Reduce log noise and tune connection pool
- Lower Spring Security from TRACE to WARN and HikariCP from DEBUG to WARN — eliminates dozens of synchronous log writes per request - Add explicit HikariCP p...
Remove per-message logging from chat message endpoint
Remove System.out.println calls inside the message stream map that were firing once per message (100 I/O operations per request), and the final log that streame...
Accept *** from query param for cross-subdomain WebSocket auth
Read *** ID from ?***= query parameter first, falling back to cookie. This allows the frontend on internal.kamocrm.com to authenticate WebSocket connections to ...
Handle stale NATS consumer binding with unique consumer retry
- Extract message handler into createNatsMessageHandler() method - Add retry logic with unique consumer name when "Consumer already bound" error occurs after ...
Add WebSocket authentication via *** cookie handshake interceptor
Add WebSocketAuthInterceptor that reads *** cookie on handshake, resolves session via KSessionService, and stores memberId/orgId in WebSocket session attributes...
Publish incoming message notifications to target member WebSocket topic
Route WebSocket through Traefik on port 443
- service.yaml: fix port 80→8443 to match pod's actual listen port - ingressroute.yaml: use scheme https + port 8443 for backend - serverstransport.yaml: add in...
Use cluster-internal DNS for NATS connection
Change default NATS URL from WireGuard IPs (100.64.x.x) to nats.kamo.svc.cluster.local for the local server. Remote nodes (k0m1, k2m1) remain on WireGuard IPs.
Trigger pipeline to apply updated deployment with optional TLS cert
Make TLS certificate optional in MediaService deployment
- Add optional: true to wildcard-kamocrm-com secret volume - Update cert-converter init container to handle missing certificate gracefully
Fix kubeconfig update to use WireGuard VPN IPs (10.8.x.x) instead of old Tailscale IPs
Refactor to parallel deployment for k1m1 and k2m1
- Split build and deployment into separate jobs - Deploy to k1m1 and k2m1 in parallel after build completes - Reduces total deployment time significantly
Revert to docker driver for faster builds - removes docker-container overhead
Switch to docker-container driver with cache for optimal build performance
Add Buildx setup with insecure registry config to resolve 401 auth errors
Fix NATS subscription error handling - gracefully handle 'Consumer already bound' errors, improve cleanup logging
Add simultaneous call detection and auto-connection - Track pending calls per session to detect simultaneous attempts - Auto-resolve when both users call at same time - Use first caller's callId and auto-accept the second - Clean up pending calls on answer/end - Remove duplicate otherMember lookup code
Use getUsernameAlias() instead of non-existent getName() method on Member
Add JanusService for WebRTC gateway integration - Add JanusService Java service for interacting with Janus WebRTC Gateway API - Configure Janus API URL, secrets, and STUN/TURN servers in application.yml - Support session creation, plugin attachment, and room management
Add WebSocketLoggingFilter to log ALL /ws/** requests to diagnose connection failures
Properly configure Spring Security for WebSocket - disable CSRF completely, enable session creation IF_REQUIRED for WebSocket handshake
Disable CSRF for /ws/** endpoints and simplify security config to fix SockJS /ws/info 405 error
Explicitly allow GET/POST/HEAD methods for /ws/** endpoints to fix SockJS /ws/info 405 error
Remove invalid method calls causing compilation errors (getId on MediaSession, getStatusCode on ServerHttpResponse)
Add EXTENSIVE logging to WebSocketConfig and ChatWebSocketController - every STOMP frame, handshake, subscription, and message logged
Add WebSocket middleware and ServersTransport to IngressRoute
- Added media-websocket-upgrade middleware for WebSocket upgrade headers - Added media-websocket-transport to disable HTTP/2 (WebSocket requires HTTP/1.1) - Thi...
WebSocket live message delivery - disable ChatMessageHandler subscription, enhance logging
- Disabled ChatMessageHandler subscription to chat.session.> that was consuming messages without forwarding to WebSocket - Enhanced WebSocketConfig logging to t...
Use session GUID directly as NATS consumer name - Session GUID is already unique, no need for prefix - Simplifies code and consumer naming
WebSocket persistent connection with aggressive keepalive
Idle timeout set to 0, heartbeat 20s, disconnect delay 30s, match frontend timing
Add TomcatConnectorCustomizer to force SSL keystore config
- Spring Boot's application.yml SSL config not being applied - Use TomcatConnectorCustomizer to programmatically set keystore - Forces connector to use /etc/ssl...
Hardcode SSL settings in ConfigMap for production
- Removed environment variable placeholders - Hardcoded port 8443, SSL enabled, keystore path - Fixes Spring Boot not resolving env vars correctly
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.