God-mode member impersonation endpoint
POST /api/security/impersonate mints a fresh ***+OTK for an arbitrary member of the caller's current org, gated on the caller session carrying god mode (GD). Re...
Return orgName + language in /user-info
Resolve the org's display name and the member's selected language (ISO-639-1 code) from the DB so kamo-universe can show each player's org + language flag on th...
Fungua uzinduzi wa KamoUniverse katika tab mpya (kifungu chasync.open + async OTK)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Simplify kubectl install in deploy job (complex cache-find step was failing the deploy)
Lango la KamoUniverse launcher juu ya ACCESS KAMOWORLD peke yake (tone org michezo bendera)
Migrate kwa k1m1 (dictionary kutoka k1m1, kuacha k2m1 kupeleka, pin k1m1 usajili picha)
KamoUniverse launch card + nav icon (gated ACCESS_KAMOWORLD, OTK redirect to play.*)
Kuongeza ACCESS KAMOWORLD kulia (145, GAMES) kwa upatikanaji wa KamoUniverse
Resurrect on k1m1 — shared-lib from k1m1:3000, drop dead k2m1 deploy, pin k1m1 registry image
Backup verified working — DB-scoped backup, MinIO region us-west-ca-s-1, EXTERNALIOIMPLICITACCESS grant in bootstrap
Drop WITH revision_history from backup (enterprise-only); core BACKUP is OSS
node-config: document k1m1 forgejo-runner config (--add-host for submodule DNS)
Job containers on k1m1 fall back to public DNS, so the fleet-swept http://k1m1:3000 .gitmodules URLs fail to clone there. Pin k1m1 into job containers via conta...
node-config: document k1m1 docker daemon insecure-registries
The k1m1 forgejo-runner's builds push to the HTTP Forgejo registry; the daemon.json shipped with only the :5000 entries, so every build job landing on k1m1 fail...
K1m1 image registry replacing retired k0m1:5000 (same credentials)
Loki 6.x SingleBinary needs zeroed scalable targets; crdb exec via localhost (cert SANs)
Kamo-universe namespace+quota+valkey, CockroachDB backups, observability stack
- universe/: namespace + ResourceQuota, valkey-universe (AOF, hostPath k1m1), nightly CockroachDB backup CronJob, operator bootstrap script - monitoring/: pin...
Join shared two-node cluster with k3m1 over LAN; account isolation
Retire WireGuard routes (10.8.x.x) for LAN routes (192.168.4.22 <-> 192.168.4.36 :6222) with creds embedded in the route URLs. Rename cluster to kamo-ratestack-...
Add k3m1 node + migrate cluster peering to LAN IPs
- statefulset: advertise/join over 192.168.4.x (k1m1=.22, k3m1=.36); WireGuard dropped (k3m1 wg0 10.8.0.1 collided with k0m1's advertise IP). - init-job + CI ...
Route paid signups to checkout after login
After successful auth (manual or auto-login), consume the apex-domain sp_checkout_plan cookie left by kamo-register and redirect the buyer to the brand /subscri...
Carry paid ?plan from signup into checkout
When a member signup originates from a paid pricing CTA (?plan=pro|business), drop an apex-domain sp_checkout_plan cookie on completion. kamo-login consumes it ...
Wire internal-auth secret from ***
ESigService now validates X-Internal-Auth against the same shared secret APIService presents **************** from the *** k8s secret), hardening the programmat...
Rebuild for kamo-shared-library update (esign signer email templates)
Picks up the new canonical templates esign.signer_verification + esign.signer_invite so seedForOrg can seed them on first send.
Canonical e-sign signer templates (verification + invite)
Add two platform-wide canonical email templates seeded lazily per org: - esign.signer_verification (step-up OTP: {{code}}, {{name}}) - esign.signer_invite (sign...
Register esign repositories for the meter submission bean
EsignMeterSubmissionService needs EsignUsageRecordRepository, but @EnableJpaRepositories didn't scan com.kamo.z.shared.esign.repos, so the context failed to sta...
E-sign usage metering + consumer self-serve checkout
#4 metering: - EsignMeterSubmissionService (@Scheduled daily): aggregates API-origin EsignUsageRecords per org+period; first 40/period included, the rest subm...
Expose API_SIGNATURE (E-Signature API) key scope
Add the E-Signature API scope to the org API-key manager so staff can grant Business orgs programmatic e-sign access. Usage beyond the included monthly allotmen...
Public programmatic e-sign API gateway (API_SIGNATURE scope)
Add /api/public/esign/** to PublicApiController: validates the org API key, requires the API_SIGNATURE scope, rate-limits, and forwards to ESigService's interna...
Internal programmatic envelope API (origin=API) for Business
- EsignInternalController (/api/esig/internal/*): X-Internal-Auth + X-Org-Id authed, called by APIService after it validates the API_SIGNATURE-scoped key; r...
API_SIGNATURE api-key scope + EsignGenericEnvelope.origin
Additive, no version bump: - ApiKeyScope.API_SIGNATURE — gates the programmatic e-signature API (Business) - EsignGenericEnvelope.origin (EsignUsageOrigin, null...
Je, unaona nini kuhusu usafiri?
Kila moja ya hizi updates ardhi katika nafasi yako ya kazi moja kwa moja. Kuanza bure na kuangalia kukua wiki baada ya wiki.