God eligibility alone passes CONFIGURE_SYSTEM only in the platform org; elsewhere only an open window (IoT R7 round 3)
**************** let GD (eligibility, no window) pass every tenant right in every org, so the System User held CONFIGURE_SYSTEM (organization sounds) in every t...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
**************** read GD && godModeActive itself. SecurityService masks an elapsed 30-minute break-glass window only for its own gates, so this service, reading...
A blank internal secret answers 503 on /transcribe too
/transcribe answered 403 when **************** is not configured; master §7 item 13 asks 503 of every internal endpoint, which its sibling /transcribe/detailed ...
Silence is never sent to the speech service, and no chunk reaches 30 s
Kamo Speech (Speaches) answers 500 'No clip timestamps found' for a chunk of 30 s or more in which its VAD finds no speech (faster-whisper's no-VAD path refuses...
Claim a staged recording before processing it, so a long call is never stored twice
DaemonService hands ConversionService every row that is still unprocessed: on its poll tick, on every voip.recording.received message (which does not wait for a...
Logo-variants runs ffmpeg single-threaded, one logo at a time
The first boot backfill OOM-killed BOTH ConversionService pods (23:04:39 and 23:05:47Z): a 3919x1373 PNG logo and a 4096-wide seeded SVG. ffmpeg gives every fil...
A meeting recording no longer passes through heap, and a long one no longer times out
/transcribe read the upload with getBytes() on a 2Gi pod, and a meeting recording runs past a gigabyte. It now copies the spooled upload to the scratch volume a...
Pin kamo-shared-library 1.6.1, the only version that exists
The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...
Only the platform namespaces can call ConversionService
The public route is gone (28ba91b), but inside the cluster any pod could still reach this service, and several endpoints take no credential because none of its ...
ConversionService is no longer published to the internet
The conversion-api.kamocrm.com IngressRoute sent anyone on the internet to this service, where several endpoints (/image/resize-bg, /favicon/generate, /convert-...
Auth on the endpoints that can take it now, ffmpeg/Batik hardening on the rest
ResourceServerConfig permits every request (this service is reachable anonymously at conversion-api.kamocrm.com), and none of ImageOpsController's or Conversion...
Internal-auth secret comparisons are constant-time and fail closed
TranscriptionController, RecordingIngestController and RecordingProcessController all compared X-Internal-Auth with String.equals (a timing oracle on a shared s...
Accept OCI image indexes when resolving the built digest [skip ci]
The images are pushed as OCI image indexes, so asking the registry for a single image manifest only answered 404, the digest came back empty and the check faile...
Restart when a same-commit rebuild leaves pods on the old digest [skip ci]
The rollout step tried to detect a same-commit rebuild by comparing the Deployment's image reference before and after `set image`. "Apply manifests" has already...
Stop an indexed source turning the tab icon into a black box
A tab icon uploaded as a transparent PNG-8 arrived in the browser tab as a black square with a ragged logo on it. Measured on the upload that exposed it: of the...
Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Gate platform uploads on MANAGE_PLATFORM_SOUNDS, not org ownership
An operator granted "Manage Platform Sounds" on the Platform Administrators page saw the Sounds tab — the console gates on the right — opened the upload dialog,...
Uploading a file takes CREATE_DOCUMENTS, like every other way of making one
The document rights are enforced in DocsService as of this change, but the upload endpoints are not in DocsService — kamo-internal's app/api/imaging/upload prox...
Raise the document upload ceiling from 500MB to 3 GiB
Chat attachments have run at 3 GiB through this same imaging pipeline for a while; documents were capped at 500MB. The difference was not a policy, it was that ...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop renewing the shared *** TTL for idle users
Fifth service holding its own copy of KSessionService, and the fifth sliding the shared *** TTL on every read. Each one alone was enough to keep a session alive...
Use targeted conversion updates instead of saving a detached ImgDat
convertAndGenerateThumbnails runs on a virtual thread with a detached ImgDat, so imgDatRepository.save() merged a stale orphan-removal collection and threw befo...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Require a session on POST /backfill-conversions
The handler was declared backfillConversions() — it took no request at all — under the comment "No auth — internal maintenance, mirrors /backfill-thumbnails". I...
Stop pinning the expired wildcard-kamocrm-com secret
wildcard-kamocrm-com was a legacy multi-SAN secret that cert-manager orphaned when its Certificate was repointed at a per-host secret. Nothing renewed it and it...
A bad assocType index is a 400, not a 500
The upload/register paths indexed ImageAssocType.values() with the client's raw index, so an out-of-range value surfaced as an ArrayIndexOutOfBoundsException (5...
Bound concurrent ffmpeg to prevent OOM under upload bursts
A multi-file upload fires all files at once; each ffmpeg decode allocates the full uncompressed frame, so N concurrent large images blew past the pod's memory l...
Downscale-only (never upscale small images)
**************** scaled small images UP to fill the box (800x600 -> 1440x1080). Compute a concrete downscale factor capped at 1.0 from the probed dimensions ins...
Harden ffmpeg resize (probe safety, dim caps, bomb guard)
Adversarial-review follow-ups on the ffmpeg rewrite: - probeDimensions redirects ffprobe output to a file and calls waitFor() FIRST (destroyForcibly on timeou...
Resize backgrounds via ffmpeg subprocess (crash-isolated)
ImageIO + webp-imageio could native-crash the JVM (SIGSEGV in libwebp-imageio, UpsampleBgraLinePair_SSE2) on certain WebP inputs, taking the whole ConversionSer...
Persist thumb flags via targeted update, not detached save
The image/video/PDF thumbnail steps set thumb flags on a detached ImgDat and called save(), which merges and cascades into the orphanRemoval images collection —...
Stop uploads hanging on 'Converting...' — route NATS progress + direct image thumbnails
The conversion-progress publish used NatsMessageService.publish(), which asserts expectedStream=<this service's stream>. The subject **************** resolves t...
Convert deduplicated documents so e-sign edit is enabled
When an uploaded file's bytes matched an existing ImgDat, the dedup path (register-existing) reused that dat verbatim and never ran the conversion pipeline. If ...
Use cluster MinIO service DNS; drop deprecated WireGuard/CGNAT IPs and retired k2m1/k0m1
Persist conversion_error instead of failing silently
Both the template and regular upload conversion pipelines swallowed Docs conversion failures (logged only), leaving is_converted=false with no recorded reason —...
Enable JPA repos for commerce + email + dao.repositories packages
ConversionService new pod CrashLoopBackOff with the same error DaemonService hit earlier: Parameter 0 of constructor in **************** required a bean of ...
Add @JsonIgnoreProperties to UploadTemplateRequest to prevent hash null on unknown fields
The frontend sends accessLevel, description, folderId, docTypeId in the metadata JSON. Jackson was failing to parse the entire metadata object when encountering...
Expand component scan and add full datasource/JPA/Redis/MinIO config
ConversionServiceApplication was only scanning com.kamo.ConversionService, missing all shared library beans (ImageService, MinIOStorageService, MemberRepository...
Add kamo-shared-library build stage to resolve missing dependency
The Dockerfile was trying to fetch kamo-shared-library from Maven Central, which doesn't exist there. Mirror the SecurityService pattern: clone the shared libra...
Handle image files (JPG, PNG, TIFF, etc.) directly via PDFBox instead of Docs
Docs can't convert images to PDF. Added ImageToPdfService that embeds images into a PDF page using PDFBox. Docs is only used for office document formats (DOC, D...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.