Mount /etc/asterisk only, not /etc, to fix PHP simplexml error
Mounting the full /etc as a hostPath volume was corrupting PHP extension loading even after seeding from the image — simplexml_load_file undefined at install ti...
Reduce CPU limits to 2:1 ratio to eliminate overcommitment
Docs 4→1 core, jibri 4→2 cores, libretranslate 2→1 core, bergamot 2→1 core, coturn 1→0.5 core. Saves ~7.5 cores off node limits.
Switch to escomputers/freepbx:17 with correct architecture
tiredofit/freepbx has no FreePBX 17 image (abandoned since 2022). escomputers/freepbx:17 (updated Apr 2026, Asterisk 21 + FreePBX 17) requires a separate MariaD...
Parse formData before forwarding to prevent binary corruption
request.text() on multipart/form-data corrupts binary file bytes; pass parsed FormData as init.body so forwardToApi skips request.text() and lets fetch regenera...
Remove minHeight:100vh causing double scrollbars
The outer box's minHeight:100vh exceeded the layout's calc(100vh - 56px) container, which caused both the browser-level scroll and the inner overflow:auto to be...
Drop stale Pay column header from security-models table
When the Employee Self-Pay Kamo Fees field was removed, the matching TableCell in the row body was deleted but the header row still had the '<TeamMember> Pay' c...
Surface real reason behind GoDaddy 400 error
GoDaddy now returns HTTP 400 with code=UNABLE_TO_AUTHENTICATE and body "Bad Request : Bad Request" when an account does not meet their current production Domain...
Censorship sub-tab now renders ATF first per spec
Reorders the Censorship sub-tab cards to match the requested order: 1. Alcohol, tobacco & firearms 2. Allowed Member Age Ranges 3. Allowed Employee (Team ...
Eager-load domains via findByIdWithDomains, drop @Transactional
@Transactional on a controller method keeps a DB connection open across the entire MinIO upload, and also risks LazyInitializationException if the inner getOrga...
Remove duplicate ?type= from apiPath
forwardToApi already appends incomingSearch (?type=...) from the original request URL. Embedding ?type= a second time in the apiPath produced ?type=full?type=fu...
Restore mailbox switcher for int64 member IDs
Use getMemberIdString for mailboxes/member fetch, normalize id/mailboxId from EmailService, and drive the switcher from accessible personal mailboxes when avail...
Cache-bust logo URLs using themeRevision from config.json
DynamicMetaLoader now stores themeRevision in sessionStorage and fires KAMO_THEME_CONFIG_LOADED after fetching config.json. ThemeLogo listens for that event and...
Cache-bust logo URLs using themeRevision from config.json
DynamicMetaLoader now stores themeRevision in sessionStorage and fires KAMO_THEME_CONFIG_LOADED after fetching config.json. ThemeLogo listens for that event and...
Upload directly to public/{domain-folder}/img/ instead of staging bucket
The uploadLogo endpoint was writing to a hardcoded 'sumtingwong' placeholder (unfilled setting) instead of the org's actual public theme path. Logos now go dire...
Remove downed k2m1 node from edge-nodes default
k2m1 (10.8.2.1) is permanently down. Leaving it in the failover list caused upload retries to hang until the new OkHttp timeout fires. Default is now k1m1-only;...
Apply connect/write/read timeouts to MinioClient via OkHttpClient
Without timeouts, a downed site-replication peer (k2m1) caused makeBucket and putObject calls to block indefinitely, surfacing as an infinite "Saving..." on the...
Mailbox checkbox reads org_domains, not provider domains
The previous wiring read /api/email/domains (email_provider_domains table). That table is only populated when a third-party email provider integration is set up...
Unwrap {markets:[...]} envelope in Attach dialog
GET /api/security/commerce-markets returns { markets: [...], message: "..." }, not a bare array. The Attach Commerce Market dialog was treating the whole respon...
Merge OTK-redirect into proxy.ts, delete duplicate middleware.ts
Next.js 15 refuses to build when both middleware.ts and proxy.ts exist. The OTK hand-off redirect that lived in middleware.ts — sending any request with ?otk=… ...
Read new *** from Redis master and dedupe OTK POST
Replica reads missed freshly written sessions after OTK exchange, causing false failure and login redirect. Skip intro delay when otk is present; share in-fligh...
Guard against non-array responses on /platform/orgs
A non-array response (empty body, error envelope, or {data: [...]} wrapper) was landing in the orgs state and blowing up the render with 'e.map is not a functio...
Enforce /network enter rules server-side
Reject when target is current session org, custom domain SSL is not confirmed, or human target membership is inactive. Share domain-setup logic with my-networks...
Require destination memberId and validate org membership
Enter-as now always builds the new *** with the client-supplied target member row; reject mismatched org/member. Improve session debug logging.
Enter-as session uses target org security provider and optional targetMemberId
Enter-as was setting Redis securityOrgId from the user global security_provider, while login sets it from the target org FQDN chain. That mismatch made cross-do...
Open /validate for enter-as OTK so target org session applies
ENTER linked to /?otk= which never called /api/validate; shared-domain *** cookies kept the source org. Redirect ?otk= to /validate via middleware for any stray...
Resolve system-user session from OTK for BFF requests
SystemUserConfigController and SystemUserCapabilityController only read the *** cookie. kamo-internal forwards X-OTK without cookies, so SecurityService never s...
Enter-as resolves session from X-OTK BFF auth
EnterAsController only read *** cookies; internal traffic uses OTKPreAuthFilter session attributes. Accept targetOrgId as string for large INT8 ids from JSON.
Add BFF route for POST /api/security/enter-as
The /network Enter action called a non-existent Next route, yielding 404. Forward the request to APIService like other security proxies.
Proxy system-user config API routes to APIService
Configuration page called /api/security/system-user/* but no Next handlers existed, so the app returned 404. Add BFF routes matching SecurityService endpoints (...
TeamMember is-a Member; drop bogus tm.getMember() calls
TeamMember uses JOINED inheritance — it IS a Member, no nested member field. The backfill was calling tm.getMember() which doesn't exist. Also switches the JPQL...
Use **************** primitive getter
isOrganizationOwner is a primitive boolean on TeamMember, so the Lombok- generated accessor is isOrganizationOwner() not getIsOrganizationOwner(). Fixes compile...
Stop duplicating query string in KB media/articles API proxy
forwardToApi already appends the browser request search params; embedding ?query in the path produced a second ? and broke upstream URL parsing, causing GET /ap...
Return only team members from by-department endpoint
Interaction Center should list TeamMember rows, not base Member records.
Align Interaction Center with team members only
NavTop greeting falls back to username when the user is not in the team-only list. Interaction Center copy uses team member wording.
Allow org admins to open other members account pages
Expand client redirect guard beyond **************** to include CONFIGURE_SYSTEM, EDIT_MEMBER_ACCESS_LEVEL, ALLOW_PROMOTING_MEMBERS, organization owner, and pla...
Reload ThemeLogo after config and cache-bust logo URL
ThemeLogo read kamo-logo-full-ext from sessionStorage before DynamicMetaLoader finished fetching config.json, so logo-full often used the wrong extension until ...
Show subscription context on Allowed Apps in branch types
Load billing subscription and plan metadata like the Apps tab; gray out rows and show an info alert when a default-on policy would not activate without an eligi...
Apply subscription gate to app routes and feature API
AppAvailabilityInterceptor now always uses isAppEffectivelyEnabled so FORCE_ENABLED respects subscription. FeatureController serializes enabled from the same ga...
Gate app effective enable on subscription and plan features
Add **************** to resolve Stripe or commerce subscriptions and match SubscriptionPlanFeature to ServiceType names. AppliedModelEnforcementService now requ...
Treat any COMP subscription as full access on Apps tab
Gate on paymentMethod COMP for all orgs, not only top-level platform owner, so child orgs with complimentary grants see unlockable toggles.
Expose commerce subscription on GET /subscriptions/current
When no Stripe mirror row exists, resolve the org active commerce SubscriptionRecord (e.g. COMP grants), include paymentMethod and plan features. Fixes Apps set...
Drop stale commerce_subscription_events event_type CHECK for COMP events
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.