Make the workstation fstab rewrite safe
Backs up /etc/fstab, normalises a missing trailing newline (a plain append would otherwise splice onto the last entry), and refuses to install a file that lost ...
Stop rounding int64 ids on the way back to the server
Sweep of the client half of the int64 id work. Each of these took an id the server had sent intact and put it through Number()/parseInt(), which rounds anything...
Workstation-side mount script for the KAMOTEAM share
NFSv4 over the NodePort, mounted soft with a systemd automount so an unreachable cluster returns an error instead of hanging every process that touches the fold...
Record the SecurityService unauthenticated-endpoint triage
Three fixed, the rest explained. The headline number needed narrowing three times and the first two attempts were wrong the same way — enumerating helper names ...
Delete the unauthenticated /api/security/roles/test stub
A reachability probe that returned "SecurityRoleController test endpoint is working" to anybody. Nothing calls it — no reference in any service or in kamo-inter...
Polish video hero unit with modern animations and optimizations
- Add poster image for instant visual feedback during video load - Implement loading skeleton with pulsing animation - Start video muted (browser autoplay polic...
KAMOTEAM shared folder on every desktop
desktop-1 hosts /srv/kamoteam and exports it over NFSv4; every VM user gets ~/Desktop/KAMOTEAM as a symlink (via /etc/skel for new accounts and the agent for ex...
Close two unauthenticated endpoints reachable from the internet
SecurityService is anyRequest().permitAll() with @EnableMethodSecurity absent, so every @PreAuthorize is inert and public is the default; APIService relays /api...
Replace hero text unit with autoplay promo video
Swap the homepage hero copy, CTAs, and stats for a looping muted video while keeping the rotating background treatment.
Stop xrdp restarts orphaning sessions and causing black screens
systemctl restart xrdp makes xrdp-sesman forget its in-memory session registry while the Xorg processes keep running. The next login cannot find the session so ...
Let the colour palette take clicks again
The sticky's palette was a child of the title bar. Header and writing surface are siblings on the same layer, so the body — later in the DOM — paints over the h...
Alert on OOMKills, and on the occupancy that precedes them
Nothing was watching memory. MediaService was OOMKilled every few hours for most of a day and EmailService six times, and the way anyone found out was a chat wi...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
The public chat reads its pages without the count either
Both sites took .getContent() and dropped the total on the floor, so both were paying for the same discarded COUNT over every object in the session that just 50...
Size the pod for the heap the JVM is already allowed to take
The container ran with a 1Gi limit while the image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch. Read off the live process, that is MaxHeapSi...
Read a page of chat history without counting the whole session
Spring Data derives a second statement for every Page it returns, and the chat history read asked for one it never looked at: MediaController takes page.getCont...
Block outbound SSH except sage, resolve k1m1/k3m1, bundle the agent dir
Outbound tcp/22 is rejected for every uid except root and sage, keyed on socket owner so future accounts are covered without re-running anything. Reapplied at b...
Standard toolchain, taskbar pins and passwordless installs for all users
Adds krita and maven **************** were already present), pins Chrome, VS Code, Kate, Spectacle and Krita to the taskbar for every user, and lets dev users i...
Allow SecurityService egress to the dev machine agent, and apply policies from CI
Cilium egress is default-deny for every endpoint it selects, and toEndpoints:[{}] is scoped to the policy's OWN namespace — so SecurityService could not reach d...
Gate the Linux desktop icon on a provision, not on god
The icon now appears exactly when the connection behind it will work — the SSO endpoint enforces the same rule, so the two cannot disagree. Windows and Master s...
Dev Machine dialog on the administrator card
Keeps three states apart that one toggle would collapse: never provisioned (needs a password), provisioned but locked (needs only the switch), and failed (needs...
Client module and proxy routes
*** is forwarded explicitly — buildForwardHeaders sets X-OTK but not the session token, and the dev-machine endpoints resolve the caller from it. The action seg...
Per-member SSO credentials and a preflight that explains failures
Linux is gated on an enabled provision rather than god, and served with the member's own credentials. The connection is omitted from the token entirely when the...
Dev machine service and controllers
Username derives from the member ACCOUNT email, not the TeamMember work email — a work address can sit on another domain and would silently produce a different ...
HTTP client for the dev machine provisioning agent
health() swallows transport failures and answers false so the SSO preflight can return an actionable 503 rather than a 500.
AES-GCM secret codec and POSIX username derivation
Codec is deliberately reversible — RDP auto-login needs a real password — and uses GCM so a tampered or wrong-key row fails loudly rather than decrypting to noi...
Dev_machine_accounts entity, status enum and repository
status and enabled are deliberately separate: a provisioned-but-disabled account keeps its home directory, so re-enabling restores access rather than rebuilding...
Agent secrets in CI, guacamole liveness, availability alerts
Alert expressions verified against the live Prometheus. Uses kube-state-metrics rather than kubevirt_* — the KubeVirt metrics endpoint is not scraped here, so r...
Idempotent agent installer, shared by cloud-init and live installs
Staged under /opt/kamo-desktop-agent so install-agent.sh has a distinct source and destination. Covers netplan-by-driver, cloud-init network disable, xrdp sessi...
Add the provisioning agent and its unit tests
Python 3 stdlib only. Every mutation runs subprocess with an argv list, never a shell string; passwords go to chpasswd on stdin so they stay out of /proc.
Pin the VM MAC and add RDP readiness/liveness probes
KubeVirt generates a random MAC per VMI when macAddress is absent. The guest's netplan matched on the first-boot MAC, so every VMI recreate silently orphaned th...
Implementation plan for dev machine provisioning
16 tasks across KlusterServices, kamo-shared-library, KamoInitializerService, SecurityService and kamo-internal.
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.