feat: add ChirpStack Cloudron package (Infrastructure) [#668]

ChirpStack 4.19.1 (LoRaWAN network server) as the 14th package: official-image wrapper, digest-pinned, with only bash added to the upstream alpine runtime. Native OIDC login wired to the Cloudron platform provider (openid_connect backend, config regenerated every start); postgresql + redis addons; diesel migrations auto-run. Operator config (NetID, US915 region, gateway MQTT backend) lives in seeded files under /app/data/config. Build green; config generation validated through chirpstack's own TOML parser. Docs gardened to 14 packages. Ticket: https://projects.knownelement.com/issues/668 💘 Generated with Crush Assisted-by: Crush:glm-5.2
2026-09-01 19:55:23 -05:00
parent 10e2b7c7ed
commit 0d7543704b
11 changed files with 570 additions and 11 deletions
@@ -0,0 +1,51 @@
+# ChirpStack Cloudron Package
+#
+# ChirpStack is an open-source LoRaWAN network-server: web UI + gRPC/REST
+# API on a single port, PostgreSQL for storage, Redis for sessions /
+# deduplication / OIDC state, and an external MQTT broker for gateway
+# connectivity and integrations (configured per region, not embedded).
+#
+# Upstream: https://github.com/chirpstack/chirpstack
+#   - Official Docker image chirpstack/chirpstack:4.19.1 (alpine, single
+#     static musl binary /usr/bin/chirpstack, upstream runs it as
+#     nobody:nogroup with ENTRYPOINT /usr/bin/chirpstack)
+#   - Takes a config DIRECTORY via `chirpstack --config <dir>`; every *.toml
+#     in it is concatenated (tables must not collide across files) and
+#     ${ENV_VAR} placeholders are substituted
+#   - DB schema migrations (diesel, embedded) run automatically at startup
+#     and seed an internal `admin` user
+#
+# Authentication: NATIVE OIDC (preferred). start.sh regenerates
+# /app/data/config/10-cloudron.toml on every start, wiring the Cloudron
+# platform OIDC provider (CLOUDRON_OIDC_ISSUER / CLIENT_ID / CLIENT_SECRET)
+# into [user_authentication.openid_connect]. CHIRPSTACK_AUTH_MODE=internal
+# is kept as an operator escape hatch for admin bootstrap only (see README).
+#
+# Pattern: official-image wrapper. Building the Rust workspace + pnpm UI
+# from source is a multi-GB compile; the upstream image is the supported
+# distribution channel. Image pinned by tag AND digest (amd64 manifest
+# digest of the 4.19.1 tag, verified via docker manifest inspect).
+FROM chirpstack/chirpstack:4.19.1@sha256:c749015e640b8cf33338c08b12922896b17636feb06e421abdd3cc80f1cdc6b9
+
+# bash is the only addition: start.sh uses it for the addon wait loops
+# (bash /dev/tcp) and TOML generation. Kept as root only for apk; the
+# runtime user stays the upstream nobody:nogroup.
+USER root
+RUN apk add --no-cache bash
+
+# start.sh waits for the postgresql + redis addons, seeds the persistent
+# config fragments under /app/data/config/ and execs chirpstack.
+# Made executable on the host, not at build time (Cloudron builds hit
+# permission errors on RUN chmod).
+COPY start.sh /app/start.sh
+
+WORKDIR /app/data
+
+# Cloudron exposes the web UI / REST / gRPC on this port (api.bind in the
+# generated config). No other TCP listener is enabled by default: gateway
+# connectivity is outbound MQTT to an external broker.
+EXPOSE 8080
+
+USER nobody:nogroup
+
+ENTRYPOINT ["/bin/bash", "/app/start.sh"]