Live Change Log

Third take, 40s (down from 60s). Uploaded alongside the previous two rather than over them, so rolling back to either is a one-line change to KAMO_ATTENDANT_INT...

- config.ini carries a [zone] block from day one so a second region is a config edit, not surgery. Secrets are substituted by an entrypoint at container start...

CouchDB q=8 / n=1, verified live. q is fixed at database creation and KamoPBX creates a database per account plus monthly MODBs, so q is sized now for the event...

- TURN over TLS on 5349 with a real cert (turn-kamocrm-com-cert). Without turns:, a customer behind a 443-only egress firewall has no media path. Verified e...

Uploaded as a new file rather than overwriting the old one, so rolling back is a one-line change to KAMO_ATTENDANT_INTRO plus a dialplan reload — no re-upload n...

Replaces the hand-rolled Dial()+Goto queue loop with app_queue. The deciding factor is DTMF: digits are NOT matched against the dialplan while Dial() is running...

Eight hold tracks uploaded as the `kamocrm-hold` MOH class, shuffled. The random ordering comes from `random=1` on the row in FreePBX's `music` table, which is ...

Replaces the music-on-hold hold pattern with the recorded intro: - **************** plays the greeting AND listens at the same time, so a caller can dial ove...

Inbound calls had nowhere to go: the `incoming` table was completely empty, so even a delivered call would have dead-ended. Adds the attendant context plus the ...

Closing the KamoDesktop tab left a live session sitting on the machine. Guacamole keeps its auth token in localStorage (GUAC_AUTH), which survives closing the t...

Two gaps, both proven against the live cluster today. FIRST: every existing KamoDesktop alert measures whether a COMPONENT is alive. All four were green during...

URI handler that creates a conversation in a RUNNING window and pre-fills the input, which is the only way to reach the editor sage already has open instead of ...

Marketing tracking codes credit a partner for the signups, organizations and paid accounts their link produced, and those three moments happen in services that ...

kamo13.mp4 uploaded to MinIO at public/kamo13.mp4 (30 MB, sha256 174aaec6…, verified byte-identical to the local source after transfer — this link has a history...

MediaMTX serves live channels over HLS, WebRTC, RTSP and RTMP, and loops the marketing reel as an always-available channel via alwaysAvailableFile — no ffmpeg s...

NFSv4 over the NodePort, mounted soft with a systemd automount so an unreachable cluster returns an error instead of hanging every process that touches the fold...

desktop-1 hosts /srv/kamoteam and exports it over NFSv4; every VM user gets ~/Desktop/KAMOTEAM as a symlink (via /etc/skel for new accounts and the agent for ex...

Nothing was watching memory. MediaService was OOMKilled every few hours for most of a day and EmailService six times, and the way anyone found out was a chat wi...

Outbound tcp/22 is rejected for every uid except root and sage, keyed on socket owner so future accounts are covered without re-running anything. Reapplied at b...

Adds krita and maven **************** were already present), pins Chrome, VS Code, Kate, Spectacle and Krita to the taskbar for every user, and lets dev users i...

Alert expressions verified against the live Prometheus. Uses kube-state-metrics rather than kubevirt_* — the KubeVirt metrics endpoint is not scraped here, so r...

Staged under /opt/kamo-desktop-agent so install-agent.sh has a distinct source and destination. Covers netplan-by-driver, cloud-init network disable, xrdp sessi...

Python 3 stdlib only. Every mutation runs subprocess with an argv list, never a shell string; passwords go to chpasswd on stdin so they stay out of /proc.

Object storage already refuses content that would take an organization past its ceiling, which covers every domain going through the object store. Inbound mail ...

Object storage already refuses content that would take an organization past its ceiling, which covers every domain going through the object store. Inbound mail ...

The shim is a sequence seeded at the production maximum plus a margin. The seed carries two requirements, not one: it must exceed every existing id or the first...

The shim is a sequence seeded at the production maximum plus a margin. The seed carries two requirements, not one: it must exceed every existing id or the first...

Both engines now run side by side on k1m1; CockroachDB is untouched and remains the rollback path. Three things that were not obvious: - The Helm chart versio...

Both engines now run side by side on k1m1; CockroachDB is untouched and remains the rollback path. Three things that were not obvious: - The Helm chart versio...

Reinstates what 8f6c672 reverted, in the only form that actually works here. The earlier attempt failed because a plain NetworkPolicy cannot express this clust...

SecurityService now runs a fetcher whose target URL is chosen by an untrusted party — a BIMI record is DNS content published by whoever owns a sending domain, a...

Local Kubuntu workstation shares its live Plasma/Wayland session over RDP via KRdp. Adds an idempotent bootstrap SQL connection (192.168.4.46:3389, sage/shared ...

expo-protocol-version:1 + expo-sfv-version:0 response headers that the expo-updates client requires and static MinIO cannot emit. Longer path prefix wins over t...

IngressRoute (priority 100, websecure, ws-upgrade middleware sans compress) routes wss://api.<domain>/ws/ai-chat to kamowsai-service:80 — same pattern as the me...

Remove the single-node pin and switch to a per-pod model cache so pods can schedule on any node, and add an HPA (min 1 / max 4, CPU 75%, deliberate scale-up giv...

Override **************** so the 'Connecting to Guacamole...' screen (and related status) reads KamoDesktop.

- Meet-prosody: version-control the custom-plugins ConfigMap (captures the existing token_verification no-op override that was created out-of-band) and add ...

- JSON_SECRET_KEY (optional) on guacamole from the shared desktop-sso secret enables the bundled guacamole-auth-json extension the god-SSO links validate agai...

Adds a full remote-desktop stack, GitOps-applied via the deploy workflow: - KubeVirt + CDI installed at deploy time (pinned-stable release URLs) - desktop-1: K...

Add step 6 to bootstrap-universe.sh: creates the universe-minio secret (ACCESS_KEY/SECRET_KEY from universe-backup-s3 root creds) and notes that the universe-ug...

- universe/: namespace + ResourceQuota, valkey-universe (AOF, hostPath k1m1), nightly CockroachDB backup CronJob, operator bootstrap script - monitoring/: pin...

- statefulset: advertise/join over 192.168.4.x (k1m1=.22, k3m1=.36); WireGuard dropped (k3m1 wg0 10.8.0.1 collided with k0m1's advertise IP). - init-job + CI ...

sign.pink is a new apex domain (consumer e-signature brand / white-label Kamo tenant org). Pre-seed apex + www so a Let's Encrypt cert exists before first HTTPS...

Adds `myloan` to the SUBDOMAINS recognition list and rewrites the comment to make the list's purpose explicit (it's documentary; the dynamic Traefik log scan is...

Auto-cert now provisions and maintains the Let's Encrypt cert for mail.kamocrm.com (HTTP-01 via Traefik on port 80) and keeps the postfix consumer in sync acros...

k1m1 Traefik now terminates HTTPS for priceturbo.com and any *.priceturbo.com subdomain, forwarding plain HTTP to the upstream Traefik at 192.168.4.36:80 with t...

k1m1 Traefik now terminates HTTPS for api.rate.loans, www.rate.loans, and www.stack.loans, forwarding plain HTTP to the upstream Traefik at 192.168.4.36:80. Aut...