feat: add eLabFTW Cloudron package (Business-Apps) [#669]

Official-image wrapper of elabftw/elabimg 5.6.12 (tag+digest pinned); localstorage + mysql + ldap addons; httpPort 443 via DISABLE_HTTPS. No OIDC upstream -> native LDAP flagged auth-risk. First mysql-addon and first Business-Apps package; 15/~57. Build verified green under ukrrs-batch.slice. Docs synced (JOURNAL s15, README, STATUS). Detail + verification: https://projects.knownelement.com/issues/669#note-3938
2026-09-02 19:58:59 -05:00
parent 8a613b4f7d
commit 1cc0063e03
11 changed files with 366 additions and 11 deletions
@@ -0,0 +1,40 @@
+# eLabFTW Cloudron Package
+#
+# eLabFTW is an open-source electronic lab notebook (ELN) for research
+# teams: experiments, inventory, scheduling, timestamps and PDF export,
+# backed by MySQL. Packaged as an official-image wrapper around the
+# upstream elabimg image (nginx + php-fpm + s6-overlay in one container).
+#
+# Upstream: https://github.com/elabftw/elabftw
+#   - The elabimg build lives in-tree (containers/elabimg/) but compiles
+#     nginx, OpenBabel and the whole yarn/composer asset pipeline from
+#     source; the published image is the supported distribution channel.
+#   - elabimg 5.6.12 with DISABLE_HTTPS=true serves plain HTTP on port
+#     443 (Cloudron terminates TLS at the platform proxy).
+#   - DB schema: AUTO_DB_INIT / AUTO_DB_UPDATE run `bin/init db:install`
+#     / `bin/console db:update` from the image entrypoint; start.sh
+#     gates them behind a MySQL wait loop.
+#
+# Authentication: NO OIDC upstream (v5.6 auth methods: local, SAML, LDAP).
+# Verdict per AGENTS.md: native LDAP = acceptable with auth-risk flag.
+# The manifest enables the `ldap` addon so CLOUDRON_LDAP_* credentials are
+# available; the sysconfig admin wires them into Admin panel -> LDAP (see
+# README). SAML is also available for an external IdP.
+#
+# Pattern: official-image wrapper. Image pinned by tag AND digest (amd64
+# manifest digest of the 5.6.12 tag, from the Docker Hub registry API).
+FROM elabftw/elabimg:5.6.12@sha256:e91fcc92f0c9a3190ac4f8db7fad03703f1662b33856a53baba9b5a06d71a51d
+
+# start.sh waits for the mysql addon, persists the SECRET_KEY, maps the
+# Cloudron env into elabimg's DB_*/SITE_URL/DISABLE_HTTPS variables,
+# binds uploads + exports under /app/data and execs the s6 init.
+# Made executable on the host, not at build time (Cloudron builds hit
+# permission errors on RUN chmod). bash ships with elabimg.
+COPY start.sh /app/start.sh
+
+# elabimg HTTP mode (DISABLE_HTTPS=true) listens here; no other listener.
+EXPOSE 443
+
+# s6-overlay must run as root: the upstream entrypoint creates the
+# unprivileged nginx/php user and drops privileges for the services.
+ENTRYPOINT ["/bin/bash", "/app/start.sh"]