SecurityService may consume BILLING_EVENTS (marketing sites follow billing.subscription.*)
Apply marketing/ from deploy-services like every other folder
A "Deploy Marketing Sites namespace" step runs marketing/apply.sh (namespace kamomarketing, marketing-ci and site-edge RBAC, Middlewares, secrets created-if-mis...
Record the 2026-10-30 public-IP hand patches so a full reconcile keeps them
coturn, MediaMTX, FreePBX (kamo-meet ACL + fail2ban) and KamoPBX were switched to k1m1's eno1 addresses 76.81.227.154/.155 by hand on 2026-10-30, and dovecot-im...
A prepared hand-off can start in a marketing site's checkout, with a WEB-<n> folder
~/Kamo/Marketing/<repo> on first use, through sage's own credential store), cwd (absolute, bounded to the home after resolving links) and workPrefix (BUG defaul...
Only known preview hosts under the wildcard sites.kamouniverse.com zone
*.sites.kamouniverse.com resolves here (wildcard A), and kamouniverse.com is an always-allow apex, so any scanner label or browser-only sibling ****************...
Namespace kamomarketing for org marketing sites
- marketing/: namespace, SA marketing-ci (Role limited to kamomarketing, long-lived token), SA site-edge (IngressRoutes only), the edge's middleware chain wit...
Svc_site_edge login (subscribe marketing.site.changed); SecurityService may publish it
The marketing sites edge (kamomarketing/site-edge) refreshes its routing table when SecurityService announces a site change. Subscribe-only, publishes nothing; ...
MediaService may hear antivirus.content.settled (held chat attachments clear live)
ConversionService publishes a core event when a held upload's check finishes; MediaService consumes it in a core queue group and fans the new attachment state o...
DocsService may hear antivirus.hold.verdict (core queue, held legal uploads)
A requested-document upload held while Antivirus was busy is finished by DocsService the moment its hold is judged. Core subscription only: DocsService keeps Je...
Public MLOS vendor webhook routes on the platform API hosts (owner-approved)
POST-only, full-path regexes on api.kamouniverse.com / api.kamocrm.com, straight to their services: **************** -> kamomlosvendor-service and *************...
Svc_commission login (publish compliance.event.>), DocsService may hear compliance events
Compliance Requirements (2026-11-07): CommissionService announces commission.credited and **************** on core NATS; DocsService subscribes to compliance.ev...
KamoAntivirus mail filter first on inbound smtpd (port 25), tempfail when unreachable
smtpd_milters = { **************** default_action=tempfail }, then rspamd unchanged. Harmful attachments are replaced by a small placeholder part and the messag...
Antivirus alerts (scanner down, signatures stale, mirror gate failing, p95, detection spike, hold backlog)
Applied by hand (monitoring/ is not a CI target).
Svc_antivirus login + ANTIVIRUS stream; conversion/email may consume antivirus.>
- svc_antivirus: STREAM.INFO/CREATE ANTIVIRUS, publish antivirus.> and rt.org.>, subscribe antivirus.> and _INBOX.> (Secret kamo/nats-user-antivirus, SECRETS....
Let DocsService reach ocrservice for the legal SI pre-check
Legal & Compliance reads uploaded documents with Kamo OCR to give reviewers suggestions (organizations with the SI app on only). Adds the kamowsdocs pod label t...
SI infrastructure alerts, and LiveKit alerts page the SI on-call people (SIE1)
**************** (applied by hand, restarts nothing): a blackbox Probe of jicofo, prosody, the meeting ear, FreePBX's console, the Tool Plane, aiservice and kam...
Let SecurityService read Forgejo's CI statuses for Live Changes
The Live Changes deployment tracker asks Forgejo (a host process on k1m1, port 3000) where each push is in its pipeline. avatar-resolver-egress allowed only Yug...
Rke2-unwedge, a watchdog for the rke2 log-pipe deadlock
The 2026-09-28 and 2026-10-25 platform outages were the same deadlock: rke2 loses its lease, its ExecStopPost kills containerd, nobody reads the container log F...
Detach k1m1's NFS mount while k3m1 is not serving it
The worldchunks USB drive dropped off k3m1 on 2026-10-30 and has not come back, so nfs-server stopped. k1m1 kept its soft mount on the assumption the server ret...
Alert on node link drops and speed fallback, routed to sysadmin email
The LAN switch shared by k1m1 eno49 and k3m1 eno49 has been resetting since 2026-10-29 (hundreds of carrier drops, 66 of 70 drop minutes shared by both nodes, k...
Live sales floor events reach open screens
svc_voip and svc_daemon may publish rt.org.>, so a call the phone system reports and a lead a job creates reach the board at once. New svc_automation login, cor...
Relay for an org domain whose SPF names us
An org that set up SPF correctly was refused by the relay's sender rule, so its NoReply mail fell back to the platform address. EmailService lists those domains...
An alias domain's senders may relay, and drop the dead Mailgun password
EmailService sends over port 25 from mynetworks without signing in, and relay_sender_domains refuses anything but kamocrm.com and kamouniverse.com with a 451. E...
V1.13.10, a room reaper and leak watchdog, metrics and alerts, no roll under live calls
livekit-server v1.13.7 kept 202 closed participants of 176 closed rooms alive (their publisher transport's StreamAllocator polled a closed ICE agent every 15 s,...
ICE on k3m1's LAN address only, so SIP legs stop resuming every 15 s
livekit-sip's same-host WebRTC legs to livekit-server failed ICE 15 s after connecting (the server's 10 s disconnected + 5 s failed timeouts) and resumed in a l...
Postfix learns alias domains from the mail database
An organization's alias domains (Settings -> Email -> Domains) used to need virtual_alias_domains and a hand-written map edited here. EmailService now keeps an ...
Re-run the deploy now that kamomeet-ear carries its preStop hook (run 352 audit)
Every meeting occupant's identity is its own verified session's (mod_kamo_presence_identity)
TPMEETAUTH (owner order 2026-10-26): the SI's ear reads who each endpoint is from its presence identity. The stock presence_identity strips a client's own <iden...
Four streams of four threads, and a lane that keeps one free for chat
Measured on the nodes' CPU class with the dictionary sync's own traffic (15-key chunks): one stream of eight threads did 1.5 keys/s, two of eight 1.8, four of f...
Write Romanian with comma-below s and t
The model mixes the legacy cedilla forms into Romanian (6 of 90 such letters in the chat widget's regenerated file) and the dictionary's earlier Romanian did to...
Drop the old engines' deploy steps, apply MADLAD's alias Services, update audit and docs
Completes 56b37fa, which removed the manifests: without this the workflow still ran steps for directories that no longer exist. The workflow now applies madlad/...
Remove LibreTranslate, Bergamot and IndicTrans; MADLAD serves every pair
TranslateService speaks only to madlad now (translateservice 5c7605b), verified end to end: every Kamo locale including Tamil and Swahili, inbound ru->en and ta...
Beam 4 only for labels, beam 2 up to 64 tokens
Cost is tokens x beam. Measured in the cluster with the old engines still running: one stream 77 chars/s and two 115 chars/s on short strings at beam 4. Sentenc...
One translation engine for every pair, MADLAD-400-3B on CPU
Replaces LibreTranslate (Argos), Bergamot and Kamo IndicTrans, whose language sets did not overlap and whose gaps came back as English. MADLAD-400-3B-MT (Apache...
Memory limit 14Gi -> 20Gi, request 10Gi -> 12Gi
Seven-day peak working set was 13.8 and 13.1 GiB against the 14Gi limit, so the kernel reclaimed the mmapped argos models and en->ru on a help article paid cold...
Svc_iot may subscribe to iot.live.device.> — the IoT production canary watches its own live frame (SP14)
Desktop alerts go by e-mail only; the MediaService chat leg is gone
Owner, 2026-10-20 (IoT close-out F12): no chat sender. A chat thread needs a sender member besides the recipient and the platform organization has none by desig...
The deploy-safety audit accepts a reasoned 'spread' exemption for a node-pinned Deployment
Every KlusterServices deploy since run #337 ended red on kamoai-voice (3 replicas pinned to k3m1 by nodeSelector, so no hostname spread is possible). The rule h...
Kamo_app is a NOLOGIN group role; services log in as kamo_app_202610
The YugabyteDB application password was exposed (com.zaxxer.hikari DEBUG in ten services' logs, and securityservice's committed diagnose-output.txt), so it was ...
Probe only www.kamocrm.com; the platform's surfaces are on kamouniverse.com
kamocrm.com is a marketing site only (owner 2026-10-18). The blackbox prober is now deployed, and apply.kamocrm.com was already failing its probe; the kamocrm.c...
Never seed devices. anywhere under kamocrm.com
ccd50be skipped the devices sibling only when the parent WAS kamocrm.com, so a child-org web alias host **************** seen live) still queued ***************...
The proxy settings live in HA's storage, promoted, not in YAML
Since 2026.10, Home Assistant migrates a YAML `http:` to its storage once, as a PENDING config. It reverts that config and restarts unless an admin promotes it ...
A Home Assistant lab instance at home.kamouniverse.com
One Home Assistant 2026.10.2 (digest-pinned) for IoT testing of Kamo's HOME_ASSISTANT connector and for the owner's own use under the HA account sajon. The demo...
Set the Google Trust Services EAB key id (IoT SP09 B1)
The gts-prod ClusterIssuer's external account binding names key id **************** from Google Cloud Public CA (project kamocrm-1755458510147). The HMAC key is...
The share host is devices.<domain>, and nothing on kamocrm.com
Owner 2026-10-18: "iot" is a technical term, so the customer-facing host alias for kamo-iot is `devices`, and kamocrm.com is a marketing site only. auto-cert do...
Iot.relay.> — svc_iot publishes, svc_media subscribes (IoT SP10)
The Google Home relay wakes the phone that holds a connection's lease: IoTService publishes a content-free frame on iot.relay.{connectionId} and MediaService fo...
Google Trust Services issues the platform login host's certificate (IoT SP09)
Amazon's account linking refuses Let's Encrypt, so login.kamouniverse.com alone moves to a gts-prod ClusterIssuer (ACME with External Account Binding); every ot...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.