|
|
|
1. **DNS Configuration**: Ensure `connections.local.mk-labs.cloud` resolves to the nginx-ingress controller IP
|
|
2. **Registration**: Register a Signal phone number via the REST API
|
|
3. **Integration**: Configure Hermes to use this endpoint for Signal notifications
|
|
|
|
## Monitoring
|
|
|
|
Check deployment status:
|
|
```bash
|
|
kubectl get all,ingress,certificate -n connections
|
|
```
|
|
|
|
Check ArgoCD sync status:
|
|
```bash
|
|
kubectl get application signal-cli -n argocd
|
|
```
|
|
|
|
View logs:
|
|
```bash
|
|
kubectl logs -n connections deployment/signal-cli-rest-api -f
|
|
```
|