WebSocket 用の Spring Security を適切に設定 - CSRF を完全に無効にし、WebSocket handhake 用のセッション作成 IF REQUIRED を有効にする
/ws/** エンドポイントの CSRF を無効にし、SockJS /ws/info 405 エラーを修正するためのセキュリティ設定を簡素化
明示的にGET/POST/HEAD メソッドを /ws/** エンドポイントで SockJS /ws/info 405 エラーを修正
コンパイルエラー(MediaSession、ServerHttpResponse の getStatusCode の getId )による不正なメソッド呼び出しを削除します
WebSocketConfigとChatWebSocketControllerにEXTENSIVEロギングを追加 - すべてのSTOMPフレーム、ハンドシェイク、サブスクリプション、およびメッセージを記録
IngressRouteにWebSocketミドルウェアとServersTransportを追加
- WebSocketアップグレードヘッダー用のメディアWebsocketアップグレードミドルウェアを追加しました - HTTP/2 (WebSocket は HTTP/1.1 が必要です) を無効にするメディア websocket-transport を追加しました。 - これは、Trefikの侵入による適切なWeb...
WebSocket live message delivery - disable ChatMessageHandler subscription, enhance logging
- Disabled ChatMessageHandler subscription to chat.session.> that was consuming messages without forwarding to WebSocket - Enhanced WebSocketConfig logging to t...
Use session GUID directly as NATS consumer name - Session GUID is already unique, no need for prefix - Simplifies code and consumer naming
WebSocket persistent connection with aggressive keepalive
Idle timeout set to 0, heartbeat 20s, disconnect delay 30s, match frontend timing
Add TomcatConnectorCustomizer to force SSL keystore config
- Spring Boot's application.yml SSL config not being applied - Use TomcatConnectorCustomizer to programmatically set keystore - Forces connector to use /etc/ssl...
Hardcode SSL settings in ConfigMap for production
- Removed environment variable placeholders - Hardcoded port 8443, SSL enabled, keystore path - Fixes Spring Boot not resolving env vars correctly
Correct Spring Boot SSL environment variable names
- Changed SSL_ENABLED to SERVER_SSL_ENABLED - Changed SSL_KEY_STORE to SERVER_SSL_KEY_STORE - Changed SSL_KEY_STORE_PASSWORD to SERVER_SSL_KEY_STORE_PASSWORD - ...
Simplify to HTTPS:8443 only, remove dual port config
- MediaService runs ONLY on port 8443 (HTTPS) - No more Traefik routing for MediaService - Removed DualPortConfig complexity - All traffic (API + WebSocket) goe...
Use SSLHostConfig API for Tomcat SSL configuration
- Use SSLHostConfig and SSLHostConfigCertificate (correct Tomcat API) - Configure certificate via **************** - Fixes compilation errors with setAttribute/...
Use setAttribute for Tomcat SSL configuration
- Changed from setKeystoreFile/Pass/Type/Alias to setAttribute - Tomcat 10+ uses setAttribute for SSL properties - Fixes compilation errors
Run MediaService on BOTH ports 80 (HTTP API) and 8443 (HTTPS WebSocket)
- Reverted service.yaml and ingressroute.yaml to use port 80 - Removed forced SERVER_PORT and SSL_ENABLED env vars - Added DualPortConfig to programmatically ad...
Use NodePort 30843 instead of hostPort for WebSocket
- hostPort may be blocked by firewall rules - NodePort 30843 is in valid range (30000-32767) - Browser connects to external port 8443 - Router forwards 8443 -> ...
Add SSL configuration to k8s ConfigMap
- ConfigMap was missing SSL config from application.yml - Added server.ssl settings with environment variable support - Matches local application.yml configurat...
Use hostPort instead of NodePort for 8443
- NodePort range is 30000-32767, cannot use 8443 - Use hostPort to bind directly to host port 8443 - Removed service-websocket.yaml
Expose MediaService on port 8443 for WebSocket over HTTPS/HTTP1.1
- Added NodePort service on 8443 for direct WebSocket access (bypasses Traefik) - Mount wildcard-kamocrm-com SSL certificate - Init container converts PEM to PK...
Restore HTTP/2 for WebSockets (RFC 8441 support)
- WebSockets CAN work over HTTP/2 via RFC 8441 - Removed TLSOption (not needed) - Removed ServersTransport reference (let HTTP/2 work) - Restored simple domain-...
Use explicit Host() for /ws route to enable TLSOption
- Changed /ws route from HostRegexp to Host(media.kamocrm.com) - TLSOption can only be applied to explicit hosts (not regex) - ALPN negotiation happens during T...
Force HTTP/1.1 for MediaService ONLY via TLSOption
- Created media-tls-http1 TLSOption with alpnProtocols: [http/1.1] - Referenced ONLY in media-route IngressRoute - Does not affect other Traefik routes - Fixes ...
Separate /ws route for WebSocket, keep HTTP/2 for API
- Added two routes: /ws for WebSocket (higher priority), rest for API - Only /ws uses media-websocket-transport (HTTP/2 disabled) - API routes can use HTTP/2 fo...
Use Host() instead of HostRegexp() for media-route
- Simplified to Host(media.kamocrm.com) - Avoids regex escaping issues with backticks - Tests show route is working with simple Host match
Force HTTP/1.1 via TLSOption for WebSocket compatibility
- Created TLSOption to disable HTTP/2 ALPN negotiation - Forces browsers to use HTTP/1.1 for media.kamocrm.com - WebSocket upgrades require HTTP/1.1 protocol - ...
Add CORS middleware to media-route for cross-origin WebSocket
- Added cors middleware to allow cross-origin connections - Enables WebSocket connections from internal.* to media.* - Allows all origins, methods, and headers ...
Remove @kubernetescrd suffix from serversTransport reference
- Traefik error: cross-namespace format not allowed when crossnamespace disabled - IngressRoute and ServersTransport are in same namespace (kamo) - Use simple n...
Add WebSocket signaling for peer-to-peer calls
- Added WebRTCSignalingController for call signaling - Handles offer/answer exchange via STOMP - Forwards ICE candidates between peers - Manages call hangup not...
Add Janus WebRTC integration
- Added WebRTCController for token generation and call management - Configured Janus API URL and secrets (api, token, admin) - Configured STUN/TURN servers (kam...
Use full Kubernetes CRD provider name for ServersTransport reference
Traefik requires the @kubernetescrd suffix when referencing CRD resources like ServersTransport.
Simplify MediaService WebSocket IngressRoute configuration
Remove media-websocket-upgrade middleware that was forcing headers and causing WebSocket handshake issues. Traefik automatically handles WebSocket upgrade when ...
Add end anchor to WebSocket path regex pattern
- Add $ to end of PathRegexp to ensure exact match - Fixes regex parsing error in Traefik - /ws/info is now working (200 OK) but WebSocket upgrade route needs p...
Only apply WebSocket upgrade middleware to actual WebSocket paths
- Change route match from PathPrefix(/ws/) to **************** - /ws/info is a regular HTTP request, not a WebSocket upgrade - Adding Upgrade header to /ws/info...
Add separate route for WebSocket paths with upgrade middleware
- Create separate route matching /ws/** paths with media-websocket-upgrade middleware - This ensures Upgrade: websocket header is added for WebSocket upgrade re...
Use ServersTransport to disable HTTP/2 for WebSocket connections
- Create ServersTransport resource with disableHTTP2: true - Reference ServersTransport in IngressRoute service configuration - Remove invalid disableHTTP2 fiel...
MediaServiceバックエンド接続用のHTTP/2を無効にする
- バックエンド接続のためにHTTP/1.1を強制するHTTP2:trueを追加 - HTTP/2 拡張 CONNECT は、アップグレードヘッダーを正しく変換しない - WebSocket のアップグレードには、HTTP/1.1 が必要です。 - これは、WebSocketハンドシェイクの「アップグレードヘッダー:n...
WebSocketサポート用のIngressRouteサービススキームの設定
- 設定スキーム: http は、WebSocket のアップグレードの適切な HTTP/1.1 処理を確実にするために - HTTP/2 拡張 CONNECT は HTTP/1.1 のアップグレードヘッダーに適切な変換が必要 - これは、WebSocketハンドシェイクの「アップグレードヘッダー:null」エラーを修...
無効なハンドハンドハンドラを削除し、SockJSの設定を修正
- 無効な DefaultHandshakeHandler オーバーライドを削除します (メソッドは存在しません) - 無効な setSupressCors コールを削除します(メソッドは存在しません) - HttpSessionHandshakeの試行をログするためのインターセプターをキープ - これは、WebSoc...
Add WebSocket handshake logging and SockJS configuration
- Add handshake handler and interceptor logging to diagnose WebSocket connection issues - Configure SockJS to suppress CORS (handled by Spring Security) and dis...
Remove media-cors middleware from IngressRoute to allow WebSocket connections
- media-cors middleware was clearing CORS headers which interfered with WebSocket upgrades - WebSocket connections require direct pass-through without header mo...
Remove invalid Spring Security pattern /ws/**/info
- PatternParseException: No more pattern data allowed after {*...} or ** - /ws/** already covers all paths under /ws including /ws/info - This was causing 500 e...