KNEL/KNEL-TSYSDevStack-SupportStack-Cloudron
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add ChirpStack Cloudron package (Infrastructure) [#668]

Browse Source 
ChirpStack 4.19.1 (LoRaWAN network server) as the 14th package:
official-image wrapper, digest-pinned, with only bash added to the
upstream alpine runtime. Native OIDC login wired to the Cloudron
platform provider (openid_connect backend, config regenerated every
start); postgresql + redis addons; diesel migrations auto-run.
Operator config (NetID, US915 region, gateway MQTT backend) lives in
seeded files under /app/data/config. Build green; config generation
validated through chirpstack's own TOML parser. Docs gardened to 14
packages.

Ticket: https://projects.knownelement.com/issues/668

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-09-01 19:55:23 -05:00
parent 10e2b7c7ed
commit 0d7543704b
11 changed files with 570 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
STATUS.md
+10 -7
View File
@@ -3,20 +3,21 @@
> **Human read-only. Agents maintain this file automatically after each work
> session.** Do not edit by hand — the next agent run will overwrite it.
>
> **Last updated:** 2026-09-01 by Crush (GLM-5.2) — FX packaged (#640,
> DevOps-Tools, 13th package); auth gate verdict: no user concept —
> httpAuth proxy gates the landing page (CLI-workstation pattern).
> **Last updated:** 2026-09-01 by Crush (GLM-5.2) — ChirpStack packaged
> (#668, Infrastructure, 14th package); auth gate verdict: native OIDC
> (`user_authentication.openid_connect`) wired to the platform provider;
> postgresql + redis addons, official-image wrapper of chirpstack 4.19.1.
## Current State: STABLE (packaging phase, ongoing)
Cloudron packaging pipeline is operational. 13 of ~57 upstream applications are
Cloudron packaging pipeline is operational. 14 of ~57 upstream applications are
packaged, committed, and pushed. Packaging templates exist for the core
patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
All remaining apps now carry build tickets (#633-#678) under umbrella
[#632](https://projects.knownelement.com/issues/632) in Redmine project 55 —
ready for the sequential grind-driver pattern.
## Completed Packages (13)
## Completed Packages (14)
| # | Application | Category | Pattern | Port(s) | Addons |
|---|-------------|----------|---------|---------|--------|
@@ -33,6 +34,7 @@ ready for the sequential grind-driver pattern.
| 11 | Rathole | Infrastructure | Pre-compiled binaries + auth proxy | 8000, 2333, 5200-5299 | localstorage |
| 12 | Database Gateway | Infrastructure | Multi-stage (Go, CGO) | 8080 | localstorage, postgresql |
| 13 | FX | DevOps-Tools | Pre-compiled binaries + auth proxy | 8000 | localstorage |
| 14 | ChirpStack | Infrastructure | Official-image wrapper | 8080 | localstorage, postgresql, redis |
Each package lives in `Package-Workspace/<Category>/<app>/` and contains a
`Dockerfile`, `CloudronManifest.json`, `README.md`, `CHANGELOG.md`, `logo.png`,
@@ -121,7 +123,7 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
| DevOps-Tools | 1 | 1/1 (100%) ✅ | fx done |
| Financial-Payments | 1 | 0/1 | |
| Financial-Trading | 1 | 0/1 | |
| Infrastructure | 6 | 3/6 | easy-gate, rathole, database-gateway done |
| Infrastructure | 6 | 4/6 | easy-gate, rathole, database-gateway, chirpstack done |
| Legal | 1 | 0/1 | |
| Project-Management | 1 | 0/1 | |
| Scientific-Computing | 2 | 0/2 | |
@@ -135,7 +137,7 @@ Auth capability is a hard gate before packaging (see
LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
(unacceptable / blocked-on-auth).
### Completed packages (13)
### Completed packages (14)
| App | OIDC | LDAP | Verdict | Note |
|-----|------|------|---------|------|
@@ -152,6 +154,7 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
| Rathole | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` on the status page; tunnels secured by mandatory per-service tokens (Noise/TLS optional) |
| Database Gateway | yes | no | ✅ preferred | **Packaged**; native OIDC-only app — platform provider env (`CLOUDRON_OIDC_*`) seeded into config.json; roles from the `groups` claim |
| FX | n/a | n/a | 🔄 proxy | **Packaged**; CLI-only FaaS tool with no user concept — pinned binary + workspace driven from the Cloudron terminal; landing page gated by `httpAuth.type=proxy` |
| ChirpStack | yes | no | ✅ preferred | **Packaged**; native `[user_authentication.openid_connect]` wired to `CLOUDRON_OIDC_*`; OIDC-registered users are non-admin — one-time `CHIRPSTACK_AUTH_MODE=internal` bootstrap links the seeded `admin` to your SSO email (README) |
### Candidates researched