RajaRename ci.yml to ci.yml

FAQ.md

@@ -10,7 +10,7 @@ git clone https://github.com/WhatsApp/proxy.git
 
 ## Common issues
 
-### (1) The container won't build on Windows with `set_public_ip_and_start.sh: Not found`
+### (1) The container won't build on Windows with `start.sh: Not found`
 
 This is likely a line encoding issue since the application is expecting unix-style line
 encoding (EOL not CRLF). This resolved in PR [72](https://github.com/WhatsApp/proxy/pull/72)

README.md

@@ -113,6 +113,23 @@ on connections. If you have a network load balancer you can preserve the client
 2. 8443: Standard web traffic, encrypted (HTTPS) with PROXY protocol expected
 3. 8222: Jabber protocol traffic (WhatsApp default) with PROXY protocol expected
 
+## Adverse network conditions
+
+The proxy container exposes many ports for different functionality.
+When deploying the container to work around adverse network conditions,
+this flexibility may actually be undesirable,
+since a proxy instance may be uniquely identified by some of the non-standard ports.
+
+To provide basic functionality (messages and media),
+we recommend exposing only ports 443 and 587 on the proxy endpoint.
+
+This is required **only if exposing the proxy on a public IP address**,
+and not needed for users connecting to the proxy through a VPN or a private connection.
+
+> Note: When using the proxy enabled HTTPS port (8443),
+> make sure port 8443 is exposed publicly as port 443,
+> to ensure WhatsApp clients can connect to port 443.
+
 ## Certificate generation for SSL encrypted ports
 
 Ports 443 and 8443 are protected by a self-signed encryption certificate generated at container start time. There are some custom options should you wish to tweak the settings of the generated certificates

charts/whatsapp-proxy-chart/Chart.yaml

@@ -17,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.1.0
+version: 1.3.12
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/whatsapp-proxy-chart/templates/configmap.yaml

@@ -0,0 +1,13 @@
+# Copyright (c) Meta Platforms, Inc. and affiliates.
+#
+# License found in the LICENSE file in the root directory
+# of this source tree.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "whatsapp-proxy-chart.fullname" . }}-haproxy
+  labels:
+    {{- include "whatsapp-proxy-chart.labels" . | nindent 4 }}
+data:
+  haproxy.cfg: |
+    {{- tpl .Values.haproxyConfig . | nindent 4 }}

charts/whatsapp-proxy-chart/templates/deployment.yaml

@@ -17,10 +17,11 @@ spec:
       {{- include "whatsapp-proxy-chart.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with .Values.podAnnotations }}
       annotations:
+        checksum/haproxy-config: {{ tpl .Values.haproxyConfig . | sha256sum }}
+        {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
-      {{- end }}
+        {{- end }}
       labels:
         {{- include "whatsapp-proxy-chart.selectorLabels" . | nindent 8 }}
     spec:
@@ -38,41 +39,33 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
-            {{- if .Values.service.http_proxy_port }}
             - name: http-proxy
               containerPort: 8080
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.http_port }}
             - name: http
               containerPort: 80
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.https_proxy_port }}
             - name: https-proxy
               containerPort: 8443
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.https_port }}
             - name: https
               containerPort: 443
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.jabber_proxy_port }}
             - name: jabber-proxy
               containerPort: 8222
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.jabber_port }}
             - name: jabber
               containerPort: 5222
               protocol: TCP
-            {{- end}}
-            {{- if .Values.service.stats_port }}
+            - name: media
+              containerPort: 587
+              protocol: TCP
+            - name: media-proxy
+              containerPort: 7777
+              protocol: TCP
             - name: stats
               containerPort: 8199
               protocol: TCP
-            {{- end}}
           readinessProbe:
             exec:
               command:
@@ -81,9 +74,25 @@ spec:
             periodSeconds: 30
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          {{- with .Values.extraEnv }}
           env:
-            - name: "PUBLIC_IP"
-              value: "{{ .Values.public_ip }}"
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: haproxy-config
+              mountPath: /usr/local/etc/haproxy/haproxy.cfg
+              subPath: haproxy.cfg
+              readOnly: true
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+      volumes:
+        - name: haproxy-config
+          configMap:
+            name: {{ include "whatsapp-proxy-chart.fullname" . }}-haproxy
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/whatsapp-proxy-chart/templates/hpa.yaml

@@ -3,7 +3,7 @@
 # License found in the LICENSE file in the root directory
 # of this source tree.
 {{- if .Values.autoscaling.enabled }}
-apiVersion: autoscaling/v2beta1
+apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
   name: {{ include "whatsapp-proxy-chart.fullname" . }}
@@ -21,12 +21,19 @@ spec:
     - type: Resource
       resource:
         name: cpu
-        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
     {{- end }}
     {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
     - type: Resource
       resource:
         name: memory
-        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+    {{- with .Values.autoscaling.customMetrics }}
+    {{- toYaml . | nindent 4 }}
     {{- end }}
 {{- end }}

charts/whatsapp-proxy-chart/templates/service.yaml

@@ -15,6 +15,9 @@ metadata:
 
 spec:
   type: {{ .Values.service.type }}
+  {{- with .Values.service.loadBalancerClass }}
+  loadBalancerClass: {{ . | quote }}
+  {{- end }}
   ports:
     {{- if .Values.service.http_proxy_port }}
     - port: {{ .Values.service.http_proxy_port }}
@@ -64,7 +67,6 @@ spec:
       protocol: TCP
       name: media
     {{- end}}
-
     {{- if .Values.service.media_proxy_port }}
     - port: {{ .Values.service.media_proxy_port }}
       targetPort: 7777

charts/whatsapp-proxy-chart/templates/servicemonitor.yaml

@@ -0,0 +1,24 @@
+# Copyright (c) Meta Platforms, Inc. and affiliates.
+#
+# License found in the LICENSE file in the root directory
+# of this source tree.
+{{- if .Values.enableServiceMonitor }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "whatsapp-proxy-chart.fullname" . }}-servicemonitor
+  namespace: default
+  labels:
+    release: {{ .Values.prometheus.release }}
+spec:
+  endpoints:
+  - interval: 30s
+    path: /metrics
+    port: stats
+  namespaceSelector:
+    matchNames:
+    - default
+  selector:
+    matchLabels:
+      {{- include "whatsapp-proxy-chart.selectorLabels" . | nindent 6 }}
+{{- end }}

charts/whatsapp-proxy-chart/templates/tests/test-connection.yaml

@@ -6,10 +6,12 @@ apiVersion: v1
 kind: Pod
 metadata:
   name: "{{ include "whatsapp-proxy-chart.fullname" . }}-test-connection"
-  labels:
-    {{- include "whatsapp-proxy-chart.labels" . | nindent 4 }}
+  # Intentionally omit common/selector labels so this pod is not matched by the
+  # HPA's selector. This test pod has no resource requests, and including it
+  # would break the HPA's utilization calculation.
   annotations:
     "helm.sh/hook": test
+    "helm.sh/hook-delete-policy": hook-succeeded
 spec:
   containers:
     - name: wget