Use VPN addresses for k0m1/k2m1 minio-public backends
- Endpoints: k0m1 10.8.0.1, k2m1 10.8.2.1 (VPN); k1m1 stays local - IngressRoute host match: 100.64.x.x -> 10.8.0.1, 10.8.1.1, 10.8.2.1
Skip CockroachDB init job if any pods exist - cluster already initialized
Improve CockroachDB init check to wait for pods and verify cluster state
Prevent CockroachDB init job from running when cluster is already initialized
Update CockroachDB probes, HTTP redirect, and MinIO service endpoints
Add CORS middleware to theme routes to allow cross-origin access from all websites
Add HTTP to HTTPS redirect middleware and IngressRoute
- Create redirect-to-https middleware for permanent redirects - Add catch-all IngressRoute on web entrypoint to redirect all kamocrm.com domains to HTTPS - Fixe...
Remove hostPort from Traefik deployment
- Port 443 is already bound by ingress-nginx via CNI hostPort - Keep standard containerPort configuration
Change Traefik service to LoadBalancer with externalIPs for direct access
- Use LoadBalancer type with externalIPs instead of NodePort - Allows router to forward port 443 directly to service IP - This should bypass ingress-nginx hostP...
Add hostPort to Traefik deployment for direct port access
- Use hostPort 443 for websecure entrypoint to bypass NodePort - Allows router to forward port 443 directly to Traefik - Also set hostPort for web (30080) and a...
Set External Traffic Policy to Local for Traefik NodePort service
- Allows proper routing of external traffic from router - Preserves source IP addresses for better logging
Update CockroachDB StatefulSet to use dynamic VPN IP based on node hostname
- Fix advertise-addr to use VPN IP (10.8.1.1 for k1m1, 10.8.2.1 for k2m1) - Update join parameter to use VPN IPs instead of hostnames - Update node certificate ...
Add node certificates to CockroachDB secret creation
- Add node.crt and node.key to cockroachdb directory - Update CI/CD workflow to include node certificates when creating *** secret - Fixes CockroachDB CrashLoop...
Handle BackoffLimitExceeded by deleting failed job and retrying
- When job fails with BackoffLimitExceeded and pods are cleaned up, delete and recreate job - This allows us to get fresh logs from a new pod - Catches 'already...
Handle BackoffLimitExceeded by deleting and retrying init job
- When job fails with BackoffLimitExceeded and pods are cleaned up, delete and recreate job - This allows the job to retry and succeed if cluster is already ini...
Improve cluster connectivity test in CockroachDB init workflow
Improve CockroachDB init job error handling when pods are cleaned up
- Check previous pod logs if current pods are not found - Test cluster connectivity to verify if already initialized - Better handling of failed jobs with clean...
MinIO secret creation from workflow (MinIO is managed manually)
Add automatic *** secret creation
- Create *** secret on both k1m1 and k2m1 - Secret contains MINIO_CURRENT_HOST pointing to k0m1 MinIO instance (http://10.8.0.1:9000) - Fixes kamowssecurity-dep...
Resolve Traefik, NATS, and CockroachDB deployment issues
- Remove hostPort from Traefik deployment (conflicts with NodePort service) - Fix NATS deployment to only deploy server-specific statefulsets (nats-k1m1, nats-k...
Improve CockroachDB init job error handling - check pod status and logs after timeout
Update IP addresses from Tailscale (100.64.x.x) to WireGuard VPN (10.8.x.x) for NATS, CockroachDB, and CI/CD workflows
Add complete Kamo logo SVG with all 14 paths
Embed full SVG content directly instead of partial paths
Use CSS-only approach for Kamo logo
Removed broken SVG file mount, using CSS background-image to load external logo directly on #logo element
Fix logo.svg to reference external Kamo logo URL
Use SVG image element to embed external logo instead of complex paths with broken transforms
Replace Roundcube logo.svg with Kamo logo SVG
Mount custom logo.svg to **************** to replace the Roundcube watermark/background logo
Add custom CSS file to override Roundcube watermark logo
- Created custom.css with watermark override - Mount CSS file to /var/www/html/custom.css - Configure Roundcube to load additional_stylesheets
Replace all Roundcube logos with Kamo logo including watermark
Updated skin_logo config to array format to cover: - Main header logo - Small collapsed header logo - Inbox watermark/background logo
Add mail subdomain to auto-cert SUBDOMAINS list
Enables automatic SSL certificate creation for mail.kamocrm.com
Expose Postfix ports 25 and 587 via hostPort for inbound mail
Required for receiving external SMTP connections on K1M1
Configure Roundcube to use Mailgun SMTP directly
Bypassing local Postfix for outgoing mail, connecting directly to smtp.mailgun.org with TLS on port 587
Switch Postfix to Alpine-based deployment with MySQL support
Similar to Dovecot, using Alpine 3.18 with postfix-mysql package installed at runtime for reliable MySQL virtual maps support
Fix postfix command to use apt-get instead of apk
boky/postfix is Debian-based, not Alpine
Add postfix-mysql support for MySQL virtual maps
Installed postfix-mysql package at container startup to enable MySQL dictionary lookups for virtual domains/users/aliases
Add auth debugging and ensure MySQL driver packages for Dovecot
- Enable auth_debug, auth_debug_passwords, auth_verbose - Add dovecot-mysql package for proper SQL support - Add mariadb-connector-c for MySQL protocol compatib...
Add MySQL auth fix job for MariaDB client compatibility
Changes kamo user from caching_sha2_password to mysql_native_password Required for Dovecot (Alpine/MariaDB) to connect to MySQL 8
Replace Roundcube logo with Kamo logo
Added skin_logo config pointing to **************** Updated deployment annotation to trigger pod restart
Fix MySQL auth: change kamo user to mysql_native_password
Alpine's MariaDB client doesn't support caching_sha2_password plugin This prevents Dovecot from connecting to MySQL for authentication
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.