Live Change Log

postfix-lmdb is not a valid Alpine package; lmdb support is built into the base postfix package. The pod was CrashLoopBackOff due to apk failure.

CronJob runs every Sunday 3am, privileged, pinned to k1m1. - crictl rmi --prune removes unused container images - nsenter journal vacuum enforces 500MB cap - CI...

- Docs: fix wrong image registry (redis.kamo.svc... → **************** add Recreate strategy - coturn: add Recreate strategy to prevent rolling update port conf...

Alpine postfix build does not include hash support — postmap and smtp_sasl_password_maps were silently failing, deferring every outbound relay attempt through s...

With the default "Cluster" policy, kube-proxy SNATs external traffic to the node IP before forwarding to Traefik. That caused Traefik to see the node IP as the ...

Kamo Analytics uses this URL to look up visitor IP→country/region/city from the **************** tables. Uses kamo user with password auth and sslmode=require (...

Delete old analytics deployment, service, and ingressroute that conflict with the kamo-analytics deployment managed by its own CI/CD pipeline.

Set X-Frame-Options to empty string to remove the SAMEORIGIN value that was being inherited, allowing CSP frame-ancestors to control iframe embedding instead.

Add security-headers-allow-iframe (no X-Frame-Options) and kamo-middlewares-allow-iframe chain so analytics can be embedded in iframes from internal.kamocrm.com...

- Remove analytics deployment, service, and nginx-configmap (now owned by kamo-analytics project with its own CI/CD pipeline) - Remove analytics-ingressroute ...

React re-applies RSC payload after hydration, resetting the title to "analytics". Add a title check inside the MutationObserver callback so it gets corrected ev...

The workspace nav title "analytics" comes from JS bundles loaded after auth, rendered as a text node next to the logo SVG. Uses TreeWalker to find and clear all...

Login page and dashboard content is rendered by Next.js JS bundles, not in the HTML body, so sub_filter can't reach it. Adds a script with a busy-flag-guarded M...

- Serve favicon via nginx 302 redirect instead of trying to rewrite HTML/RSC payload href strings (cleaner, always works) - Fix RSC title replacement with pro...

MutationObserver caused infinite loop (DOM change -> observer fires -> DOM change). Switch to direct nginx sub_filter string replacements targeting both static ...

- Replace title dynamically (handles "Login | analytics", "Dashboard | analytics" etc.) - Replace "analytics" h2 text on login page with Kamo logo image - Repla...

analytics is a Next.js app that sets title/logo via JavaScript after initial HTML load. Replaces static sub_filter approach with injected script that uses Mutat...

Adds nginx sidecar proxy that injects CSS to replace the analytics logo with KamoCRM logo, changes the page title to "Kamo Analytics", and overrides the favicon...

- New analytics/ directory: PostgreSQL StatefulSet + analytics deployment, services, and secret template - **************** routes analytics.kamocrm.com → analy...

The service crashes on startup if it finds a directory in /models that has missing or partial model files. Add a sweep at init start that removes any directory ...

GitHub raw URLs return LFS pointer files, not actual binaries. Drop enru/enar downloads entirely — LibreTranslate handles those locales. Only download the 4 pai...

- replicas: 1 - Init container (alpine): downloads 4 pairs from data.statmt.org (tarballs for enes/enfr/ende/enpl) and 2 from firefox-translations-models GitH...

The Google Cloud Storage model download bucket (bergamot-models-sandbox) returns 404 for all files and the firefox-translations-models repo was archived Dec 202...

Bergamot was at 0 replicas with its service still registered. The ProviderRouter in TranslateService had no circuit breaker, so every request for es/fr/de/pt/it...

All needed language packages are pre-installed on the hostPath volume. --load-only was preventing some packages from loading. Without the flag, LibreTranslate l...

startupProbe with 60 attempts x 30s = 30min startup window for initial model downloads. After startup completes, normal liveness and readiness probes take over ...

Use --load-only with the 22 supported language codes instead of downloading all available models (~hundreds of GB). Removes --update-models flag which would dow...

Flag does not exist in current libretranslate image. Replace with --update-models to ensure language packs are downloaded on startup.

LibreTranslate was crashing with PermissionError on packages subdir. Added busybox init container to mkdir + chmod 777 the mounted hostPath before the main cont...

The manifests were committed but never wired into the deploy steps. Add kubectl apply for both services on K1M1 and K2M1.

When a push triggers a workflow and workflow_dispatch is also fired (or two pushes arrive in quick succession), both runs would execute simultaneously. Adding a...

Was 10.8.1.1 (Wireguard private) — guests' browsers can't reach this. Changed to 75.83.113.11 (public IP). This is why guests kept getting ICE restarts every ~1...

The MUC token_verification module re-validates tokens and demotes guests from PARTICIPANT to VISITOR after ~60 seconds, causing Jicofo to kick them. The module ...

Guests authenticate via Meet-anonymous on guest.meet.Meet but the MUC token_verification module was re-checking them and demoting their role from PARTICIPANT to...

Jicofo's AbstractAuthAuthority has a hardcoded 1-minute auth session lifetime that ignores the config file setting. After 60 seconds, Prosody demotes participan...

Both Jicofo and JVB Docker images append @XMPP_INTERNAL_MUC_DOMAIN to the brewery room name automatically. Using full JIDs like **************** caused double-d...

JVB's REST API port 8080 conflicts with CockroachDB's admin UI on the same hostNetwork. The JVB_OHTTP_SERVER_PORT env var is not recognized by this JVB image ve...