Run IBM Granite 4.0 H-Tiny in place of qwen3:4b, on 16 cores
The owner asked for a local model that runs substantially better on k3m1's AVX2-only Xeons (2026-09-27, ruling SP01-LLM-granite4). granite4:tiny-h is a hybrid M...
Bring the worldchunks drive back into use after it drops
On 2026-09-23 the USB earth-tile drive on k3m1 dropped for a second. systemd unmounted it and stopped nfs-server, which nfs-utils makes require every exported p...
Forward the four audience domains' apex + www to www.kamouniverse.com
kamofamily.org, kamobusiness.com, kamopersonal.com and kamocommunity.org are registered and pointed at the cluster. Their apex and www now 301 to https://www.ka...
KamoBusiness, KamoPersonal, KamoCommunity sites; KamoFamily moves to dev.kamofamily.org
Three more audience sites set up like KamoFamily. Each is a Next.js repo edited on GitHub (pantherkamo/<Name>), synced to Forgejo kamo/<name> by a git-sync Cron...
KamoFamily (dev.kamofamily.com): cert, PDB, GitHub sync; auto-cert retries unissued static domains
KamoFamily is a new Next.js site (Forgejo kamo/kamofamily, edited on GitHub pantherkamo/KamoFamily), set up the same way as the KamoUniverse marketing site: - ...
AI extensions route to LiveKit; one recording path on every call; outside-calls list comes from Kamo
The host patch refuses until kamo-asterisk-support's recording subroutine and managed allow-list are on the node (and the list covers the hand-edited one), veri...
Svc_kamoai_voice follows the org pause and the kill switch (KamoAI SP13)
LiveKit server, SIP and Redis on k3m1 for KamoAI voice; signalling route; ports and secrets
The signalling EndpointSlice uses k3m1's node address 10.0.50.1 (k1m1's eno49 corrupts TCP payloads), the TURN secret volume is 0400 (livekit-server refuses a s...
Widen svc_kamoai for the KamoAI runtime (SP10)
kamoai-service creates and pulls its own KAMOAI_WORK work queue, runs up to four notify shards (kamoai-notify, kamoai-notify-1..3) on EMAIL_NOTIFICATIONS, publi...
Golden image AI layer — Chrome, x11vnc, computer-use-linux, ydotool
Chrome's source is kamo-google-chrome.list, not google-chrome.list: Chrome's postinst (154.0.8037.57) migrates a google-chrome.list into its own google-chrome.s...
The agent runs the AI workstation profile when cloud-init asks for it
The agent loads kamo_hc_ai only for KAMO_HC_PROFILE=AI_WORKSTATION: the AI's paths on 9810 behind the agent bearer, the MCP bridge on 9811, the AI's activity re...
AI workstation profile applier, screen guard, software kit and runtime
MCP bridge from the Tool Plane to computer-use-linux
Streamable HTTP on 9811 (JSON answers only, GET 405, Origin 403, per-wake bearer 401, take-over 409) in front of one stdio computer-use-linux child per session....
AI workstation agent module — renderers, MCP token, lease, VNC passwords
The guest half of SP11's AI profile: the files the profile writes (LightDM autologin at 1280x800, kiosk, x11vnc and ydotoold units, Chrome wrapper and managed p...
The PBX speaks through Kamo Speech — kamo_tts.agi, Piper norman at 8 kHz, key from a secret volume
Mirror GitHub kamouniverse main to Forgejo so a merge deploys
The KamoUniverse marketing site is now edited on GitHub GitHub, and PRs merge there. But the site deploys from Forgejo (kamo/kamouniverse-marketing), whose work...
Certificate and disruption budget for dev.kamouniverse.com
dev.kamouniverse.com is the new KamoUniverse marketing site (repo kamouniverse-marketing; it carries its own Host() IngressRoute in namespace kamo). The kamouni...
Dovecot pushes mail events to EmailService (Lua push_notification); stop logging secrets
The default user may only PING
SP00 stage R3. Persists the runtime rule for a future start of redis-0: default keeps nopass for the unauthenticated readiness probe and may run PING and nothin...
Kamo Speech's registry facts and its registration through AIService's internal registry
The last wait needs VERIFIED to hold for 120 s. An attestation itself writes VERIFIED and #36 carries no probe time, so a first VERIFIED read cannot tell SP01's...
A live probe of every Kamo Speech capability, with a four-stream load check
The probe runs inside the pod and prints one JSON document for register.py: a TTS round trip per voice and language (recall >= 0.8), the batch STT row, a realti...
Kamo Speech on k3m1 — pinned Speaches, read-only models, DNS-only egress
Keys and NetworkPolicies on in-cluster inference; Kamo reranker and Kamo Local LLM
TEI embeddings and the new cross-encoder reranker require TEI_API_KEY; bergamot, LibreTranslate and the new Kamo-owned Ollama (qwen3:4b) sit behind the Kamo aut...
Pinned, hash-verified model fetch and a warm-up that holds the pod until every model is resident
The warm-up also drops a model whose load failed: Speaches 0.9.0-rc.3 keeps the entry of a failed load, so the next startupProbe would get 409 and /api/ps would...
Svc_ai publishes ai.registry.changed.> (KamoAI SP01 registry events)
Svc_security publishes kamoai.platform.state, svc_kamoai subscribes to it (KamoAI SP02)
SecurityService announces the platform AI kill switch on kamoai.platform.state and KamoAI Service listens for it. rt.org.<org>.ai-workforce needs no new grant: ...
Log in to Redis as mail_rspamd
rspamd reads its password from Secret mail/rspamd-redis-auth, included into local.d/redis.conf. The pod gains fsGroup 11333: the image runs as 11333:11333 and a...
ACL users for the platform, rspamd and operators (default still open)
Start a coder session in the cloud from a local checkout
repository. The bundle is forced because our remotes are Forgejo, not GitHub, and the point is the checkout on this disk. No --permission-mode (the CLI drops by...
Add kamouniverse.com as a second regular-mail domain
Adds kamouniverse.com to postfix's virtual_alias_domains with a local-part-preserving regexp so any address on it lands in the identical kamocrm.com mailbox (no...
Forward kamouniverse.com to kamocrm.com
DNS for the apex and www now point at k1m1's public IP. Add a redirectRegex route on both entrypoints (301, path/query preserved, ACME challenge path excluded o...
An org's own computers host gets a certificate and a route
computers is a standard alias now — every white-label org is told to point one at Kamo on /setup/dns, the way it points meet and sign — so two things had to fol...
Issue and mirror the certificate for computers.kamocrm.com
Opening a Hosted Computer produced a browser tab that appeared and vanished. The launch link is correct and so is the token: SecurityService builds ************...
A way to actually build the golden image
build-golden-image.sh said "Run by CI (see ../../.forgejo/workflows/)". No such workflow was ever written. It needs libguestfs, qemu-img and virt-customize, non...
Per-org VM islands, suspend-to-disk, and a white-labeled golden image
A member's own Linux computer, running as a KubeVirt VM in its organization's namespace and opened from the browser. Separate from desktop/ in every way that ma...
Encode the kamo14 reel
The marketing reel was recut (new closing logo shot) and uploaded as public/kamo14.mp4. It gets a new name instead of replacing kamo13 in place because the ladd...
Bounces for organizations' sending domains reach EmailService through postfix-k3m1-inbound
A campaign sent through the shared relay has its From at the organization's sending domain as its envelope sender, and that domain is a CNAME to contact.kamocrm...
Postmaster@ and abuse@contact.kamocrm.com reach KamoCRM — the shared relay's name receives its checks
contact.kamocrm.com is the shared org relay's name (47.181.8.86's PTR, MX contact.kamocrm.com), and its MX is 47.181.8.86 → k3m1, where postfix-k3m1-inbound ans...
Postfix-orgs, the shared bulk relay every organization sends through as 47.181.8.86
KamoCRM's own campaign mail keeps leaving through postfix-bulk (47.181.8.87) and regular mail through postfix (47.181.8.84). Every other organization's campaign...
Sign Feedback-ID in DKIM signatures
Gmail counts a campaign message toward its Feedback Loop only when the Feedback-ID header is covered by the sending domain's DKIM signature. local.d/dkim.conf k...
Receive postmaster@/abuse@stack.loans on k3m1 for the bulk IP's checks
47.181.8.87's reverse DNS is mail.stack.loans and the router forwards its port 25 to k3m1, but nothing there accepted mail, so a provider verifying who runs the...
Route fbl@/abuse@hello.kamocrm.com complaint reports to EmailService
Spam-complaint feedback-loop reports (ARF, RFC 5965) and abuse reports sent to fbl@ and abuse@hello.kamocrm.com are rewritten to complaints-mail.invalid and han...
Mail to unsubscribe@hello.kamocrm.com reaches EmailService
Every bulk and shared-article message offers an unsubscribe by email (List-Unsubscribe mailto), but mail to that address went to postmaster and was never acted ...
Postfix-bulk accepts any sender from EmailService [skip ci]
The relay is now a platform outbound host that every organization's campaign mail may go through, as whatever From that organization sends as. Only the null sen...
Sign hello.kamocrm.com with its own customer key, by the From domain itself
Campaign mail leaves as hello.kamocrm.com through postfix-bulk. It gets its own DKIM key (selector customer, published as customer._domainkey.hello), and use_es...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.