添加定价@kamocrm.com 邮箱和外部 IMAP 节点端口
- 新服务邮件/ dovecot-imap-外部(节点30143 - > 143) IMAP可以从集群外的$NODE:30143到达. - 种子定价@kamocrm.com 在 mysql-init 中如此新鲜的 DB靴子 重建邮箱;活行已经存在于 MySQL.
种子 pbx.k1.kluster.kamocrm.com 作为一个静态域
浏览器软手机需要 SIP- over- WSS 才能在主机名上登陆 TLS 证书 。 将 FreePBX 管理员 / WS 主机名添加到 STATIC DOMAINS 中, 所以 每个主机自动复制器的过滤器 而不是在Treefik访问日志中出现。 一旦颁发证书,临时内部.kamocrm.com/voip-ws路径 ...
为浏览器软手机添加 WSS WebRTC 传输
Asterisk 的 chan pjsip 现在在 0.0:8089 上绑定一个普通的 WebSocket 运输 和特拉菲克终止 TLS at QQ(第443端口) 因此, Kamo- 内部可以在已有通配符上注册浏览器软手机 不管理舱内证书的 cert. - 配置map- k1m1. yaml: startup.sh...
与PJSIP监狱和持续状态的禁产2
- 增加dauf2ban-configmap.yaml 与[asterisk]和[frepbx-web]监狱, 递增禁令升级(1h-24h-30d上限)、局域网忽略和a 用于 PJSIP 安全Event 记录的自定义星号安全.conf 过滤器 - Mount dauf2ban-configMap和主机Path/var/...
Integrate Coqui TTS with norman voice (VCTK p267)
- Deploy coqui-tts server (VCTK VITS model, CPU-only) as ClusterIP service on port 5002 with model cache at /var/lib/coqui-tts on k1m1 - Inject coqui_tts.agi ...
在 k1m1 上为分拆 DNS 添加 LAN DNS 显示器
在 k1m1 上部署带有主机的 dnsmasq 显示器 192.168.4.22:53. overrides pbx.k1.kluster.kamocrm.com - > 192.168.4.22 (中文(简体) ). 因此局域网的电话直接到达PBX,没有NAT发夹. 所有其他 询问转至8.8.8.8/8.8.4。 ...
在 k1m1 和 k2m1 上部署 FreePBX 17 + Jigasi SIP桥
FreePBX(已退休/freepbx:17-latest)使用主机Network运行,所以SIP/RTP 保存真实的客户端IP,通过节点Selector被绑定为一号节点. SIP 打开 5060 UDP/TCP (5061 TLS), RTP 范围 18000-18999 为避开Janus所选 (20000年-209...
Add weekly image prune and journal vacuum CronJob for k1m1
CronJob runs every Sunday 3am, privileged, pinned to k1m1. - crictl rmi --prune removes unused container images - nsenter journal vacuum enforces 500MB cap - CI...
Add geo-database-url to analytics-secret for CockroachDB geolite lookup
Kamo Analytics uses this URL to look up visitor IP→country/region/city from the **************** tables. Uses kamo user with password auth and sslmode=require (...
Add iframe-compatible middleware chain for kamo-analytics
Add security-headers-allow-iframe (no X-Frame-Options) and kamo-middlewares-allow-iframe chain so analytics can be embedded in iframes from internal.kamocrm.com...
Move kamo-analytics to own repo, keep only postgres in KlusterServices
- Remove analytics deployment, service, and nginx-configmap (now owned by kamo-analytics project with its own CI/CD pipeline) - Remove analytics-ingressroute ...
Rebrand analytics analytics UI with Kamo logo, title, and favicon
Adds nginx sidecar proxy that injects CSS to replace the analytics logo with KamoCRM logo, changes the page title to "Kamo Analytics", and overrides the favicon...
Add analytics analytics deployment and analytics.kamocrm.com routing
- New analytics/ directory: PostgreSQL StatefulSet + analytics deployment, services, and secret template - **************** routes analytics.kamocrm.com → analy...
Restore bergamot with working model sources and correct image
- replicas: 1 - Init container (alpine): downloads 4 pairs from data.statmt.org (tarballs for enes/enfr/ende/enpl) and 2 from firefox-translations-models GitH...
Configure Prosody, Jicofo, and secrets for Jibri recording support
Enable recording in Prosody, add Jibri XMPP passwords to secrets, and configure Jicofo brewery MUC for Jibri instance discovery.
Add Jibri deployment manifests for Meet meeting recording
Kubernetes deployment, service, and configmap for Jibri (Meet Broadcasting Infrastructure) to enable meeting recording with MinIO storage integration.
Add Meet service deployment steps to CI/CD pipeline for k1m1 and k2m1
Add distributed JVB pool with per-node StatefulSets on k1m1 and k2m1
Add Jicofo conference focus with JVB brewery and lobby enforcement
Add Prosody XMPP server deployment with JWT auth and lobby support
Add Qdrant vector DB and MiniLM embedding model K8s manifests
- Qdrant v1.12.1 deployment + ClusterIP service (ports 6333/6334) - HuggingFace TEI with all-MiniLM-L6-v2 deployment + service (port 8080) - Updated deploy-serv...
Add wopi-*** for DocsService
Adds WOPI JWT signing secret used by DocsService for Docs access tokens. Deployed to both K1M1 and K2M1 clusters.
Add HTTP to HTTPS redirect middleware and IngressRoute
- Create redirect-to-https middleware for permanent redirects - Add catch-all IngressRoute on web entrypoint to redirect all kamocrm.com domains to HTTPS - Fixe...
Add automatic *** secret creation
- Create *** secret on both k1m1 and k2m1 - Secret contains MINIO_CURRENT_HOST pointing to k0m1 MinIO instance (http://10.8.0.1:9000) - Fixes kamowssecurity-dep...
Update TURN server credentials with secure values
- Updated turn-secret with secure random value - Updated turn-password for Janus authentication - Credentials match MediaService WebRTC configuration
Add ServersTransport deployment to CI/CD workflow
Deploy traefik/serverstransport.yaml as part of Traefik deployment to both K1M1 and K2M1. This enables HTTP/1.1 backend connections for MediaService WebSocket s...
Add ServersTransport for MediaService WebSocket connections
Add media-websocket-transport ServersTransport resource to disable HTTP/2 for backend connections to MediaService. This is required for proper WebSocket upgrade...
Add media-websocket-upgrade middleware to force Upgrade header
- Add Upgrade: websocket header for WebSocket paths to fix HTTP/2 Extended CONNECT conversion - This ensures HTTP/2 WebSocket upgrade requests are properly conv...
Add media-cors middleware for media domain CORS support
- Add media-cors middleware matching theme-cors configuration - Allows CORS headers to be set for media.{domain} requests
Add 'media' subdomain to auto-cert SUBDOMAINS for MediaService
- Add 'media' to SUBDOMAINS list in auto-cert-service.yaml - Enables automatic SSL certificate generation for media.{domain} subdomains - Required for MediaServ...