Fix Dovecot auth syntax and Roundcube database permissions
- Dovecot: Fix auth-sql.conf.ext syntax - passdb/userdb need section names - MySQL: Grant ALL PRIVILEGES on roundcubemail database to kamo user - Add mysql-perm...
Fix Dovecot and Postfix configurations to resolve CrashLoopBackOff
- Dovecot: Use conf.d structure with official Dovecot image defaults - Dovecot: Split config into individual files (10-auth, 10-mail, 10-master, 10-ssl) - Postf...
Fix kubeconfig setup in CI/CD to use Tailscale IPs directly
- Replace sed commands with kubectl config set-cluster for reliable connection - Use 100.64.1.1 for K1M1 and 100.64.2.1 for K2M1 directly - Fixes 'dial tcp 100....
Add complete mail server infrastructure with Postfix, Dovecot, Roundcube, and MySQL
- Deploy mail server (MySQL, Postfix, Dovecot, Roundcube) to K1M1 only - Configure HTTPS access via Traefik at https://mail.kamocrm.com - Set up multi-domain su...
Update Janus TURN server configuration to use kamocrm.com:3478
Add Janus WebRTC Gateway configuration documentation - Document current Janus configuration on k1m1 - Add configuration reference files for Janus setup
Revert "fix(traefik): disable idle timeout for WebSocket connections"
This reverts commit ****************
Disable idle timeout for WebSocket connections
- Added idleTimeout=0 to websecure entrypoint - Prevents Traefik from closing WebSocket connections due to inactivity - Fixes SockJS WebSocket timeout issues
Update TURN server credentials with secure values
- Updated turn-secret with secure random value - Updated turn-password for Janus authentication - Credentials match MediaService WebRTC configuration
Split port ranges to avoid conflicts
- Coturn relay: 52000-65535 (13,536 ports) - Avoids: Janus RTP (10000-49151) and WireGuard (51820-51821) - No overlap between services
Adjust relay port range to avoid WireGuard/VPN ports
- Changed max-port from 65535 to 51800 to avoid conflicts - Avoids WireGuard on UDP 51820 and other VPN services on 51821 - Provides 2,649 ports (49152-51800) f...
Resolve CrashLoopBackOff by fixing probes and config
- Replace netstat-based health probes with TCP socket checks (netstat not available in coturn/coturn:latest Alpine image) - Remove conflicting no-stdout-log dir...
Add ServersTransport deployment to CI/CD workflow
Deploy traefik/serverstransport.yaml as part of Traefik deployment to both K1M1 and K2M1. This enables HTTP/1.1 backend connections for MediaService WebSocket s...
Add ServersTransport for MediaService WebSocket connections
Add media-websocket-transport ServersTransport resource to disable HTTP/2 for backend connections to MediaService. This is required for proper WebSocket upgrade...
Add Connection: Upgrade header to WebSocket upgrade middleware
- Add Connection: Upgrade header along with Upgrade: websocket - Both headers are required for proper WebSocket upgrade handshake - This ensures HTTP/2 Extended...
Add media-websocket-upgrade middleware to force Upgrade header
- Add Upgrade: websocket header for WebSocket paths to fix HTTP/2 Extended CONNECT conversion - This ensures HTTP/2 WebSocket upgrade requests are properly conv...
Add media-cors middleware for media domain CORS support
- Add media-cors middleware matching theme-cors configuration - Allows CORS headers to be set for media.{domain} requests
Add 'media' subdomain to auto-cert SUBDOMAINS for MediaService
- Add 'media' to SUBDOMAINS list in auto-cert-service.yaml - Enables automatic SSL certificate generation for media.{domain} subdomains - Required for MediaServ...