Unique_rowid() shim and non-public schemas in YugabyteDB
The shim is a sequence seeded at the production maximum plus a margin. The seed carries two requirements, not one: it must exceed every existing id or the first...
Unique_rowid() shim and non-public schemas in YugabyteDB
The shim is a sequence seeded at the production maximum plus a margin. The seed carries two requirements, not one: it must exceed every existing id or the first...
Deploy single-node YugabyteDB 2026.1.0.1 alongside CockroachDB
Both engines now run side by side on k1m1; CockroachDB is untouched and remains the rollback path. Three things that were not obvious: - The Helm chart versio...
Deploy single-node YugabyteDB 2026.1.0.1 alongside CockroachDB
Both engines now run side by side on k1m1; CockroachDB is untouched and remains the rollback path. Three things that were not obvious: - The Helm chart versio...
Egress containment for the avatar resolver, as a CiliumNetworkPolicy
Inaelezea nini 8f6c672 ilirudi, kwa fomu pekee ambayo inafanya kazi hapa. Jaribio la awali lilishindwa kwa sababu mtandao wa wazi hauwezi kuelezea hili. Topolo...
Contain egress from the avatar resolver; note the Redis eviction pool
Huduma ya Usalama sasa inaendesha mporaji ambaye URL ya lengo inachaguliwa na wasio waaminifu Chama - rekodi ya BIMI ni maudhui ya DNS yaliyochapishwa na mtu ye...
Kuongeza "Master Machine" (kamo-dev-1) RDP kifaa kwa Guacamole
Local Kubuntu workstation shares its live Plasma/Wayland session over RDP via KRdp. Adds an idempotent bootstrap SQL connection (192.168.4.46:3389, sage/shared ...
Self-hosted expo-updates headers for Mobile Copilot OTA
expo-protocol-version:1 + expo-sfv-version:0 response headers that the expo-updates client requires and static MinIO cannot emit. Longer path prefix wins over t...
Expose AIService /ws /ai-chat kupitia api. * majeshi kwa wateja wa simu
IngressRoute (priority 100, websecure, ws-upgrade middleware sans compress) routes wss://api.<domain>/ws/ai-chat to kamowsai-service:80 — same pattern as the me...
Make whisper-asr independently scalable (HPA, multi-node)
Remove the single-node pin and switch to a per-pod model cache so pods can schedule on any node, and add an HPA (min 1 / max 4, CPU 75%, deliberate scale-up giv...
Rebrand Guacamole client connection status text to KamoDesktop
Juu ya [TD="width: 456"] [FONT=&](2)[/FONT][FONT=&]Bila kuathiri masharti ya kifungu kidogo (1) 'Kuwasiliana na Guacamole...' skrini (na hali inayohusiana) inas...
Moduli ya moderator ya Prosody, Whisper-asr, jibri kurekodi upload
- Meet-prosody: version-control the custom-plugins ConfigMap (captures the existing token_verification no-op override that was created out-of-band) and add ...
Guacamole Json-auth SSO + KamoDesktop rebrand
- JSON_SECRET_KEY (optional) on guacamole from the shared desktop-sso secret enables the bundled guacamole-auth-json extension the god-SSO links validate agai...
Harded KubeVirt eneo la mbali + lango la Guacamole
Adds a full remote-desktop stack, GitOps-applied via the deploy workflow: - KubeVirt + CDI installed at deploy time (pinned-stable release URLs) - desktop-1: K...
Utoaji SOCIAL MESSAGES JetStream mkondo (social.inbound.>, social.lead.) R1 kwa bomba la ndani la vyombo vya habari vya kijamii
Bootstrap ulimwengu-minio siri + ugc ndoo note (§14)
Kuongeza hatua 6 kwa bootstrap-universe.sh: inajenga ulimwengu-minio siri (ACCESS KEY/SECRET KEY kutoka kwa mizizi ya ulimwengu-backup-s3) Kuna haja ya kuwa na ...
K1m1 image registry replacing retired k0m1:5000 (same credentials)
Kamo-universe namespace+quota+valkey, CockroachDB backups, observability stack
- universe/: namespace + ResourceQuota, valkey-universe (AOF, hostPath k1m1), nightly CockroachDB backup CronJob, operator bootstrap script - monitoring/: pin...
Add k3m1 node + migrate cluster peering to LAN IPs
- statefulset: advertise/join over 192.168.4.x (k1m1=.22, k3m1=.36); WireGuard dropped (k3m1 wg0 10.8.0.1 collided with k0m1's advertise IP). - init-job + CI ...
Pre-seed sign.pink + www.sign.pink in STATIC_DOMAINS
sign.pink is a new apex domain (consumer e-signature brand / white-label Kamo tenant org). Pre-seed apex + www so a Let's Encrypt cert exists before first HTTPS...
Document myloan alias for KamoLOS
Adds `myloan` to the SUBDOMAINS recognition list and rewrites the comment to make the list's purpose explicit (it's documentary; the dynamic Traefik log scan is...
Manage mail.kamocrm.com TLS end-to-end
Auto-cert now provisions and maintains the Let's Encrypt cert for mail.kamocrm.com (HTTP-01 via Traefik on port 80) and keeps the postfix consumer in sync acros...
Reverse-proxy priceturbo.com apex + wildcard via k1m1 with TLS
k1m1 Traefik now terminates HTTPS for priceturbo.com and any *.priceturbo.com subdomain, forwarding plain HTTP to the upstream Traefik at 192.168.4.36:80 with t...
Reverse-proxy rate.loans/stack.loans hosts via k1m1 with TLS
k1m1 Traefik now terminates HTTPS for api.rate.loans, www.rate.loans, and www.stack.loans, forwarding plain HTTP to the upstream Traefik at 192.168.4.36:80. Aut...
Add pricing@kamocrm.com mailbox and external IMAP NodePort
- New Service mail/dovecot-imap-external (NodePort 30143 -> 143) so IMAP can be reached from outside the cluster on $NODE:30143. - Seed pricing@kamocrm.com in...
Seed pbx.k1.kluster.kamocrm.com as a static domain
The browser softphone needs SIP-over-WSS to land on a hostname with a real TLS cert. Add the FreePBX admin / WS hostname to STATIC_DOMAINS so the auto-cert seed...
Add WSS WebRTC transport for browser softphones
Asterisk's chan_pjsip now binds a plain WebSocket transport on 0.0.0.0:8089 and Traefik terminates TLS at **************** (port 443) so kamo-internal can regis...
Production fail2ban with PJSIP jails and persistent state
- Add fail2ban-configmap.yaml with [asterisk] and [freepbx-web] jails, incremental ban escalation (1h→24h→30d ceiling), LAN ignoreip, and a custom asterisk-...
Integrate Coqui TTS with norman voice (VCTK p267)
- Deploy coqui-tts server (VCTK VITS model, CPU-only) as ClusterIP service on port 5002 with model cache at /var/lib/coqui-tts on k1m1 - Inject coqui_tts.agi ...
Add LAN DNS pod for split-DNS on k1m1
Deploys a dnsmasq pod with hostNetwork on k1m1 that listens on 192.168.4.22:53. Overrides pbx.k1.kluster.kamocrm.com -> 192.168.4.22 so LAN phones reach the PBX...
Deploy FreePBX 17 + Jigasi SIP bridge on k1m1 and k2m1
FreePBX (tiredofit/freepbx:17-latest) runs with hostNetwork so SIP/RTP preserves real client IPs, pinned one-per-node via nodeSelector. SIP on 5060 UDP/TCP (506...
Use ECDSA P-256 for cert-manager Certificate specs and migrate RSA
Add weekly image prune and journal vacuum CronJob for k1m1
CronJob runs every Sunday 3am, privileged, pinned to k1m1. - crictl rmi --prune removes unused container images - nsenter journal vacuum enforces 500MB cap - CI...
Add geo-database-url to analytics-secret for CockroachDB geolite lookup
Kamo Analytics uses this URL to look up visitor IP→country/region/city from the **************** tables. Uses kamo user with password auth and sslmode=require (...
Add iframe-compatible middleware chain for kamo-analytics
Add security-headers-allow-iframe (no X-Frame-Options) and kamo-middlewares-allow-iframe chain so analytics can be embedded in iframes from internal.kamocrm.com...
Move kamo-analytics to own repo, keep only postgres in KlusterServices
- Remove analytics deployment, service, and nginx-configmap (now owned by kamo-analytics project with its own CI/CD pipeline) - Remove analytics-ingressroute ...
Rebrand analytics analytics UI with Kamo logo, title, and favicon
Adds nginx sidecar proxy that injects CSS to replace the analytics logo with KamoCRM logo, changes the page title to "Kamo Analytics", and overrides the favicon...
Add analytics analytics deployment and analytics.kamocrm.com routing
- New analytics/ directory: PostgreSQL StatefulSet + analytics deployment, services, and secret template - **************** routes analytics.kamocrm.com → analy...
Restore bergamot with working model sources and correct image
- replicas: 1 - Init container (alpine): downloads 4 pairs from data.statmt.org (tarballs for enes/enfr/ende/enpl) and 2 from firefox-translations-models GitH...
Configure Prosody, Jicofo, and secrets for Jibri recording support
Enable recording in Prosody, add Jibri XMPP passwords to secrets, and configure Jicofo brewery MUC for Jibri instance discovery.
Add Jibri deployment manifests for Meet meeting recording
Kubernetes deployment, service, and configmap for Jibri (Meet Broadcasting Infrastructure) to enable meeting recording with MinIO storage integration.
Add Meet service deployment steps to CI/CD pipeline for k1m1 and k2m1
Add distributed JVB pool with per-node StatefulSets on k1m1 and k2m1
Add Jicofo conference focus with JVB brewery and lobby enforcement
Je, unaona nini kuhusu usafiri?
Kila moja ya hizi updates ardhi katika nafasi yako ya kazi moja kwa moja. Kuanza bure na kuangalia kukua wiki baada ya wiki.