KNEL/KNEL-TSYSDevStack-SupportStack-Cloudron
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(consuldemocracy): verify end-to-end + harden seed/OIDC [#653]

Browse Source 
Seed verification over marker trust (observed exit-0 no-op seed),
first-boot-only OIDC auto-enable, logo added, docs synced (JOURNAL
s17, counts 17/~57). grind-stack verified: homepage 200, OIDC SSO
button live.

Detail: https://projects.knownelement.com/issues/653#note-5044
This commit is contained in:
mrcharles
2026-09-06 18:23:54 -05:00
parent 7c65dc18d3
commit 1bf9810071
7 changed files with 112 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
STATUS.md
+9 -8
View File
@@ -3,7 +3,7 @@
> **Human read-only. Agents maintain this file automatically after each work
> session.** Do not edit by hand — the next agent run will overwrite it.
>
> **Last updated:** 2026-09-06 by ZCode (GLM-5.3) — NetBox packaged
> **Last updated:** 2026-09-06 by ZCode (GLM-5.3) — ConsulDemocracy packaged (17th; verified via grind lifecycle)
> (#648, Infrastructure, 16th package); auth gate verdict: native OIDC via
> python-social-auth (OpenIdConnectAuth + SOCIAL_AUTH_OIDC_*) wired to the
> platform provider; official-image wrapper of netboxcommunity/netbox
@@ -13,14 +13,14 @@
## Current State: STABLE (packaging phase, ongoing)
Cloudron packaging pipeline is operational. 16 of ~57 upstream applications are
Cloudron packaging pipeline is operational. 17 of ~57 upstream applications are
packaged, committed, and pushed. Packaging templates exist for the core
patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
All remaining apps now carry build tickets (#633-#678) under umbrella
[#632](https://projects.knownelement.com/issues/632) in Redmine project 55 —
ready for the sequential grind-driver pattern.
## Completed Packages (16)
## Completed Packages (17)
| # | Application | Category | Pattern | Port(s) | Addons |
|---|-------------|----------|---------|---------|--------|
@@ -45,7 +45,7 @@ Each package lives in `Package-Workspace/<Category>/<app>/` and contains a
`Dockerfile`, `CloudronManifest.json`, `README.md`, `CHANGELOG.md`, `logo.png`,
and (where relevant) `start.sh` + `.env.example`.
## Build Ticket Map (46 filed 2026-09-01; 39 open — 7 landed: #639, #640, #648, #650, #651, #668, #669)
## Build Ticket Map (46 filed 2026-09-01; 38 open — 8 landed: #639, #640, #648, #650, #651, #653, #668, #669)
All under umbrella [#632](https://projects.knownelement.com/issues/632)
(Redmine project 55, tracker Feature). Excluded: **grist-core** (a Cloudron
@@ -68,12 +68,12 @@ package already exists upstream — do not package).
| #645 | OpenBoxes | Business-Apps | needs LDAP runtime verification (note 2026-09-06) |
| #646 | Nautilus Trader | Financial-Trading | disposition (headless lib) |
| #647 | Fleet | Monitoring | build (research queue) |
| #648 | NetBox | Infrastructure | build (redis addon; strong candidate) |
| #648 | NetBox | Infrastructure | DONE 2026-09-06 (16th package) |
| #649 | SeaTunnel | Data-Management | disposition (service vs tool) |
| #650 | Rathole | Infrastructure | build (proxy) |
| #651 | Easy-Gate | Infrastructure | build (proxy) |
| #652 | Huginn | Automation | blocked-on-auth (local-only Devise; note 2026-09-06) |
| #653 | ConsulDemocracy | Collaboration | build |
| #653 | ConsulDemocracy | Collaboration | DONE 2026-09-06 (17th, grind-verified) |
| #654 | BOINC | Scientific-Computing | disposition (server packaging heavy) |
| #655 | Slurm | System-Administration | disposition (likely out of scope) |
| #656 | Gophish | Security | blocked-on-auth |
@@ -122,7 +122,7 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
| Monitoring | 6 | 1/6 | healthchecks done |
| Automation | 4 | 1/4 | windmill done |
| Business-Apps | 8 | 1/8 | elabftw done |
| Collaboration | 2 | 0/2 | |
| Collaboration | 2 | 1/2 | consuldemocracy done |
| Communication | 1 | 0/1 | |
| Data-Management | 2 | 0/2 | |
| DevOps-Tools | 1 | 1/1 (100%) ✅ | fx done |
@@ -142,7 +142,7 @@ Auth capability is a hard gate before packaging (see
LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
(unacceptable / blocked-on-auth).
### Completed packages (16)
### Completed packages (17)
| App | OIDC | LDAP | Verdict | Note |
|-----|------|------|---------|------|
@@ -162,6 +162,7 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
| ChirpStack | yes | no | ✅ preferred | **Packaged**; native `[user_authentication.openid_connect]` wired to `CLOUDRON_OIDC_*`; OIDC-registered users are non-admin — one-time `CHIRPSTACK_AUTH_MODE=internal` bootstrap links the seeded `admin` to your SSO email (README) |
| eLabFTW | no | yes | ⚠️ risk (LDAP) | **Packaged**; no OIDC upstream (auth = local/SAML/LDAP per `src/Enums/AuthMethod.php`); `ldap` addon enabled, README maps `CLOUDRON_LDAP_*` → sysconfig LDAP panel — must be validated on the live Cloudron before production; SAML possible via external IdP |
| NetBox | yes | plugin | ✅ preferred | **Packaged**; python-social-auth OIDC (`REMOTE_AUTH_BACKEND=OpenIdConnectAuth` + `SOCIAL_AUTH_OIDC_*`) wired from `CLOUDRON_OIDC_*`; local Django login retained for admin bootstrap; SSO users register without privileges (README) |
| ConsulDemocracy | yes | no | ✅ preferred | **Packaged**; omniauth_openid_connect (discovery) wired into generated secrets.yml; `feature.oidc_login` auto-enabled on first boot when the provider is present (admin-panel toggle afterwards); SAML also available; local admin seeded |
### Candidates researched