KNEL/KNEL-TSYSDevStack-SupportStack-Cloudron
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add eLabFTW Cloudron package (Business-Apps) [#669]

Browse Source 
Official-image wrapper of elabftw/elabimg 5.6.12 (tag+digest pinned);
localstorage + mysql + ldap addons; httpPort 443 via DISABLE_HTTPS.
No OIDC upstream -> native LDAP flagged auth-risk. First mysql-addon
and first Business-Apps package; 15/~57. Build verified green under
ukrrs-batch.slice. Docs synced (JOURNAL s15, README, STATUS).

Detail + verification: https://projects.knownelement.com/issues/669#note-3938
This commit is contained in:
mrcharles
2026-09-02 19:58:59 -05:00
parent 8a613b4f7d
commit 1cc0063e03
11 changed files with 366 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
STATUS.md
+12 -8
View File
@@ -3,21 +3,23 @@
> **Human read-only. Agents maintain this file automatically after each work
> session.** Do not edit by hand — the next agent run will overwrite it.
>
> **Last updated:** 2026-09-01 by Crush (GLM-5.2) — ChirpStack packaged
> (#668, Infrastructure, 14th package); auth gate verdict: native OIDC
> (`user_authentication.openid_connect`) wired to the platform provider;
> postgresql + redis addons, official-image wrapper of chirpstack 4.19.1.
> **Last updated:** 2026-09-02 by ZCode (GLM-5.3) — eLabFTW commit landed
> (#669, Business-Apps, 15th package; packaged 2026-09-01 by Crush
> GLM-5.2, gardening finished + committed 2026-09-02 after the prior
> session ended before committing). Auth gate verdict: no OIDC upstream
> (local/SAML/LDAP only) → native LDAP wired to the platform directory
> with an auth-risk flag; official-image wrapper of elabimg 5.6.12.
## Current State: STABLE (packaging phase, ongoing)
Cloudron packaging pipeline is operational. 14 of ~57 upstream applications are
Cloudron packaging pipeline is operational. 15 of ~57 upstream applications are
packaged, committed, and pushed. Packaging templates exist for the core
patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
All remaining apps now carry build tickets (#633-#678) under umbrella
[#632](https://projects.knownelement.com/issues/632) in Redmine project 55 —
ready for the sequential grind-driver pattern.
## Completed Packages (14)
## Completed Packages (15)
| # | Application | Category | Pattern | Port(s) | Addons |
|---|-------------|----------|---------|---------|--------|
@@ -35,6 +37,7 @@ ready for the sequential grind-driver pattern.
| 12 | Database Gateway | Infrastructure | Multi-stage (Go, CGO) | 8080 | localstorage, postgresql |
| 13 | FX | DevOps-Tools | Pre-compiled binaries + auth proxy | 8000 | localstorage |
| 14 | ChirpStack | Infrastructure | Official-image wrapper | 8080 | localstorage, postgresql, redis |
| 15 | eLabFTW | Business-Apps | Official-image wrapper | 443 | localstorage, mysql, ldap |
Each package lives in `Package-Workspace/<Category>/<app>/` and contains a
`Dockerfile`, `CloudronManifest.json`, `README.md`, `CHANGELOG.md`, `logo.png`,
@@ -116,7 +119,7 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
| Low-Code | 3 | 1/3 | corteza done |
| Monitoring | 6 | 1/6 | healthchecks done |
| Automation | 4 | 1/4 | windmill done |
| Business-Apps | 8 | 0/8 | |
| Business-Apps | 8 | 1/8 | elabftw done |
| Collaboration | 2 | 0/2 | |
| Communication | 1 | 0/1 | |
| Data-Management | 2 | 0/2 | |
@@ -137,7 +140,7 @@ Auth capability is a hard gate before packaging (see
LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
(unacceptable / blocked-on-auth).
### Completed packages (14)
### Completed packages (15)
| App | OIDC | LDAP | Verdict | Note |
|-----|------|------|---------|------|
@@ -155,6 +158,7 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
| Database Gateway | yes | no | ✅ preferred | **Packaged**; native OIDC-only app — platform provider env (`CLOUDRON_OIDC_*`) seeded into config.json; roles from the `groups` claim |
| FX | n/a | n/a | 🔄 proxy | **Packaged**; CLI-only FaaS tool with no user concept — pinned binary + workspace driven from the Cloudron terminal; landing page gated by `httpAuth.type=proxy` |
| ChirpStack | yes | no | ✅ preferred | **Packaged**; native `[user_authentication.openid_connect]` wired to `CLOUDRON_OIDC_*`; OIDC-registered users are non-admin — one-time `CHIRPSTACK_AUTH_MODE=internal` bootstrap links the seeded `admin` to your SSO email (README) |
| eLabFTW | no | yes | ⚠️ risk (LDAP) | **Packaged**; no OIDC upstream (auth = local/SAML/LDAP per `src/Enums/AuthMethod.php`); `ldap` addon enabled, README maps `CLOUDRON_LDAP_*` → sysconfig LDAP panel — must be validated on the live Cloudron before production; SAML possible via external IdP |
### Candidates researched