반전 프록시 rate.loans/stack.loans는 TLS와 k1m1을 통해 호스트
k1m1 Traefik은 이제 api.rate.loans, www.rate.loans에 대한 HTTPS를 종결하고 www.stack.loans, 상류 Traefik에 일반 HTTP 전달 192.168.4.36:80. Auto-cert 씨앗 per-host는 세 가지를 위해 certs를 ...
Price@kamocrm.com 메일박스 및 외부 IMAP NodePort 추가
- 신규 서비스 메일/dovecot-imap-external (NodePort 30143 -> 143) IMAP는 클러스터 외부에서 $NODE:30143에 도달 할 수 있습니다. - Seed Pricing@kamocrm.com mysql-init에서 신선한 DB 부트 스트랩 mailbo...
Seed pbx.k1.kluster.kamocrm.com 정적 도메인으로
브라우저 소프트 폰은 SIP-over-WSS가 실제 호스트 이름에 착륙해야합니다. TLS 인증 FreePBX 관리자 / WS hostname을 STATIC DOMAINS에 추가하십시오. auto-cert seeder 규정 a per-host Let's Encrypt cert for it...
브라우저 softphones에 대한 WSS WebRTC 운송 추가
Asterisk의 chan pjsip는 이제 일반 WebSocket 운송을 0.0.0.0:8089에 묶습니다. 그리고 Traefik는 ***에 TLS를 종결****** (포트 443) so kamo-internal can register browser softphones over 기존 ...
생산 실패 PJSIP 감옥과 지속 상태
- [asterisk] 및 [freepbx-web] 감옥과 함께 실패2ban-configmap.yaml를 추가하십시오. 증가 금지 에스컬레이션 (1h→24h→30d 천장), LAN 무시, 및 사용자 정의 asterisk-security.conf 필터 대상 PJSIP SecurityEve...
Integrate Coqui TTS with norman voice (VCTK p267)
- Deploy coqui-tts server (VCTK VITS model, CPU-only) as ClusterIP service on port 5002 with model cache at /var/lib/coqui-tts on k1m1 - Inject coqui_tts.agi ...
Add LAN DNS pod for split-DNS on k1m1
Deploys a dnsmasq pod with hostNetwork on k1m1 that listens on 192.168.4.22:53. Overrides pbx.k1.kluster.kamocrm.com -> 192.168.4.22 so LAN phones reach the PBX...
FreePBX 17 + K1m1 및 k2m1의 Jigasi SIP 브리지 배포
FreePBX (tiredofit/freepbx:17-latest)는 hostNetwork로 실행되므로 SIP/RTP nodeSelector를 통해 실제 클라이언트 IP를 보호하고, 1per-node를 피했습니다. SIP 정보 5060 UDP/TCP (5061 TLS), Janus를 피...
Add weekly image prune and journal vacuum CronJob for k1m1
CronJob runs every Sunday 3am, privileged, pinned to k1m1. - crictl rmi --prune removes unused container images - nsenter journal vacuum enforces 500MB cap - CI...
Add geo-database-url to analytics-secret for CockroachDB geolite lookup
Kamo Analytics uses this URL to look up visitor IP→country/region/city from the **************** tables. Uses kamo user with password auth and sslmode=require (...
Add iframe-compatible middleware chain for kamo-analytics
Add security-headers-allow-iframe (no X-Frame-Options) and kamo-middlewares-allow-iframe chain so analytics can be embedded in iframes from internal.kamocrm.com...
Move kamo-analytics to own repo, keep only postgres in KlusterServices
- Remove analytics deployment, service, and nginx-configmap (now owned by kamo-analytics project with its own CI/CD pipeline) - Remove analytics-ingressroute ...
Rebrand analytics analytics UI with Kamo logo, title, and favicon
Adds nginx sidecar proxy that injects CSS to replace the analytics logo with KamoCRM logo, changes the page title to "Kamo Analytics", and overrides the favicon...
Add analytics analytics deployment and analytics.kamocrm.com routing
- New analytics/ directory: PostgreSQL StatefulSet + analytics deployment, services, and secret template - **************** routes analytics.kamocrm.com → analy...
Restore bergamot with working model sources and correct image
- replicas: 1 - Init container (alpine): downloads 4 pairs from data.statmt.org (tarballs for enes/enfr/ende/enpl) and 2 from firefox-translations-models GitH...
Configure Prosody, Jicofo, and secrets for Jibri recording support
Enable recording in Prosody, add Jibri XMPP passwords to secrets, and configure Jicofo brewery MUC for Jibri instance discovery.
Add Jibri deployment manifests for Meet meeting recording
Kubernetes deployment, service, and configmap for Jibri (Meet Broadcasting Infrastructure) to enable meeting recording with MinIO storage integration.
Add Meet service deployment steps to CI/CD pipeline for k1m1 and k2m1
Add distributed JVB pool with per-node StatefulSets on k1m1 and k2m1
Add Jicofo conference focus with JVB brewery and lobby enforcement
Add Prosody XMPP server deployment with JWT auth and lobby support
Add Qdrant vector DB and MiniLM embedding model K8s manifests
- Qdrant v1.12.1 deployment + ClusterIP service (ports 6333/6334) - HuggingFace TEI with all-MiniLM-L6-v2 deployment + service (port 8080) - Updated deploy-serv...
Add wopi-*** for DocsService
Adds WOPI JWT signing secret used by DocsService for Docs access tokens. Deployed to both K1M1 and K2M1 clusters.
Add HTTP to HTTPS redirect middleware and IngressRoute
- Create redirect-to-https middleware for permanent redirects - Add catch-all IngressRoute on web entrypoint to redirect all kamocrm.com domains to HTTPS - Fixe...
Add automatic *** secret creation
- Create *** secret on both k1m1 and k2m1 - Secret contains MINIO_CURRENT_HOST pointing to k0m1 MinIO instance (http://10.8.0.1:9000) - Fixes kamowssecurity-dep...
Update TURN server credentials with secure values
- Updated turn-secret with secure random value - Updated turn-password for Janus authentication - Credentials match MediaService WebRTC configuration
Add ServersTransport deployment to CI/CD workflow
Deploy traefik/serverstransport.yaml as part of Traefik deployment to both K1M1 and K2M1. This enables HTTP/1.1 backend connections for MediaService WebSocket s...
Add ServersTransport for MediaService WebSocket connections
Add media-websocket-transport ServersTransport resource to disable HTTP/2 for backend connections to MediaService. This is required for proper WebSocket upgrade...
Add media-websocket-upgrade middleware to force Upgrade header
- Add Upgrade: websocket header for WebSocket paths to fix HTTP/2 Extended CONNECT conversion - This ensures HTTP/2 WebSocket upgrade requests are properly conv...
Add media-cors middleware for media domain CORS support
- Add media-cors middleware matching theme-cors configuration - Allows CORS headers to be set for media.{domain} requests
Add 'media' subdomain to auto-cert SUBDOMAINS for MediaService
- Add 'media' to SUBDOMAINS list in auto-cert-service.yaml - Enables automatic SSL certificate generation for media.{domain} subdomains - Required for MediaServ...