KNEL/KNEL-TSYSDevStack-SupportStack-Cloudron
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add FX Cloudron package (DevOps-Tools) [#640]

Browse Source 
FX 0.9.48 ("poor man's function as a service") as the 13th package:
pre-compiled goreleaser release binary with sha256 pin on
cloudron/base:4.0.0. fx is a CLI with no user concept, so the package
is a workstation: pinned binary + persistent workspace
(functions/ssh/kube) driven from the Cloudron web terminal, with an
auth-proxied landing page as the only HTTP surface (httpAuth proxy).
Deploys target remote Docker hosts over key-based SSH or Kubernetes
via FX_KUBECONF. Build green; runtime smoke (landing page, workspace
seeding, fx -v) green. Docs gardened to 13 packages.

Ticket: https://projects.knownelement.com/issues/640
This commit is contained in:
mrcharles
2026-09-01 19:39:53 -05:00
parent 3d38c507e8
commit 10e2b7c7ed
12 changed files with 412 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
STATUS.md
+9 -7
View File
@@ -3,20 +3,20 @@
> **Human read-only. Agents maintain this file automatically after each work
> session.** Do not edit by hand — the next agent run will overwrite it.
>
> **Last updated:** 2026-09-01 by Crush (GLM-5.2) — Database Gateway
> packaged (#639, Infrastructure, 12th package); auth gate verdict: native
> OIDC (preferred) — platform provider wired via CLOUDRON_OIDC_* env.
> **Last updated:** 2026-09-01 by Crush (GLM-5.2) — FX packaged (#640,
> DevOps-Tools, 13th package); auth gate verdict: no user concept —
> httpAuth proxy gates the landing page (CLI-workstation pattern).
## Current State: STABLE (packaging phase, ongoing)
Cloudron packaging pipeline is operational. 12 of ~57 upstream applications are
Cloudron packaging pipeline is operational. 13 of ~57 upstream applications are
packaged, committed, and pushed. Packaging templates exist for the core
patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
All remaining apps now carry build tickets (#633-#678) under umbrella
[#632](https://projects.knownelement.com/issues/632) in Redmine project 55 —
ready for the sequential grind-driver pattern.
## Completed Packages (12)
## Completed Packages (13)
| # | Application | Category | Pattern | Port(s) | Addons |
|---|-------------|----------|---------|---------|--------|
@@ -32,6 +32,7 @@ ready for the sequential grind-driver pattern.
| 10 | Easy-Gate | Infrastructure | Multi-stage (Go) + auth proxy | 8080 | localstorage |
| 11 | Rathole | Infrastructure | Pre-compiled binaries + auth proxy | 8000, 2333, 5200-5299 | localstorage |
| 12 | Database Gateway | Infrastructure | Multi-stage (Go, CGO) | 8080 | localstorage, postgresql |
| 13 | FX | DevOps-Tools | Pre-compiled binaries + auth proxy | 8000 | localstorage |
Each package lives in `Package-Workspace/<Category>/<app>/` and contains a
`Dockerfile`, `CloudronManifest.json`, `README.md`, `CHANGELOG.md`, `logo.png`,
@@ -117,7 +118,7 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
| Collaboration | 2 | 0/2 | |
| Communication | 1 | 0/1 | |
| Data-Management | 2 | 0/2 | |
| DevOps-Tools | 1 | 0/1 | |
| DevOps-Tools | 1 | 1/1 (100%) ✅ | fx done |
| Financial-Payments | 1 | 0/1 | |
| Financial-Trading | 1 | 0/1 | |
| Infrastructure | 6 | 3/6 | easy-gate, rathole, database-gateway done |
@@ -134,7 +135,7 @@ Auth capability is a hard gate before packaging (see
LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
(unacceptable / blocked-on-auth).
### Completed packages (12)
### Completed packages (13)
| App | OIDC | LDAP | Verdict | Note |
|-----|------|------|---------|------|
@@ -150,6 +151,7 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
| Easy-Gate | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` (no user concept; IP-subnet groups only) |
| Rathole | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` on the status page; tunnels secured by mandatory per-service tokens (Noise/TLS optional) |
| Database Gateway | yes | no | ✅ preferred | **Packaged**; native OIDC-only app — platform provider env (`CLOUDRON_OIDC_*`) seeded into config.json; roles from the `groups` claim |
| FX | n/a | n/a | 🔄 proxy | **Packaged**; CLI-only FaaS tool with no user concept — pinned binary + workspace driven from the Cloudron terminal; landing page gated by `httpAuth.type=proxy` |
### Candidates researched