Remove forced WebSocket headers from media middleware
Traefik v3 handles WebSocket Upgrade/Connection headers natively. Remove forced headers that broke non-WebSocket API requests.
Add system account to all NATS configs
Add $SYS account with admin credentials to k0m1, k1m1, and k2m1 NATS configs. Enables nats CLI cluster management operations (peer removal, step-down, etc.) for...
Resilient probes so cluster stays up when one node is offline
- Liveness: tcpSocket on 4222 (do not depend on JetStream meta leader) - Readiness: initialDelay 90s, period 15s, failureThreshold 10 so k0m1+k1m1 can form qu...
Update Traefik routes: themes.* assets now only load from k1m1 minio instead of balancing across k0m1, k1m1, and k2m1
Use VPN addresses for k0m1/k2m1 minio-public backends
- Endpoints: k0m1 10.8.0.1, k2m1 10.8.2.1 (VPN); k1m1 stays local - IngressRoute host match: 100.64.x.x -> 10.8.0.1, 10.8.1.1, 10.8.2.1
Skip CockroachDB init job if any pods exist - cluster already initialized
Improve CockroachDB init check to wait for pods and verify cluster state
Prevent CockroachDB init job from running when cluster is already initialized
Update CockroachDB probes, HTTP redirect, and MinIO service endpoints
Add CORS middleware to theme routes to allow cross-origin access from all websites
Add HTTP to HTTPS redirect middleware and IngressRoute
- Create redirect-to-https middleware for permanent redirects - Add catch-all IngressRoute on web entrypoint to redirect all kamocrm.com domains to HTTPS - Fixe...
Remove hostPort from Traefik deployment
- Port 443 is already bound by ingress-nginx via CNI hostPort - Keep standard containerPort configuration
Change Traefik service to LoadBalancer with externalIPs for direct access
- Use LoadBalancer type with externalIPs instead of NodePort - Allows router to forward port 443 directly to service IP - This should bypass ingress-nginx hostP...
将主机端口添加到 Traefik 部署, 用于直接端口访问
- 使用主机Port 443作为网络安全入口,绕过节点Port - 允许路由器将443号口直接转发至Traefik - 还为Web(30080)和管理员(30646)设置主机端口,以便保持一致
将外部交通政策设定为 Trafik 节点端口服务
- 允许从路由器对外部交通进行适当的路线安排 - 为更好的记录保存源IP地址
更新 CockroachDB 根据节点主机名使用动态 VPN IP 的状态Set
- 固定广告添加器,使用VPN IP(k1m1, 10.8.1.1, 10.8.2.1, k2m1) - 更新加入参数以使用VPN IP而不是主机名 - 更新节点证书,以包括所有VPN IP(10.8.0.1, 10.8.1.1, 10.8.2.1)和主机名称
在 CockroachDB 秘密创建中添加节点证书
- 在蟑螂目录中添加节点.crt和节点.key - 更新 CI/CD 工作流程,以便在创建 *** 秘密时包含节点证书 - 解决CockroachDB CrashLoopBackOff问题
处理 BackoffLimit 通过删除失败的工作并重试而超越
- 当与 BackoffLimit Excessed 的工作失败时, 和被清理、删除和重新创建的工作 - 这样我们就能从新舱取出新的日志 - 在重试时检查“ 已经初始化” 错误
处理 BackoffLimit 通过删除和重试它的任务而超额完成
- 当与 BackoffLimit Excessed 的工作失败时, 和被清理、删除和重新创建的工作 - 如果集群已初始化, 允许任务重试并成功 。 - 更好地处理临时故障
Improve cluster connectivity test in CockroachDB init workflow
Improve CockroachDB init job error handling when pods are cleaned up
- Check previous pod logs if current pods are not found - Test cluster connectivity to verify if already initialized - Better handling of failed jobs with clean...
MinIO secret creation from workflow (MinIO is managed manually)
Add automatic *** secret creation
- Create *** secret on both k1m1 and k2m1 - Secret contains MINIO_CURRENT_HOST pointing to k0m1 MinIO instance (http://10.8.0.1:9000) - Fixes kamowssecurity-dep...
Resolve Traefik, NATS, and CockroachDB deployment issues
- Remove hostPort from Traefik deployment (conflicts with NodePort service) - Fix NATS deployment to only deploy server-specific statefulsets (nats-k1m1, nats-k...
Improve CockroachDB init job error handling - check pod status and logs after timeout
从 Tailscale (100.64.x.x) 更新 NATS, CockroachDB 和 CI/CD 工作流程的 IP 地址到 WireGuard VPN (10.8.x.x)
卡莫标志只使用 CSS 方法
使用 CSS 背景图像删除已损坏的 SVG 文件挂载 直接从 #logo 元素上加载外部标志
将 Roundcube 标志.svg 替换为 Kamo 标志 SVG
挂载自定义标志. svg to QQ 替换圆立方体水印/背景标志
添加自定义 CSS 文件来覆盖圆立方体水印标志
- 创建自定义.cs 有水印覆盖 - 将CSS文件上载到/var/www/html/custom.css - 配置圆立方体以装入额外的 styleshows
将所有圆立方体标志替换为包括水印在内的卡莫标志
将 skin logo 配置更新到数组格式以覆盖 : - 主头徽标 - 倒塌的小头徽标 - 信箱水印/背景标识
配置圆立方体直接使用 Mailgun SMTP
通过本地 Postfix 发送邮件,直接连接到 Smtp.mailgun.org 端口为587的 TLS
Switch Postfix to Alpine-based deployment with MySQL support
Similar to Dovecot, using Alpine 3.18 with postfix-mysql package installed at runtime for reliable MySQL virtual maps support
Fix postfix command to use apt-get instead of apk
boky/postfix is Debian-based, not Alpine
Add postfix-mysql support for MySQL virtual maps
Installed postfix-mysql package at container startup to enable MySQL dictionary lookups for virtual domains/users/aliases