- Se descapó
- 23 de septiembre de 2026 a las 14:49 UTC
- Autor
- Kamo
- Compromit
- 7136a9e
computers is a standard alias now — every white-label org is told to point one at Kamo on /setup/dns, the way it points meet and sign — so two things had to follow it or the record would resolve and do nothing. A CERTIFICATE. computers joins SUBDOMAINS, which is the per-org list this service issues from. Without it an org's host has DNS and no TLS, which is a browser warning on their brand rather than a working desk. A ROUTE. The gateway matched Host(`computers.kamocrm.com`) and nothing else, so an org could add the record, watch the setup studio turn green and still land somewhere that is not this gateway. The new routes use HostRegexp(`^computers[.].+$`), the same shape **************** and the stream./grafana. routes already use. SEPARATE IngressRoutes rather than widening the existing rules, and the reason is TLS. The platform routes carry an explicit secretName, which is the only certificate that can be named ahead of time; a tenant's arrives when their domain goes live. Widening those rules would have made one named secret answer for every tenant domain — a certificate warning on somebody else's brand, which is worse than no route at all because it looks like Kamo got their domain wrong. The tenant routes leave TLS to Traefik's store and SNI, as meet does, and sit at lower priority so computers.kamocrm.com keeps its own. Serving every org from one regex hands nobody anything: the connection is chosen by the signed token, never by the hostname, and a token mints one computer for one member for one session.