逆プロキシレート.loans/stack.loans は k1m1 を TLS でホスト
k1m1 Traefik は、api.rate.loans、www.rate.loans の HTTPS を終了し、 www.stack.loans、 プレーン HTTP を上流 Traefik に転送する 192.168.4.36:80。 ホストごとの自動認証種子は、すべての3つのセルを暗号化してみましょう.
Add プライシング@kamocrm.comメールボックスと外部IMAPノードポート
- 新サービスメール/dovecot-imap-external (NodePort 30143 -> 143) など IMAPは、$NODE:30143でクラスターの外から到達することができます。 - mysql-initでシードprices@kamocrm.comは、新しいDBブートストラップ メールボックスを再作...
Seed pbx.k1.kluster.kamocrm.com 静的ドメインとして
ブラウザのソフトフォンは、SIP-over-WSSがホスト名に実質的に上陸する必要があります TLSの証明書。 FreePBX 管理者/WS ホスト名を STATIC DOMAINS に追加して、 auto-cert のシーダーのプロビジョニングは 1 ホストの Cert を暗号化しましょう Traefikアクセスログ...
ブラウザソフトフォン用のWSS WebRTCトランスポートを追加
Asterisk の chan pjsip は 0.0.0.0:8089 で普通の WebSocket の輸送を結合しました ************************でTLSを終了 (ポート 443) そのため、kamo-internalは、既存のワイルドカードの上にブラウザのソフトフォンを登録することができま...
生産はPJSIPの刑務所およびpersistentの状態と2ban失敗します
- [asterisk] と [freepbx-web] の jails で、fail2ban-configmap.yaml を追加します。 増分禁止エスカレーション(1h→24h→30d天井)、LAN無視、およびa PJSIP SecurityEvent レコードをターゲットとするカスタム asterisk-secu...
Integrate Coqui TTS with norman voice (VCTK p267)
- Deploy coqui-tts server (VCTK VITS model, CPU-only) as ClusterIP service on port 5002 with model cache at /var/lib/coqui-tts on k1m1 - Inject coqui_tts.agi ...
Add LAN DNS pod for split-DNS on k1m1
Deploys a dnsmasq pod with hostNetwork on k1m1 that listens on 192.168.4.22:53. Overrides pbx.k1.kluster.kamocrm.com -> 192.168.4.22 so LAN phones reach the PBX...
FreePBX 17 + jigasi SIP ブリッジを k1m1 と k2m1 にデプロイする
FreePBX (tiredofit/freepbx:17-latest) は hostNetwork で実行されるため、SIP/RTP 実際のクライアント IP を保存し、nodeSelector 経由で 1 ノードをピン留めします。 SIPについて 5060 UDP/TCP (5061 TLS)、Janusを避ける...
Add weekly image prune and journal vacuum CronJob for k1m1
CronJob runs every Sunday 3am, privileged, pinned to k1m1. - crictl rmi --prune removes unused container images - nsenter journal vacuum enforces 500MB cap - CI...
Add geo-database-url to analytics-secret for CockroachDB geolite lookup
Kamo Analytics uses this URL to look up visitor IP→country/region/city from the **************** tables. Uses kamo user with password auth and sslmode=require (...
Add iframe-compatible middleware chain for kamo-analytics
Add security-headers-allow-iframe (no X-Frame-Options) and kamo-middlewares-allow-iframe chain so analytics can be embedded in iframes from internal.kamocrm.com...
Move kamo-analytics to own repo, keep only postgres in KlusterServices
- Remove analytics deployment, service, and nginx-configmap (now owned by kamo-analytics project with its own CI/CD pipeline) - Remove analytics-ingressroute ...
Rebrand analytics analytics UI with Kamo logo, title, and favicon
Adds nginx sidecar proxy that injects CSS to replace the analytics logo with KamoCRM logo, changes the page title to "Kamo Analytics", and overrides the favicon...
Add analytics analytics deployment and analytics.kamocrm.com routing
- New analytics/ directory: PostgreSQL StatefulSet + analytics deployment, services, and secret template - **************** routes analytics.kamocrm.com → analy...
Restore bergamot with working model sources and correct image
- replicas: 1 - Init container (alpine): downloads 4 pairs from data.statmt.org (tarballs for enes/enfr/ende/enpl) and 2 from firefox-translations-models GitH...
Configure Prosody, Jicofo, and secrets for Jibri recording support
Enable recording in Prosody, add Jibri XMPP passwords to secrets, and configure Jicofo brewery MUC for Jibri instance discovery.
Add Jibri deployment manifests for Meet meeting recording
Kubernetes deployment, service, and configmap for Jibri (Meet Broadcasting Infrastructure) to enable meeting recording with MinIO storage integration.
Add Meet service deployment steps to CI/CD pipeline for k1m1 and k2m1
Add distributed JVB pool with per-node StatefulSets on k1m1 and k2m1
Add Jicofo conference focus with JVB brewery and lobby enforcement
Add Prosody XMPP server deployment with JWT auth and lobby support
Add Qdrant vector DB and MiniLM embedding model K8s manifests
- Qdrant v1.12.1 deployment + ClusterIP service (ports 6333/6334) - HuggingFace TEI with all-MiniLM-L6-v2 deployment + service (port 8080) - Updated deploy-serv...
Add wopi-*** for DocsService
Adds WOPI JWT signing secret used by DocsService for Docs access tokens. Deployed to both K1M1 and K2M1 clusters.
Add HTTP to HTTPS redirect middleware and IngressRoute
- Create redirect-to-https middleware for permanent redirects - Add catch-all IngressRoute on web entrypoint to redirect all kamocrm.com domains to HTTPS - Fixe...
Add automatic *** secret creation
- Create *** secret on both k1m1 and k2m1 - Secret contains MINIO_CURRENT_HOST pointing to k0m1 MinIO instance (http://10.8.0.1:9000) - Fixes kamowssecurity-dep...
Update TURN server credentials with secure values
- Updated turn-secret with secure random value - Updated turn-password for Janus authentication - Credentials match MediaService WebRTC configuration
Add ServersTransport deployment to CI/CD workflow
Deploy traefik/serverstransport.yaml as part of Traefik deployment to both K1M1 and K2M1. This enables HTTP/1.1 backend connections for MediaService WebSocket s...
Add ServersTransport for MediaService WebSocket connections
Add media-websocket-transport ServersTransport resource to disable HTTP/2 for backend connections to MediaService. This is required for proper WebSocket upgrade...
Add media-websocket-upgrade middleware to force Upgrade header
- Add Upgrade: websocket header for WebSocket paths to fix HTTP/2 Extended CONNECT conversion - This ensures HTTP/2 WebSocket upgrade requests are properly conv...
Add media-cors middleware for media domain CORS support
- Add media-cors middleware matching theme-cors configuration - Allows CORS headers to be set for media.{domain} requests
Add 'media' subdomain to auto-cert SUBDOMAINS for MediaService
- Add 'media' to SUBDOMAINS list in auto-cert-service.yaml - Enables automatic SSL certificate generation for media.{domain} subdomains - Required for MediaServ...