Try older Dovecot Alpine image to avoid strict config requirements
- Switch from dovecot/dovecot:latest to dovecot/dovecot:2.3.21-alpine - Older version may not have strict dovecot_config_version requirement - Keeps all databas...
Dovecot config iteration - simplified further
- Removed problematic includes and dict blocks - Simplified to minimal configuration - Note: The official dovecot/dovecot image has strict config requirements
Simplify Dovecot config - remove problematic version include
- Remove dovecot-version include that was causing errors - Use simpler configuration with just protocols and protocol includes - Restarted Roundcube pod to trig...
Fix Dovecot version requirement and create roundcubemail database
- Dovecot: Add dovecot-version.conf.ext include (required as first setting) - MySQL Job: CREATE DATABASE roundcubemail before granting permissions - Fixes 'The ...
Simplify Dovecot config and fix MySQL permissions job
- Dovecot: Use single complete dovecot.conf instead of conf.d fragments - Dovecot: Simplified configuration with minimal working setup - MySQL Job: Use root cre...
Fix Dovecot configuration and add permissions job to CI/CD
- Dovecot: Move passdb/userdb config directly into 10-auth.conf - Dovecot: Remove problematic auth-sql.conf.ext include - CI/CD: Add mysql-permissions-job.yaml ...
Fix Dovecot auth syntax and Roundcube database permissions
- Dovecot: Fix auth-sql.conf.ext syntax - passdb/userdb need section names - MySQL: Grant ALL PRIVILEGES on roundcubemail database to kamo user - Add mysql-perm...
Fix Dovecot and Postfix configurations to resolve CrashLoopBackOff
- Dovecot: Use conf.d structure with official Dovecot image defaults - Dovecot: Split config into individual files (10-auth, 10-mail, 10-master, 10-ssl) - Postf...
Fix kubeconfig setup in CI/CD to use Tailscale IPs directly
- Replace sed commands with kubectl config set-cluster for reliable connection - Use 100.64.1.1 for K1M1 and 100.64.2.1 for K2M1 directly - Fixes 'dial tcp 100....
Add complete mail server infrastructure with Postfix, Dovecot, Roundcube, and MySQL
- Deploy mail server (MySQL, Postfix, Dovecot, Roundcube) to K1M1 only - Configure HTTPS access via Traefik at https://mail.kamocrm.com - Set up multi-domain su...
Update Janus TURN server configuration to use kamocrm.com:3478
Add Janus WebRTC Gateway configuration documentation - Document current Janus configuration on k1m1 - Add configuration reference files for Janus setup
Revert "fix(traefik): disable idle timeout for WebSocket connections"
This reverts commit ****************
Disable idle timeout for WebSocket connections
- Added idleTimeout=0 to websecure entrypoint - Prevents Traefik from closing WebSocket connections due to inactivity - Fixes SockJS WebSocket timeout issues
Update TURN server credentials with secure values
- Updated turn-secret with secure random value - Updated turn-password for Janus authentication - Credentials match MediaService WebRTC configuration
Split port ranges to avoid conflicts
- Coturn relay: 52000-65535 (13,536 ports) - Avoids: Janus RTP (10000-49151) and WireGuard (51820-51821) - No overlap between services
Adjust relay port range to avoid WireGuard/VPN ports
- Changed max-port from 65535 to 51800 to avoid conflicts - Avoids WireGuard on UDP 51820 and other VPN services on 51821 - Provides 2,649 ports (49152-51800) f...
Resolve CrashLoopBackOff by fixing probes and config
- Replace netstat-based health probes with TCP socket checks (netstat not available in coturn/coturn:latest Alpine image) - Remove conflicting no-stdout-log dir...
Add ServersTransport deployment to CI/CD workflow
Deploy traefik/serverstransport.yaml as part of Traefik deployment to both K1M1 and K2M1. This enables HTTP/1.1 backend connections for MediaService WebSocket s...
Add ServersTransport for MediaService WebSocket connections
Add media-websocket-transport ServersTransport resource to disable HTTP/2 for backend connections to MediaService. This is required for proper WebSocket upgrade...
Add Connection: Upgrade header to WebSocket upgrade middleware
- Add Connection: Upgrade header along with Upgrade: websocket - Both headers are required for proper WebSocket upgrade handshake - This ensures HTTP/2 Extended...
Add media-websocket-upgrade middleware to force Upgrade header
- Add Upgrade: websocket header for WebSocket paths to fix HTTP/2 Extended CONNECT conversion - This ensures HTTP/2 WebSocket upgrade requests are properly conv...
Add media-cors middleware for media domain CORS support
- Add media-cors middleware matching theme-cors configuration - Allows CORS headers to be set for media.{domain} requests
Add 'media' subdomain to auto-cert SUBDOMAINS for MediaService
- Add 'media' to SUBDOMAINS list in auto-cert-service.yaml - Enables automatic SSL certificate generation for media.{domain} subdomains - Required for MediaServ...
CoTurn (Including the last deployment with from title) configuration scripts added
CoTurn (Including the last deployment with from title) configuration scripts added
CoTurn (Including the last deployment with from title) configuration scripts added
Use TLSStore for dynamic cert management (survives CI/CD deployments)
Certificate export/import with locking for true multi-cluster cert sharing
Enable JSON access logging in Traefik for auto-cert domain detection
Skip CockroachDB init if job failed (cluster already initialized)
Add webhook wait and sleep to ensure cert-manager is fully ready
Move ClusterIssuer to auto-cert folder, remove duplicate deployment steps
Add cert-manager and Let's Encrypt ClusterIssuer to deployment workflow
Strip HSTS header from MinIO responses to prevent forced HTTPS
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.