Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Migrate to k1m1 (registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Simplify kubectl install in deploy job (complex cache-find step was failing the deploy)
Gate KamoUniverse launcher on ACCESS_KAMOWORLD right alone (drop org games flag)
Migrate to k1m1 (dictionary from k1m1, drop k2m1 deploy, pin k1m1 registry image)
KamoUniverse launch card + nav icon (gated ACCESS_KAMOWORLD, OTK redirect to play.*)
Add ACCESS_KAMOWORLD right (145, GAMES) for KamoUniverse access
Resurrect on k1m1 — shared-lib from k1m1:3000, drop dead k2m1 deploy, pin k1m1 registry image
Backup verified working — DB-scoped backup, MinIO region us-west-ca-s-1, EXTERNALIOIMPLICITACCESS grant in bootstrap
Drop WITH revision_history from backup (enterprise-only); core BACKUP is OSS
node-config: document k1m1 forgejo-runner config (--add-host for submodule DNS)
Job containers on k1m1 fall back to public DNS, so the fleet-swept http://k1m1:3000 .gitmodules URLs fail to clone there. Pin k1m1 into job containers via conta...
node-config: document k1m1 docker daemon insecure-registries
The k1m1 forgejo-runner's builds push to the HTTP Forgejo registry; the daemon.json shipped with only the :5000 entries, so every build job landing on k1m1 fail...
K1m1 image registry replacing retired k0m1:5000 (same credentials)
Loki 6.x SingleBinary needs zeroed scalable targets; crdb exec via localhost (cert SANs)
Kamo-universe namespace+quota+valkey, CockroachDB backups, observability stack
- universe/: namespace + ResourceQuota, valkey-universe (AOF, hostPath k1m1), nightly CockroachDB backup CronJob, operator bootstrap script - monitoring/: pin...
Join shared two-node cluster with k3m1 over LAN; account isolation
Retire WireGuard routes (10.8.x.x) for LAN routes (192.168.4.22 <-> 192.168.4.36 :6222) with creds embedded in the route URLs. Rename cluster to kamo-ratestack-...
Add k3m1 node + migrate cluster peering to LAN IPs
- statefulset: advertise/join over 192.168.4.x (k1m1=.22, k3m1=.36); WireGuard dropped (k3m1 wg0 10.8.0.1 collided with k0m1's advertise IP). - init-job + CI ...
Route paid signups to checkout after login
After successful auth (manual or auto-login), consume the apex-domain sp_checkout_plan cookie left by kamo-register and redirect the buyer to the brand /subscri...
Carry paid ?plan from signup into checkout
When a member signup originates from a paid pricing CTA (?plan=pro|business), drop an apex-domain sp_checkout_plan cookie on completion. kamo-login consumes it ...
Wire internal-auth secret from ***
ESigService now validates X-Internal-Auth against the same shared secret APIService presents **************** from the *** k8s secret), hardening the programmat...
Rebuild for kamo-shared-library update (esign signer email templates)
Picks up the new canonical templates esign.signer_verification + esign.signer_invite so seedForOrg can seed them on first send.
Canonical e-sign signer templates (verification + invite)
Add two platform-wide canonical email templates seeded lazily per org: - esign.signer_verification (step-up OTP: {{code}}, {{name}}) - esign.signer_invite (sign...
Register esign repositories for the meter submission bean
EsignMeterSubmissionService needs EsignUsageRecordRepository, but @EnableJpaRepositories didn't scan com.kamo.z.shared.esign.repos, so the context failed to sta...
E-sign usage metering + consumer self-serve checkout
#4 metering: - EsignMeterSubmissionService (@Scheduled daily): aggregates API-origin EsignUsageRecords per org+period; first 40/period included, the rest subm...
Expose API_SIGNATURE (E-Signature API) key scope
Add the E-Signature API scope to the org API-key manager so staff can grant Business orgs programmatic e-sign access. Usage beyond the included monthly allotmen...
Public programmatic e-sign API gateway (API_SIGNATURE scope)
Add /api/public/esign/** to PublicApiController: validates the org API key, requires the API_SIGNATURE scope, rate-limits, and forwards to ESigService's interna...
Internal programmatic envelope API (origin=API) for Business
- EsignInternalController (/api/esig/internal/*): X-Internal-Auth + X-Org-Id authed, called by APIService after it validates the API_SIGNATURE-scoped key; r...
API_SIGNATURE api-key scope + EsignGenericEnvelope.origin
Additive, no version bump: - ApiKeyScope.API_SIGNATURE — gates the programmatic e-signature API (Business) - EsignGenericEnvelope.origin (EsignUsageOrigin, null...
Send-for-signature action + envelope status in document editor
Add a 'Send for signature' button to the template editor header that opens a dialog to send the document to recipients and track signing status, calling the new...
Generic envelope create/send engine (sender side)
Add the OTK-authed /api/esig/envelopes API kamo-internal drives to send documents for signature, reusing the same shared-lib entities the public signing API rea...
Public signing API engine for sign.sign.pink
Implement the /api/esig/public/* signing API the kamo-signer app calls, turning the live signer from preview-stub into a working backend. - validate (recipient...
Back metered add-on prices with a Billing Meter
Stripe (>= 2025-03-31.basil) rejects the legacy usage_type+aggregate_usage metered model ('metered prices must be backed by meters'), so USAGE_BASED add-on pric...
Platform product toggle in Organizations tab
Surface the platform-product designation where it belongs — Platform → Organizations. Adds a gated Switch per org (disabled for the top-level org), a confirmati...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.