Replace "analytics" text nodes with "Kamo Analytics" instead of clearing
Use TreeWalker to remove all "analytics" text nodes from rendered DOM
The workspace nav title "analytics" comes from JS bundles loaded after auth, rendered as a text node next to the logo SVG. Uses TreeWalker to find and clear all...
Add guarded MutationObserver for client-side rendered logo/text
Login page and dashboard content is rendered by Next.js JS bundles, not in the HTML body, so sub_filter can't reach it. Adds a script with a busy-flag-guarded M...
Redirect favicons at nginx level, fix RSC payload escaping
- Serve favicon via nginx 302 redirect instead of trying to rewrite HTML/RSC payload href strings (cleaner, always works) - Fix RSC title replacement with pro...
Use pure sub_filter replacements instead of MutationObserver
MutationObserver caused infinite loop (DOM change -> observer fires -> DOM change). Switch to direct nginx sub_filter string replacements targeting both static ...
Comprehensive analytics rebranding for login page and dashboard
- Replace title dynamically (handles "Login | analytics", "Dashboard | analytics" etc.) - Replace "analytics" h2 text on login page with Kamo logo image - Repla...
Use MutationObserver to rebrand analytics client-side rendered UI
analytics is a Next.js app that sets title/logo via JavaScript after initial HTML load. Replaces static sub_filter approach with injected script that uses Mutat...
Purge incomplete model directories in init container
The service crashes on startup if it finds a directory in /models that has missing or partial model files. Add a sweep at init start that removes any directory ...
Remove GitHub LFS downloads, use only data.statmt.org models
GitHub raw URLs return LFS pointer files, not actual binaries. Drop enru/enar downloads entirely — LibreTranslate handles those locales. Only download the 4 pai...
Scale bergamot to 0, update image to mozilla/translation-service
The Google Cloud Storage model download bucket (bergamot-models-sandbox) returns 404 for all files and the firefox-translations-models repo was archived Dec 202...
Scale bergamot back to 1 replica — translation failures caused by missing pod
Bergamot was at 0 replicas with its service still registered. The ProviderRouter in TranslateService had no circuit breaker, so every request for es/fr/de/pt/it...
Remove --load-only restriction from LibreTranslate
All needed language packages are pre-installed on the hostPath volume. --load-only was preventing some packages from loading. Without the flag, LibreTranslate l...
Use startupProbe for LibreTranslate to handle long model downloads
startupProbe with 60 attempts x 30s = 30min startup window for initial model downloads. After startup completes, normal liveness and readiness probes take over ...
Restrict LibreTranslate to only load supported language models
Use --load-only with the 22 supported language codes instead of downloading all available models (~hundreds of GB). Removes --update-models flag which would dow...
Remove invalid --load-awesome-ai-models flag from LibreTranslate
Flag does not exist in current libretranslate image. Replace with --update-models to ensure language packs are downloaded on startup.
Add LibreTranslate permission init container, scale Bergamot to 0
LibreTranslate was crashing with PermissionError on packages subdir. Added busybox init container to mkdir + chmod 777 the mounted hostPath before the main cont...
JVB_ADVERTISE_IPS must be public IP, not Wireguard IP
Was 10.8.1.1 (Wireguard private) — guests' browsers can't reach this. Changed to 75.83.113.11 (public IP). This is why guests kept getting ICE restarts every ~1...
Disable mod_token_verification via custom plugin override to stop guest kicks
The MUC token_verification module re-validates tokens and demotes guests from PARTICIPANT to VISITOR after ~60 seconds, causing Jicofo to kick them. The module ...
Add guest domain to token_verification_allowlist, increase smacks timeout
Guests authenticate via Meet-anonymous on guest.meet.Meet but the MUC token_verification module was re-checking them and demoting their role from PARTICIPANT to...
Disable Jicofo auth module to prevent 1-minute participant kick
Jicofo's AbstractAuthAuthority has a hardcoded 1-minute auth session lifetime that ignores the config file setting. After 60 seconds, Prosody demotes participan...
Use room names (not full JIDs) for all brewery MUC configs
Both Jicofo and JVB Docker images append @XMPP_INTERNAL_MUC_DOMAIN to the brewery room name automatically. Using full JIDs like **************** caused double-d...
Use TCP probe on port 9090 for JVB health checks instead of HTTP on 8080
JVB's REST API port 8080 conflicts with CockroachDB's admin UI on the same hostNetwork. The JVB_OHTTP_SERVER_PORT env var is not recognized by this JVB image ve...
Resolve JVB crash loop — wrong MUC JID + port 8080 conflict
Two issues causing JVB to crash in a loop for 43+ hours: 1. JVB_BREWERY_MUC was **************** (full JID) but JVB appends XMPP_INTERNAL_MUC_DOMAIN automat...
JVB_BREWERY_MUC should be room name only, not full JID
Was **************** which caused JVB to construct a double-domain JID **************** with an @ in the domain part — crashing JVB with XmppStringprepException...
Add dnsPolicy ClusterFirstWithHostNet to JVB StatefulSets so hostNetwork pods can resolve cluster DNS
Reference *** instead of non-existent turn-secret in Prosody deployment
Enable auto-truncate on embedding model to prevent 413 errors
Add --auto-truncate flag so inputs exceeding the 256 token limit are silently truncated instead of rejected with a validation error.
Load embedding model from local hostPath to prevent HuggingFace download failures
The embedding-model pod was in CrashLoopBackOff because it couldn't download the model from HuggingFace on startup (network/DNS issue). Mount the model from a h...
Auto-cert service not renewing expired SSL certificates
The auto-cert service was importing expired certs from shared storage and skipping Certificate CR creation, so cert-manager couldn't manage renewals. Also fixed...
Fix kubectl not found in pod, add docs alias, proactive SUBDOMAINS
- Mount /usr/local/bin/kubectl from host via hostPath instead of failing apt-get install (kubectl not in default Debian repos) - Add "docs" to SUBDOMAINS list...
Remove forced WebSocket headers from media middleware
Traefik v3 handles WebSocket Upgrade/Connection headers natively. Remove forced headers that broke non-WebSocket API requests.
Add system account to all NATS configs
Add $SYS account with admin credentials to k0m1, k1m1, and k2m1 NATS configs. Enables nats CLI cluster management operations (peer removal, step-down, etc.) for...
Resilient probes so cluster stays up when one node is offline
- Liveness: tcpSocket on 4222 (do not depend on JetStream meta leader) - Readiness: initialDelay 90s, period 15s, failureThreshold 10 so k0m1+k1m1 can form qu...
Skip CockroachDB init job if any pods exist - cluster already initialized
Improve CockroachDB init check to wait for pods and verify cluster state
Prevent CockroachDB init job from running when cluster is already initialized
Update CockroachDB probes, HTTP redirect, and MinIO service endpoints
Add CORS middleware to theme routes to allow cross-origin access from all websites
Add hostPort to Traefik deployment for direct port access
- Use hostPort 443 for websecure entrypoint to bypass NodePort - Allows router to forward port 443 directly to Traefik - Also set hostPort for web (30080) and a...
Set External Traffic Policy to Local for Traefik NodePort service
- Allows proper routing of external traffic from router - Preserves source IP addresses for better logging
Update CockroachDB StatefulSet to use dynamic VPN IP based on node hostname
- Fix advertise-addr to use VPN IP (10.8.1.1 for k1m1, 10.8.2.1 for k2m1) - Update join parameter to use VPN IPs instead of hostnames - Update node certificate ...
Add node certificates to CockroachDB secret creation
- Add node.crt and node.key to cockroachdb directory - Update CI/CD workflow to include node certificates when creating *** secret - Fixes CockroachDB CrashLoop...
Handle BackoffLimitExceeded by deleting failed job and retrying
- When job fails with BackoffLimitExceeded and pods are cleaned up, delete and recreate job - This allows us to get fresh logs from a new pod - Catches 'already...
Handle BackoffLimitExceeded by deleting and retrying init job
- When job fails with BackoffLimitExceeded and pods are cleaned up, delete and recreate job - This allows the job to retry and succeed if cluster is already ini...
Improve CockroachDB init job error handling when pods are cleaned up
- Check previous pod logs if current pods are not found - Test cluster connectivity to verify if already initialized - Better handling of failed jobs with clean...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.