GET /api/public/iot/providers, the device-compatibility feed (IoT SP14 D2)
Carry website visitors' Live Support files through the gateway
- POST **************** the multipart "files" parts are re-sent to MediaService as a fresh multipart body, streamed from the container's spooled copies (the...
Serve Tesla's partner key path and exempt it from access rules (IoT SP08-D2)
GET **************** forwards sessionless (identity headers and Authorization dropped) to IoTService **************** the exact path (container- normalised) is ...
IoT vendor deliveries are not judged by an organization's IP and country rules (IoT SP00-D5)
No literal internal-auth secret fallback — a blank public-chat secret answers 503
Seven @Value sites and application.yml fell back to the literal dev-secret-change-in-prod when **************** was missing, so a pod without its Secret sent a ...
The connector relay never sends a reserved close code
When KamoCameraService rolled, the backend socket closed without a close frame (1006) and the relay passed 1006 to the connector; 1005, 1006 and 1015 only descr...
The connector socket's client address is the right-most public X-Forwarded-For hop
CameraAgentWebSocketHandler took the FIRST X-Forwarded-For hop — the one a client can write itself — and that address is what KamoCameraService rate-limits unau...
KamoCameras connector — /api/cameras/agent/** enrollment and the /ws/cameras/agent relay
Carve out /api/docs/internal/** for the disclosure label endpoint
KamoCollab CP05 Task 23. DocsService gains POST **************** guarded only by the KamoAI internal secret and called in-cluster, so the public gateway ends th...
Route website contact forms, on the session-creation budget
POST /api/public-chat/contact proxies to MediaService's new contact endpoint through the same site-key, origin and scope checks as every other public-chat call,...
The FreePBX helper's one key rings a phone
kamo-asterisk-support holds a single API key, documented and issued as a VOIP_RECORDING_UPLOADS key, and sends its ring events with it. The ring endpoint accept...
The public subscription catalog takes ?universe=
The KamoUniverse site shows the Family, Community and Personal plan ladders, and the public catalog proxy only forwarded locale, so it could only ever return th...
Give a public chat's own turns the message rate limit, not the session one
Every public-chat path lives under /sessions/, so the limiter's contains("sessions") test put the conversation itself on the session-creation budget: 3 requests...
PBX policy pull for kamo-asterisk-support; ring VOIPService with the cluster secret
KamoAI internal endpoints never leave the gateway
Carves the seven KamoAI internal subtrees (master spec §7 item 13) out of the wildcard forwards, and with them the server-to-server endpoints that predate the p...
The public address Zapier posts Arive events to
POST **************** trigger> forwards to SecurityService's AriveInboundController, which owns the token check. The query string (the event) crosses the hop, a...
Give the gateway a memory request and limit
The deployment had no resources: block at all. No request, so the scheduler could not reason about this pod's footprint; no limit, so nothing capped the JVM's -...
Forward commission Stripe Connect webhooks, which reached nothing at all
CommissionService registers **************** directly with Stripe (OrgStripeSetupService), but no /api/commissions/** forward existed anywhere in this gateway -...
Carve out VOIPService's internal SMS-template API, and never forward a client's own X-Internal-Auth
Two related gaps in the same trust boundary. /api/voip/sms/templates/** was forwarded wholesale by the /api/voip/** wildcard. VOIPService's InternalAuthFilter ...
Derive X-Real-IP from the right-most hop, not the client's own
forward() set the outgoing X-Real-IP to X-Forwarded-For.split(",")[0] -- the LEFT-most hop, which is the one part of that header a client controls outright: a r...
Bound upstream calls with a connect and a read timeout
Both RestTemplate beans were built from a bare JdkClientHttpRequestFactory with no timeout at all. One upstream that accepts the connection and then never answe...
Stop logging session tokens, OTKs and auth headers on every request
forward() printed the entire copied-header map on every single call -- System.out.println("APIService: copied headers: " + outHeaders) -- which serializes X-***...
Scrub copies of live credentials from config and dumps
A sweep of every repo for the values of the cluster's live Secrets (2026-09-23) found copies here: the JWT signing secret as a `${JWT_SECRET:<literal>}` default...
No live credentials in application.yml defaults
The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...
Forward /api/checklists to KBService
Checklists live in the Notes app and are served by KBService beside the notes themselves; without this route the whole feature answers 404 at the gateway.
Forward the Hosted Computer agent path, and only that path
/api/hosted-computers/agent/** -> ComputeService. A Hosted Computer's network policy denies the cluster entirely — no database, no service, not even cluster DN...
Liveness probe on /actuator/health/liveness, not the DB-aware aggregate
The aggregate /actuator/health includes the DataSource indicator, so restarting the database failed liveness on every pod at once and restarted the whole platfo...
Release idle Hikari connections now that YSQL pooling is shared
The connection manager no longer pins sessions **************** so idle app connections no longer each hold a database backend. Keep the pool maximum, but stop ...
Accept OCI image indexes when resolving the built digest [skip ci]
The images are pushed as OCI image indexes, so asking the registry for a single image manifest only answered 404, the digest came back empty and the check faile...
Restart when a same-commit rebuild leaves pods on the old digest [skip ci]
The rollout step tried to detect a same-commit rebuild by comparing the Deployment's image reference before and after `set image`. "Apply manifests" has already...
Never forward client-supplied identity headers upstream
forward(), forwardWebhook() and forwardCallback() copied every inbound header except Host (and, for the sessionless two, the credential headers) onto the upstre...
Forward carrier SMS webhooks, which reached nothing at all
Traefik sends every path on api.kamocrm.com to this gateway with no path split, and this class forwarded /api/voip/** and nothing else. So /api/bulktext/inbound...
Forward carrier SMS webhooks, which reached nothing at all
Traefik sends every path on api.kamocrm.com to this gateway with no path split, and this class forwarded /api/voip/** and nothing else. So /api/bulktext/inbound...
Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Drop the /api/settings forward, which pointed at nothing
EmailService serves the sync-integration controller at **************** not /api/settings/integrations — so that forward reached a path the service does not map...
Route /api/contacts, /api/calendar and /api/settings to EmailService
KamoMobile's contacts and calendar screens 404'd on every request. Neither path was routed at the api host, so nothing reached EmailService and the service logg...
Run two pods
replicas 1 -> 2. This service runs no @Scheduled work and binds no exclusive NATS durable, so a second pod duplicates nothing — it is stateless request serving,...
Give the rollout room for the 15s minReadySeconds now costs
progressDeadlineSeconds was 60. That is the window a rollout has to show progress before Kubernetes gives up and marks it failed, and the previous commit added ...
Restore this manifest's CRLF line endings
The previous commit rewrote the file with a script that normalised it to LF, which is a whole-file diff for a change that touched a dozen lines. No content chan...
APIService never shut down gracefully at all
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
API-key surface for live call events from a customer PBX
Companion to VoipRecordingUploadController, on a deliberately separate VOIP_CALL_EVENTS scope: uploading a recording after the fact and making somebody's phone ...
Forward /api/email/oauth/callback to EmailService
Google's OAuth redirect target. Same shape as the email and meet provider callbacks beside it: public and sessionless, because the popup lands on this gateway o...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.