From 7e054facadc4b192f365a3c70ec2cdddd2c496ec Mon Sep 17 00:00:00 2001 From: reachableceo Date: Sun, 6 Sep 2026 19:54:56 -0500 Subject: [PATCH] feat!: remove rathole package - superseded by netbird [#650] Founder ruling: "we will use netbird for all enterprise network access." Package dir deleted (11th package, f918a90, is hereby retired); GitUrlList 41->40; counts 19->18; completed tables renumbered; JOURNAL section retained as history with a superseding addendum. Standing policy recorded: netbird for network access. --- GitUrlList.txt | 1 - JOURNAL.md | 8 ++ .../Infrastructure/rathole/.dockerignore | 1 - .../Infrastructure/rathole/.env.example | 8 -- .../Infrastructure/rathole/CHANGELOG.md | 27 ----- .../rathole/CloudronManifest.json | 43 -------- .../Infrastructure/rathole/Dockerfile | 48 --------- .../Infrastructure/rathole/README.md | 95 ------------------ .../Infrastructure/rathole/logo.png | Bin 11463 -> 0 bytes .../Infrastructure/rathole/start.sh | 54 ---------- .../Infrastructure/rathole/status.html | 51 ---------- README.md | 22 ++-- STATUS.md | 39 ++++--- 13 files changed, 35 insertions(+), 362 deletions(-) delete mode 100644 Package-Workspace/Infrastructure/rathole/.dockerignore delete mode 100644 Package-Workspace/Infrastructure/rathole/.env.example delete mode 100644 Package-Workspace/Infrastructure/rathole/CHANGELOG.md delete mode 100644 Package-Workspace/Infrastructure/rathole/CloudronManifest.json delete mode 100644 Package-Workspace/Infrastructure/rathole/Dockerfile delete mode 100644 Package-Workspace/Infrastructure/rathole/README.md delete mode 100644 Package-Workspace/Infrastructure/rathole/logo.png delete mode 100755 Package-Workspace/Infrastructure/rathole/start.sh delete mode 100644 Package-Workspace/Infrastructure/rathole/status.html diff --git a/GitUrlList.txt b/GitUrlList.txt index 5c3839a..6f58229 100644 --- a/GitUrlList.txt +++ b/GitUrlList.txt @@ -15,7 +15,6 @@ https://github.com/healthchecks/healthchecks https://github.com/fleetdm/fleet https://github.com/netbox-community/netbox https://github.com/apache/seatunnel -https://github.com/rapiz1/rathole https://github.com/wiredlush/easy-gate https://github.com/consuldemocracy/consuldemocracy https://github.com/BOINC/boinc diff --git a/JOURNAL.md b/JOURNAL.md index e721eb1..a8db1c1 100644 --- a/JOURNAL.md +++ b/JOURNAL.md @@ -893,6 +893,14 @@ traversal (frp/ngrok class, Rust); this package runs the **server** side **Commit**: `feat: add Rathole Cloudron package (Infrastructure) [#650]` +> **SUPERSEDED / REMOVED 2026-09-06** by founder ruling on +> [#650](https://projects.knownelement.com/issues/650): *"remove this. +> we will use netbird for all enterprise network access."* The package +> directory was deleted and the app dropped from GitUrlList and all +> counts. This section is retained (append-only) as the historical +> record of the pre-compiled-binaries pattern work. + + ### 12. Database Gateway (Infrastructure) ✅ **Date**: 2026-09-01 **Application**: Database Gateway (dbgw) — policy-checked web gateway to diff --git a/Package-Workspace/Infrastructure/rathole/.dockerignore b/Package-Workspace/Infrastructure/rathole/.dockerignore deleted file mode 100644 index f606d5e..0000000 --- a/Package-Workspace/Infrastructure/rathole/.dockerignore +++ /dev/null @@ -1 +0,0 @@ -repo diff --git a/Package-Workspace/Infrastructure/rathole/.env.example b/Package-Workspace/Infrastructure/rathole/.env.example deleted file mode 100644 index 890983a..0000000 --- a/Package-Workspace/Infrastructure/rathole/.env.example +++ /dev/null @@ -1,8 +0,0 @@ -# Rathole Cloudron package — environment knobs -# -# Cloudron injects these at runtime (App -> Configure -> Environment); -# they are not secrets. - -# Log level for the rathole server: error | warn | info | debug | trace. -# Default when unset: info -RUST_LOG=info diff --git a/Package-Workspace/Infrastructure/rathole/CHANGELOG.md b/Package-Workspace/Infrastructure/rathole/CHANGELOG.md deleted file mode 100644 index e82fde2..0000000 --- a/Package-Workspace/Infrastructure/rathole/CHANGELOG.md +++ /dev/null @@ -1,27 +0,0 @@ -# Changelog — Rathole Cloudron Package - -## 1.0.0 (2026-09-01) - -Initial Cloudron package for Rathole 0.5.0 (server mode). - -- Pre-compiled-binaries pattern: upstream `x86_64-unknown-linux-gnu` - release zip downloaded at build time behind a sha256 pin (musl release - builds were dropped upstream in v0.5.0). -- Runtime `cloudron/base:4.0.0` (Ubuntu 22.04): the gnu binary requires - glibc >= 2.35, too new for the 3.x (20.04) base used by earlier - packages. -- `start.sh` seeds `/app/data/server.toml` on first run with a random - `default_token` (openssl) and a placeholder `[server.services.example]` - binding :5200 — upstream rejects a server config with zero services — - then execs `rathole --server`; the config hot-reloads on save. -- Verified end-to-end at build time: a client container tunneled its own - HTTP server through the packaged server (token auth, lazy service bind, - hot-reload of added services). -- TCP surface: control channel on 2333 + a 100-port tunnel exit range - (5200-5299) declared via `tcpPorts` with `containerPort`/`portCount`. -- No user concept → `httpAuth.type = proxy` gates a small static status - page served on the HTTP port (also serves as the platform health - check); tunnel access itself is controlled by rathole's mandatory - per-service tokens. -- Addons: `localstorage` only (config persistence; no database). -- Logo padded from the upstream wordmark to a 256x256 PNG. diff --git a/Package-Workspace/Infrastructure/rathole/CloudronManifest.json b/Package-Workspace/Infrastructure/rathole/CloudronManifest.json deleted file mode 100644 index 1f7f6f1..0000000 --- a/Package-Workspace/Infrastructure/rathole/CloudronManifest.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "manifestVersion": 2, - "type": "app", - "id": "io.cloudron.rathole", - "title": "Rathole", - "description": "Rathole is a secure, stable and high-performance reverse proxy for NAT traversal, written in Rust. This package runs the server side: clients behind NAT connect to the control port with per-service token authentication (optionally Noise/TLS encrypted) and expose their local services through tunnels on the reserved port range. Configuration lives in /app/data/server.toml and hot-reloads on save. No database required.", - "author": "rapiz1 / rathole-org", - "website": "https://github.com/rathole-org/rathole", - "documentationUrl": "https://github.com/rathole-org/rathole/blob/main/README.md", - "contactEmail": "cloudron@tsys.dev", - "tagline": "Secure, high-performance reverse-tunnel server for NAT traversal", - "version": "0.5.0", - "upstreamVersion": "0.5.0", - "healthCheckPath": "/", - "httpPort": 8000, - "httpAuth": { - "type": "proxy" - }, - "tcpPorts": { - "CONTROL_PORT": { - "title": "Control channel port", - "description": "TCP port that rathole clients connect to in order to establish tunnels. Change only if it collides with another exposed app on this Cloudron.", - "defaultValue": 2333, - "containerPort": 2333, - "portCount": 1 - }, - "SERVICE_PORT": { - "title": "Tunnel exit ports", - "description": "Start of the sequential port range reserved for tunneled services (100 ports by default: 5200-5299). Each [server.services.*] block in /app/data/server.toml binds one port from this range; the config hot-reloads, so services can be added without a restart.", - "defaultValue": 5200, - "containerPort": 5200, - "portCount": 100 - } - }, - "memoryLimit": 268435456, - "addons": { - "localstorage": {} - }, - "postInstallMessage": "Rathole is headless: there is nothing to click through. Open the **file manager** and edit **/app/data/server.toml** to define tunnel services (a random default token was generated on first start). The config hot-reloads on save. The client-side setup is documented in the package README.", - "mediaLinks": [], - "changelog": "Initial Cloudron package for Rathole 0.5.0 (server mode). Pre-compiled upstream binary with sha256 pin, token-authenticated tunnels on control port 2333 plus a 100-port service range (5200-5299), config with hot reload at /app/data/server.toml, and an auth-proxied status page on the HTTP port.", - "icon": "file://logo.png" -} diff --git a/Package-Workspace/Infrastructure/rathole/Dockerfile b/Package-Workspace/Infrastructure/rathole/Dockerfile deleted file mode 100644 index 0785731..0000000 --- a/Package-Workspace/Infrastructure/rathole/Dockerfile +++ /dev/null @@ -1,48 +0,0 @@ -# Rathole Cloudron Package -# -# Rathole is a secure, stable and high-performance reverse proxy for NAT -# traversal (frp/ngrok class, written in Rust). This package runs the -# SERVER side: the Cloudron box is the public-IP endpoint, rathole clients -# behind NAT dial the control port (2333) and expose their local services -# through token-authenticated tunnels on the 5200+ port range. -# -# Upstream: https://github.com/rathole-org/rathole (v0.5.0) -# - Ships a prebuilt x86_64-unknown-linux-gnu release binary (musl -# release builds were dropped upstream in v0.5.0) -# - No database, no user accounts; per-service tokens are mandatory -# -# Authentication: Rathole has NO user concept (tunnels are authorized by -# per-service tokens, optionally Noise/TLS encrypted at the transport -# layer). The status page on the HTTP port is gated by Cloudron's -# authentication proxy (httpAuth.type = proxy). -# -# Base image: cloudron/base:4.0.0 (Ubuntu 22.04). The upstream gnu binary -# is built on ubuntu-latest, so the runtime needs glibc >= 2.35 — -# cloudron/base:3.2.0 (20.04) is too old for it. -FROM cloudron/base:4.0.0 - -ARG RATHOLE_VERSION=0.5.0 -ARG RATHOLE_SHA256=3e7d0d0f365120cd3cd351d147d1a12ee960c8068b464d4dd533a3821873b80e - -# Pre-compiled-binaries pattern (see JOURNAL.md): download the pinned -# upstream release, verify the sha256 gate, install the binary. -RUN curl -fsSL -o /tmp/rathole.zip \ - "https://github.com/rathole-org/rathole/releases/download/v${RATHOLE_VERSION}/rathole-x86_64-unknown-linux-gnu.zip" \ - && echo "${RATHOLE_SHA256} /tmp/rathole.zip" | sha256sum -c - \ - && unzip -o /tmp/rathole.zip -d /usr/local/bin \ - && chmod +x /usr/local/bin/rathole \ - && rm -f /tmp/rathole.zip \ - && /usr/local/bin/rathole --version - -# Static status page served on the Cloudron HTTP port (platform health -# check + auth-proxied landing page). start.sh seeds /app/data/server.toml -# on first run and execs rathole in server mode. start.sh is made -# executable on the host, not at build time (Cloudron gotcha). -COPY status.html /app/code/status/index.html -COPY start.sh /app/start.sh - -WORKDIR /app/data - -EXPOSE 8000 2333 5200-5299 - -CMD ["/bin/bash", "/app/start.sh"] diff --git a/Package-Workspace/Infrastructure/rathole/README.md b/Package-Workspace/Infrastructure/rathole/README.md deleted file mode 100644 index 9196783..0000000 --- a/Package-Workspace/Infrastructure/rathole/README.md +++ /dev/null @@ -1,95 +0,0 @@ -# Rathole — Cloudron Package - -[Rathole](https://github.com/rathole-org/rathole) is a secure, stable and -high-performance reverse proxy for NAT traversal (frp/ngrok class, written -in Rust). This package runs the **server** side: the Cloudron box is the -public-IP endpoint, rathole clients behind NAT dial the control port, and -their local services are exposed through token-authenticated tunnels. - -## Packaging overview - -| Aspect | Choice | -|--------|--------| -| Pattern | Pre-compiled binaries (JOURNAL pattern #5) | -| Base image | `cloudron/base:4.0.0` (Ubuntu 22.04) | -| Upstream binary | `rathole-x86_64-unknown-linux-gnu.zip`, v0.5.0, sha256-pinned in Dockerfile | -| Addons | `localstorage` only (config persistence; no database) | -| Auth | No user concept → `httpAuth.type = proxy` (see below) | -| Runtime | `start.sh` seeds config, serves status page, execs rathole `--server` | - -Why pre-compiled: upstream ships release binaries and **dropped the musl -builds in v0.5.0** (only `x86_64-unknown-linux-gnu` remains for Linux -amd64). The gnu binary is built on ubuntu-latest, so the runtime needs -glibc >= 2.35 — hence `cloudron/base:4.0.0` (22.04) instead of the 3.x -series (20.04). Compiling from source would need a full Rust toolchain -build stage for no benefit. - -## Authentication (auth gate verdict: proxy) - -- Rathole has **no user concept**: no web UI, no accounts, no SSO hooks. -- Tunnels are authorized by **mandatory per-service tokens** (a random - `default_token` is generated into `/app/data/server.toml` on first - start). Transport can additionally be encrypted via Noise or TLS. -- The manifest declares `httpAuth: {"type": "proxy"}`: Cloudron's auth - proxy gates the HTTP status page, which is the only HTTP surface this - app has. The raw TCP tunnel ports cannot be HTTP-gated by design; the - token layer is their access control. - -## Ports - -| Port | Type | Purpose | -|------|------|---------| -| 8000 | `httpPort` | Status/health page (behind Cloudron auth proxy) | -| 2333 | `tcpPorts` | Control channel — rathole clients connect here | -| 5200–5299 | `tcpPorts` (100-port range) | Tunnel exit ports — one per `[server.services.*]` | - -With default install settings Cloudron bridges these 1:1 (external -5200-5299 → container 5200-5299). If the admin picks a different -`SERVICE_PORT` start value, the *container* ports stay 5200+ and only the -external numbering shifts — `server.toml` never needs editing for that. - -## Configuration - -`/app/data/server.toml`, seeded on first run, **hot-reloaded on save** -(add/remove services without restarting the app). The seed contains a -placeholder `[server.services.example]` on :5200 — rathole rejects a -server config with zero services, so keep at least one block. Example -service: - -```toml -[server.services.my_nas_ssh] -token = "" -bind_addr = "0.0.0.0:5200" -``` - -Client side (machine behind NAT): - -```toml -[client] -remote_addr = "your-cloudron.example.com:2333" - -[client.services.my_nas_ssh] -token = "" -local_addr = "127.0.0.1:22" -``` - -Then `ssh -p 5200 user@your-cloudron.example.com` reaches the NAS. - -Knob: `RUST_LOG` (error|warn|info|debug|trace, default `info`) via -Cloudron environment settings — see `.env.example`. - -## Build & test - -```bash -docker build --cgroup-parent ukrrs-batch.slice -t rathole-cloudron:test Package-Workspace/Infrastructure/rathole/ -docker run --rm --entrypoint /usr/local/bin/rathole rathole-cloudron:test --version -``` - -## Files - -- `Dockerfile` — pinned release download + sha256 gate on cloudron/base:4.0.0 -- `CloudronManifest.json` — manifestVersion 2, httpAuth proxy, tcpPorts (control + 100-port service range) -- `start.sh` — config seeding, status page, exec rathole server mode -- `status.html` — auth-proxied landing/health page -- `.env.example` — runtime knobs -- `logo.png` — 256x256, padded from upstream wordmark diff --git a/Package-Workspace/Infrastructure/rathole/logo.png b/Package-Workspace/Infrastructure/rathole/logo.png deleted file mode 100644 index c623d58425f51a9801983073aca2b1bc4fe77ed2..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 11463 zcmeHNWl&X7oWGCvBp)H5bf`#3KDt9dKm}B9F7jB(%{=fR)k1rKvaIwj;Aqc{ila+b}K``(u48lYMAHxJk#D30YRI35G0rYK_qr5waUWa59kK+GE&g(zpspj{AjQT z%T89q5rPQ!{(ZxQ9157gP7EhG1!;^;EEowdXWX5omk`8kEhi=M+HGnl)!p;;==p8B zW3>inw1~L6hzf5czBQ^ip80f~8KYWMpK7*LuonYphr)T~t6oU~+OYi*czTDG$q^ z7BlD7(l3Ae{(+u=vQ7CRGU=U(^5tkHQH}2wqr0HPE{Bn#^DJwpkIp$&557B-G=rHc976qYvDT2J#H7O?cxmIRF)(|2`u zlZ$y@{rpHYU1c4rjBsT^*z25SqH!Pt9N9t)XbIeI&ezhtP9~R@44_YRa>UY2^N}rd za^2nCn}eB>mnS=1TwE$DDyfS3w3tbGqobp-@$u<`&YPW|AIU^eGCg^M?cLb6n82am zs(bS{eyms%4n>r*Ic46x6}qB@CE(s-(0JP2UZ2tkxgeo!m%4(2+7h^U=zUhUrmMg8 z_4T4&7nPRdY$%j+oN?Iiuy|Al>2k{D^-V!RL2GMkv1WCNPJ_pAo`SQpGik?)gUEg} z9AET|*047$hSr;ZjSVUaURhZoVo=nov3meb?3{?x`bwr|N(M#Hh>5bZvvY9~L7t+z zv;>3PtTl7XG^>36w6ak~-zKeilk?020|VvbSQ5d=jqCb^!z#Xg(|xz|9R^3&Bj#rQ zcm9V^N_|LHjl)W}{c?xun>XDRy`(q@G>F5bH-Skd4@t@YlDPfi!s99`HMfglxsA*a zFQ{$9X>4?qRkLb)(lq`0Zx1`FS4Bz0d9UFV4L2zGP+|tHc|WY&G|k;)s?r?NtDg1} zrGd0O585Mz|8_341gNSWy9pB*?F(SM2(@_iDr$aDw@j}kjEqY$g&ziib#{1le(1+7 zexZ|jvN~&)Db*bPy1WN?IlPB};YpLu_R~2+}VJKDAcSq|77h9!kfBwY8 z$7f5g|C0TZXU?0v;72`}avnEFu-R}4&!9lxO=W*+~diT}d#Nm9U{A1V>rP*7EzxGQ(!RFL=OLOzDeI|#O*VQu)Ju^QX z3kwSu(Y`mLEWlv1O zC5Zs4`kL;2VeaiM8sYi2(yZM5aCKzlb^3s7i#2;eL0*1-sd~A=pU%&qG?IBN)wVwR(VK_o*f==ZuWi~mDk>_p*v6GI{LIjr*PXTZ z<{BPkdn`KOG%P9~iH9KMbPw_)=AM@{9N}{&lDG!m}8?37JW&Dm5K<T#5IT=OZIzbwk3UZnr&wO7264d~OcYHNRV|oL>4=(sAlJ zymVe`M!bxYaPZ!fhx8oE(4~}%N=m3v20wG-bp#DNkijjT`|^I$t4|qrga_3-#2Ts| zMHrPaTnzZ!z#;FZCc|G5%fBK^OG-q2`ovZbw?mDPNU9O?GCp`8&I^d%e>c8bk>jm) zvFR+rk6aIp1FNS0>fTHm`Ui`-e&0*4MxU!?nsJ?X*5>Bs-%R?vH|X!CbiGIwbe^qs zwy73UA4>RMJ?~wokj(plC@sAWlL5QMR*C>&WyH?%8&PIDkcLaayD;NAlq1K)#00=_ z&HQM;4U0PH3{pERV<>}*Hs}AAzp>ZX9O>9P+^PbDxR(y>exr2$PYyuMa zzO(^GrgMaPglnElKR>2>{>8fLw9eEgtu3)k$}@jEu^9KGyaj3EKb>u;;e&vL?~5xF zqcCR#h^u_I#!KgYVeqJ^D1&Y2cSH9J&3egSW$s}Ww-nJaV2h6*&z6a#8IqR?5!8{E zE_}@Vrl?u$Sp?-I;PgYj3sXpI(k;k(gCO&at1Q<}Kv}rqv%8|b0K7i8yLS40*0DoN z_Cg^nAYlDIK05(E`=>^arx&aDN^p1pv64!@Q}d>Ap78#ji*ffST2f=N!|QR)J_uLkcB@1YfLYt4#V~{P6r24E=rhs zKuy={4ph@l+=565z~FMvVsz*SK-pw7Tl?K{t$*+}kuSb}*qwX=9M-tcSb_n8eUD5C zydF!&_{wdLd>u9gEZ_Mkk~^`}F_>KB(W84-h7a)wK{b{g!Dz+AXtKljis$X=dC(#F z@BU3iOk<%3FSCoN3y;%EjFs+2dLz+&OZ*oM(uk^Z+x$M#{($MClf*jT;`6ULV4IO+ zx@3CBzr1){ZOUl5NASeOkD8!qc4E*(>TtF1^62K6M7OA?ySvre5=GAuH{wiTbGNb2b>&|MOyXD;JLpocY{H4QA<)@=AnVKbUTnxN-6w{r?mooU`xQaO!@~o8N=%$=^6}}_sb|6q`Gp73PSL)E zhm~Kb5bXOWU~0v>2tT1t8K}>faPo`5{ebjGYnE8EGf88HzQGOc@}%|kFuT`WIcD)2 zpOodI8vNZAIonDLJ@*GKv8!y)wXJZ_&NzXV@g7#-(+{2C52MBW{{8y^p!_oZHar?p z&(m2~cI{g3vqkpCvn4=u4LW-v_n3KY=dO;&bxH2uPZRYbuWk>_1q9-CdD3vuLGde+ zCh}K@9#KTy&EespTJhV!B&@G}tDn)%&(HCK;L^JXZft;;<8{5s+PIlaG~z--LuowL zGb2SWFsW)^pyQGs0kv_wHO_9egKA=7WOTbe9tWpURagIF{#KR)aBIW6)2pj1EF$^^ zd+KmChGlD|zAsG|n}tASc>&H2!l$vJ{NA&&Ih;Sh3g~s(y82_*M2@LAH*A3hj*c`N zE1LW^tk;6s5m?=2qm$ff+m5-Y2|?Vwa!%Z@17{< zNB2Ts)Tfz@uPO3HtM6$iw|)#Yg_qfEpdf;F^?O^#9(^LeK64-q2hv2qNT{mbgUVE+ z>AKbq0cpaTyP_FnBB`kyNFrSPm7wO9t&QRQcp&1eCM(FeOzKajEG0i6QMw#!o?zY! z3bOX(a*nnqzcHK{Iyi9t%y5qxZVklwH?&+PT!9H?0F(dx`Qr)Hb&K57UPFSs7l{>m zE&gThKam~{bAU5#=NqrnZ?D$i_`>`9ZTQ(yk{5*&%y*w@tE%!CcgFz47kWMdR4)K9 zpfRq8mBg-h>-J7Ih8b$nAL>jryyLq;=`}-EDF#Y5jL4tM^0`^81{;cvmye5k_S%Vh zAmThj=`{$O_XN_9YklbX2O_kC6fht?-pq=Zb0>&Wk;#L7A@iI5SZ9j@`3U=@$01o+ zj1x;A(w7$nOX+YW}lzZ9-FuFXN(BKojU^`2!u?NMJ?e6XlL_E2GL(X{t zAtB*{m2o(t@f{`Mmx4_v!3Q7S#>T`PEe6rdxh;o7v^@^X`n6e%e&Tw-A%V)rPJ3ZE zg^i8<0iQvP&Ypc2b%06IqwSB;4W@0ku zv|yQlW8i^-wF0uO*%zkFO@QJ7)7CELakA~sMg-aTX2Qk?Ml_i2N>Ru%6>XMPEb3&M z5pgiAqmx2{zWpt}9Jfd7H0Q2-4(PQdRvuC_B1%y?_g|@MNE=grT%p9plv?SCW(S(^IZo-H?MVh3J<94mu+vV>7E%!sm{U zNCa9)R!nTH$nDi3fl);aojDL#K%ClZXpni#X1TSR5Xrw%Rkb4KwVL=8AD_SFQ6GoJ zwfXOnR#$;M=Z+w^HptWHWl`6N!)>bpYtGWbBI^jcd&hUSwr$Z22xnS?U=@gxj=?o2 zAPV!vQnPqjKwdxz+|lka6#|2l@@Q{-VdbmCEkWLQT z|1CoUg9PK2D$hPp*fhfl_P->nV}Ejt2$=#DsqH#@$DVB{S+m!+c7wije45`PB{&C?&v*MA0_7DFv`(+f^*>lZ-9XCzUq7 zd44wB%1!Rs7uN4D>2ov(o%1&I%3haCST|#tQ3|DHV{oWh_tImSU+wlm6SK?em<&jL z3`l+PKATpswnEqk*ITr4nX)eKZE5c6h@am zL&$`0M!SIXq2`k>ZS)1xvAtP1pDPUC>JF|6-?%TFCys zLxZI5iu%x+Ao7m)=P>Is7i#mQ)MHZdac7VynA9`^$lV+* zlnlb#*w}D$Q?|C=DbcQ@ez#o?Z2l+4vRO{#^2k>e06Rp8#ZdM}ez*OFdum#Kp^^Ho z)hxP=^_Jr$xVX4(wk*+lNCAgGo&QvPS65e|T4|cFyTb(IKE?2hO5h2BDO>*2XwT6x z0U*;0Uu#lu=`kl!}bdUKB0)L-FxA0BzMUUn#PgdCItC)FeE

L#%b>`hfH;G( z?cj~JUC3*pZ9bI6@}-Yshm>S>mp!TVJ?Zl4o#MCO{V|<8i;QgR573idzPR!h!y_3U z9{%UIfr(u0OAZQu%)qe5*L1D`V9(OhQgV~>S;zp)H!LhnHkW2KCRql-TAlYF(}GVLL`kp+)E>_&UMclJYmNu zy6F(0lMs36b5=+BSc-rnu<}Gvs|yA{(Y_XinGuFD`U0{5N-=>dhaZ!(kl7?QNW#TV zGwP)m(uoRrqP-&=v?{#H-o$LxkCb%fpJ91?d`Xf-A2o8&r|mqd+7^T_(`Hi<5+G#%y^+pLY~PmUBhnQ$Bs zQG5HAoDyB6dLOxivkRwW2gOp32z{*kpeg31p{$L~F7U&X<%TlQ`dBeV z5-|l1L^Sxv;Qmb{8crHwnLPRj{XJt|+f{ClxW2;m-(*-?wyl|*7q?P!KhD3bhkC7! z$|@ULZ%=(^_Haqzx_cQ9P!mL8co2wN2%H0h0~j4;I9>DXT%&$_(5k3%yr)+yS~?@u zmBrH{);#|CDkK-P_xMCM9M?ObIHS)5=j*kbC;FNv&_gEHn2QI$X!a(`AFTmkp^R5+ zi(`1EFL)vISFZ(8q+NF(0u*!VpAg?#qV#CB?VzA%CFB*SiRJ7!(*ap&3DXhdh1bEz6?SV^1PqufUH%fY3wZa|&== zpyf_$PP=wTaTk++Xn{#JC+AkZ{3@xE@i;Rt&*b{zn1avdy`3u2{0d+Z zfi>WPqUf|8`*^Uhu-w>he2&(YooKA;vk;~VWMTipvc>+PGMyX14jsD>MMP#7?f5Ap z%2dQ(40xT+p6*o7p8)NinVAWIsHW!ZBSYE*z!Z=g1N%vlj}VKCjb&9Y%lKyqgj}>5 zJdTriENQjGeEmpR-@bnJ%HbGPfyYMfIw1ui^0EzB!&#?c1z>I(#<#o{14#-B3n|#& z>q|I;SPEEkkja2p^y%b#5mGcLj!pZmvNFo^Y+oV(eet2VZ2HHxeh|w6)V&XGP1ZLvS;?)qM$>DlRRzk49S(Sf^Le4jXIb_3D2Umzi< zk9O8jq`-a|kZh20lV#fqCcV~m5ASn+{)2ho9d9<(np)o-+=9f%`}#t<76rmv5Ws+N z2iy&hF%eS;h=W%C{8_J^14{@nytKe7>mT{1dC+n=12KK`QK*$CiMP)@7<8Z8Yd{9& zM(3cd00xzk+ib8SoTAM}3CI2E1R|SZAOIY&o*ij3Rk;x*&-U^0CSY>cjiD6~pzBuK zXit23#5x^>I6GU8EUnwE-G^n(2wP2XR8Kbm3Iu+0X*GM0ASJ+Px#WH`@owir6*06S zM6yEQ%7?c&JBx(a?3&aD);<4bnOEDmL~0cE&-K;72qAnAOumFKmi`%t4==9Yna?lM zjNYCGFBmm9y~}I97R@}=(?cS04bV^FQi%x$?*c@tYXs-c?#R@BMu8%^nJ|oO05biv zMHAT_MEEO@qjlKbUfMj(WX2FuXA6rb9^8u!pR<~SgedWbgSanZ+K!&LexH-=cWe>L zY3o*1RSjx82ok%3_3s`3Onxwbg>4b+P%49t z8GM54pKp*v4oA@3P=#?1$jZw0x{8Xvq%*QVG9nZ<_=y>8^}5BKLvXG|gYP@Nwf}>| zW%^XDUTZDGjxaJF3t~arAl&;KT3Ee8P;ZI=k!dBVVN6aEo(t*m_i-H|k0Z0I@FLk2 zU+KG^vQjZ^O#UBDjPCe?NC(yo0%CP-Z7LJR4g@AQ=~oRu%XEky7=y(gGMh*oKE&@m zk+hj#o!f{EU9qc>2#v&z=Xx!7t1<{E3D*TZNc|8O7}9J$)rC-oWO8r)jJN;XeyjK5 zYt{)eJ2u~H9kXH0ZBH!7cb_O#D}1=FvXXmytgT<`H))Vf!g>`M4xo1H(Sq0?=6PL4 zS8ilK#pb*(|Ebk1AD^&QPpc2As@K17OS{wi{3$!Q$h~niL4}(r0-q}-;z$dc`H|bBAtaG)+teAVRH%E$zpu`K>c+b+qnPk)ZrO!GjkEX(W zKO*f8rl2pc(F6hSH`3IC0-Nf0KzV|Eqa|IEuTAQC?2jux=gkqmIk!hOm5W7*%q%7a z9CS8kGnMAUv1&SB3oMSl1PnY!g|{oe4a(D&p!QgQ00GnCQX}9Ci$bflNOomr7Q^%3 zc_*2%PC-6^+>+o9^RR2I-Ypzo?S(BU2_Hx~JAY?<{%|>;f;Pk73?ik4$M7|O^f;La zlZl`f;j|np0?aQ+MEH7kLIoEJyYymNR$IzQhAr9L@F;+$Oiip}C^F7lQc_Y@()aLN zN($wX(68bTt9k*B5y@}>2_jw>N6`#Q2G@8Lf#>~nazoBuKZEc7>#2Bn2<|?`J8?$2 zwq-2xJb2Jz@@?@hzGyo8tNVkpy1KfybJQZ=j*pKMG+rpZdNs6`?sK!}b6W?Xb~S;) zs$l<>qGEq{Ec1bJV z5^}VeeOyd>U>vW_3t$3-X=WhK1Y`d7>sJ9o%r$gOLXMV`RqG+XLieXriPsyZQSilE z8>f$083kIOVlZ~=Y{!+lb=jCy#%+qJ`&Av?! z(zypoeJLc6xs82H7f|9yx|JC`!JCtx52XG*)7Q!!>#Ouf9c^ALh2@67fGgVqszDd@ z%jD#+PSE?3`I?qOnDdm<=W^vq+BiUPI4_A@F` z&ojV;*GI!j_@EQ2sv21M7cb}$=yNkO7lMEb5LUd72NR?PGMv67o;HyepXbc2t*v!* z(%Kf!hSP6|+k=RyaE&xNdRr$YV20a~pcMkhxe>&ykLBZt!FKPSyD)Xp7yvvbrmuiu zz$rmY2|PVIG=ppPY$QuMblSE_q??ZPU$0z7JK^#ZsbMs|LK5gm1Eo&Ft`nv_J~n1B z5=AGF+7CZF%~AFI)N%aYjW9{08hZxW;r1esca&MkVWQL5&%{s-S4kbMP;8mmTvuW}UL<>vWqHTM;Y5VPR{+%)Da4*8%`{-r^nRe;CHN2H6%+>P+pfQn$+yp|AW47*30Su z?VBwSFCMlGGTf;r$F!rL=zl_5OTFo2hrPg;ArZ9ow)M&{>b2T~xjOOMvkx^%x1S6` zL_A|W!ge(tz{-SpBbh^WR>SA-)3XjNSkJ-F@02cg7_injM z&zn7;^vb4NQ@h-NOt^1z_(fa;uhm@s*S9@VW8Il1HN>B>3Nn4-6YQQ33SdHbR`hfb zZk4KkC#}$3;>CCW8rQxSzVc{#gBgC3=r5(R$F}4xHrz~b9P`om8mHY~5TFQ#&0ux% zmHx-ulZSp7G~QJ*Ua9HwSZJi^>jk^dmsP~zI0N%a(U%P=~*f&vp$)6%!)OWpcywZcvVG=eUNlw$NkTFpjpwCU5P zrmyErH}Q$x@b(nyu9A*2l_oEw9@B<*VO@^FQ`h?T@#FALmxIwF}?#^UFRKYf@`iIkX<`@Ga5(+uG1Xkt_|Fl>1M|6-%P;j z!Rurl;%f`97KRPfwa}u!Ww>I)^(+(ug%8Y0o$<$=T{3;j6V3u3ieBxv*}uOpt*Tmg zx{g}Uy5UpwDNs1|hR+^1CcQOLA_&DtOs(-_;C=t0qQrV$x_fG*;}ZV+tJp|P=zP)e z&PTZ{olLoRTUOHTxtA7`Lr>h@9BaPf=Ex3aNH#;Gz6dO~e&64HiyKcTRN!rzoXP}b zM3lT|3v`}uI?^^_tds_^^ZR43KUVigl_YoLN@h$cr7$00LH!mPDr;=nr9U=LG#n{v zI4kdv7MPrEN-HHcoqidi7N~veb9F61MxwjX+xfZ<&p%uDV0nJs#no|g{%Z4JgYWiy zq$~STPV^+x^W5~pnWH4bCuJTAc5>UU)`9NrOL?!d;is?1&*Nf4whD3>>NX2nHtR)A z)_27kmMGmB+ETm4;PRLUI4hK{c}wbFGW#9dtbNQH-*u(T`5RS_tG+RdUNeioe)Ec= z@k*uf?!N9(_Y-Z^%$Bya8b6Xw6qmG4?lH=t-~44|^ws$q&Z}s`oz#oRrq0+SqZY^1 zYL_L?B&njU4R)Q2tnss}UNN)tI;C>`UeF``;C)duSQ|QG%INsmZxurUu5Ijxj(G+X z|3sJ1QoB<@hi$5;aplf(N_Y!TNgp-`Z;6$JW+9-VG@H+SbV2#QlFiUEZk(zmwzAII=; z3-bKuMWjyP2H+U7f5)iUnmD=YI~YT*uC8q6HkOWt`gX=_whpGryTat)pCCDDMX8df Hdj9_brl6<> diff --git a/Package-Workspace/Infrastructure/rathole/start.sh b/Package-Workspace/Infrastructure/rathole/start.sh deleted file mode 100755 index 08774cd..0000000 --- a/Package-Workspace/Infrastructure/rathole/start.sh +++ /dev/null @@ -1,54 +0,0 @@ -#!/bin/bash -set -euo pipefail - -# Rathole runs in SERVER mode on Cloudron: the box has the public IP and -# rathole clients behind NAT dial in on the control port (container port -# 2333, bridged 1:1 by default). Tunneled services bind container ports -# 5200-5299, which Cloudron exposes in sequence from the SERVICE_PORT -# value chosen at install time. -# -# Rathole has no HTTP interface of its own, so a tiny static status page -# is served on the Cloudron HTTP port. That gives the platform a health -# check endpoint and gives the admin an auth-proxied landing page -# (httpAuth.type = proxy gates it at the platform edge). - -export RATHOLE_CONFIG="/app/data/server.toml" - -if [[ ! -f "${RATHOLE_CONFIG}" ]]; then - default_token="$(openssl rand -hex 24)" - cat > "${RATHOLE_CONFIG}" < - - - - -Rathole (server) - - - -

-

Rathole ▲ server running

-

Secure, high-performance reverse-tunnel server for NAT traversal

- -

Rathole is headless — this page exists so Cloudron has a health - endpoint and you have a landing spot. Configuration is file-based and - hot-reloads on save: edit - /app/data/server.toml with the Cloudron file manager to add - or remove tunnel services. A random default_token was - generated on first start; copy it from that file.

- - - - - - -
PortPurpose
2333Control channel — rathole clients connect here
5200–5299Tunnel exit ports — one per [server.services.*] block
HTTP (this page)Status/health only, gated by the Cloudron auth proxy
- -

Client side (on the machine behind NAT), with a matching service block on the server:

- 
[client]
-remote_addr = "your-cloudron.example.com:2333"
-
-[client.services.my_nas_ssh]
-token = "<same token as the server>"
-local_addr = "127.0.0.1:22"
- -

Upstream docs: - github.com/rathole-org/rathole

-
- - diff --git a/README.md b/README.md index ef4b2fc..340a110 100644 --- a/README.md +++ b/README.md @@ -9,9 +9,9 @@ The Cloudron component focuses on packaging upstream free/libre/open application ### 📊 Current Progress - **Total Applications**: 41 (see [GitUrlList.txt](GitUrlList.txt); pruned 2026-09-06 by rulings: no-Node, no-open-core, no-SSO-tax, k8s redirects, out-of-scope) -- **Completed Packages**: 19/41 (~46% of the post-ruling set) +- **Completed Packages**: 18/40 (~45% of the post-ruling set) - **Packaging Templates**: Created ✅ -- **Packages Committed & Pushed**: 19 ✅ +- **Packages Committed & Pushed**: 18 ✅ (rathole removed by ruling) - **Build Tickets**: rulings synced 2026-09-06 (#633-#678 batch, umbrella [#632](https://projects.knownelement.com/issues/632), Redmine project 55); grist-core excluded (packaged upstream) @@ -32,15 +32,14 @@ The Cloudron component focuses on packaging upstream free/libre/open application | 8 | draw.io | Documentation-Tools | — | 8080 | none (auth proxy) | ✅ Committed | | 9 | Windmill | Automation | ~2GB | 8000 | localstorage, postgresql | ✅ Committed | | 10 | Easy-Gate | Infrastructure | 3.18GB | 8080 | localstorage (auth proxy) | ✅ Committed | -| 11 | Rathole | Infrastructure | 3.51GB | 8000, 2333, 5200-5299 | localstorage (auth proxy) | ✅ Committed | -| 12 | Database Gateway | Infrastructure | 93.7MB | 8080 | localstorage, postgresql | ✅ Committed | -| 13 | FX | DevOps-Tools | 3.55GB | 8000 | localstorage (auth proxy) | ✅ Committed | -| 14 | ChirpStack | Infrastructure | 83.4MB | 8080 | localstorage, postgresql, redis | ✅ Committed | -| 15 | eLabFTW | Business-Apps | ~209MB (compressed) | 443 | localstorage, mysql, ldap | ✅ Committed | -| 16 | NetBox | Infrastructure | ~1GB | 8080 | localstorage, postgresql, redis | ✅ Committed | -| 17 | ConsulDemocracy | Collaboration | ~1.6GB | 3000 | localstorage, postgresql | ✅ Committed | -| 18 | GoAlert | Monitoring | ~40MB | 8081 | localstorage, postgresql | ✅ Committed | -| 19 | InvenTree | Business-Apps | ~1.4GB | 8000 | localstorage, postgresql, redis | ✅ Committed | +| 11 | Database Gateway | Infrastructure | 93.7MB | 8080 | localstorage, postgresql | ✅ Committed | +| 12 | FX | DevOps-Tools | 3.55GB | 8000 | localstorage (auth proxy) | ✅ Committed | +| 13 | ChirpStack | Infrastructure | 83.4MB | 8080 | localstorage, postgresql, redis | ✅ Committed | +| 14 | eLabFTW | Business-Apps | ~209MB (compressed) | 443 | localstorage, mysql, ldap | ✅ Committed | +| 15 | NetBox | Infrastructure | ~1GB | 8080 | localstorage, postgresql, redis | ✅ Committed | +| 16 | ConsulDemocracy | Collaboration | ~1.6GB | 3000 | localstorage, postgresql | ✅ Committed | +| 17 | GoAlert | Monitoring | ~40MB | 8081 | localstorage, postgresql | ✅ Committed | +| 18 | InvenTree | Business-Apps | ~1.4GB | 8000 | localstorage, postgresql, redis | ✅ Committed | ### 📦 Packages in Development @@ -132,7 +131,6 @@ Applications are organized by function rather than programming language: | [Fleet](https://github.com/fleetdm/fleet) | [GitHub](https://github.com/fleetdm/fleet) | Device management and monitoring | Monitoring | | [NetBox](https://github.com/netbox-community/netbox) | [GitHub](https://github.com/netbox-community/netbox) | IP address management (IPAM) and data center infrastructure management | Infrastructure | ✅ Packaged | [SeaTunnel](https://github.com/apache/seatunnel) | [GitHub](https://github.com/apache/seatunnel) | Data integration and streaming platform | Data-Management | -| [Rathole](https://github.com/rapiz1/rathole) | [GitHub](https://github.com/rapiz1/rathole) | Lightweight and high-performance reverse proxy | Infrastructure | ✅ Packaged | | [Easy-Gate](https://github.com/wiredlush/easy-gate) | [GitHub](https://github.com/wiredlush/easy-gate) | Gateway and proxy solution | Infrastructure | ✅ Packaged | | [ConsulDemocracy](https://github.com/consuldemocracy/consuldemocracy) | [GitHub](https://github.com/consuldemocracy/consuldemocracy) | Open-source citizen participation platform | Collaboration | ✅ Packaged | [BOINC](https://github.com/BOINC/boinc) | [GitHub](https://github.com/BOINC/boinc) | Open-source software for volunteer computing | Scientific-Computing | diff --git a/STATUS.md b/STATUS.md index 7c1586c..562d924 100644 --- a/STATUS.md +++ b/STATUS.md @@ -3,25 +3,23 @@ > **Human read-only. Agents maintain this file automatically after each work > session.** Do not edit by hand — the next agent run will overwrite it. > -> **Last updated:** 2026-09-06 by ZCode (GLM-5.3) — GoAlert packaged (18th; rulings synced: -> GitUrlList 56→46, no-Node policy live) -> (#648, Infrastructure, 16th package); auth gate verdict: native OIDC via -> python-social-auth (OpenIdConnectAuth + SOCIAL_AUTH_OIDC_*) wired to the -> platform provider; official-image wrapper of netboxcommunity/netbox -> v4.6.10 (netbox-docker 5.0.2), full-stack verified (migrations, Granian, -> gated RQ worker, OIDC login button). Session also finished #685's apply -> pass (memlimits script repairs + photos floor-limit). +> **Last updated:** 2026-09-06 by ZCode (GLM-5.3) — rathole REMOVED by founder +> ruling ("we will use netbird for all enterprise network access"): package dir +> deleted, GitUrlList 46→40, completed count 19→18. Landed tickets sit in +> **Feedback** (awaiting live-Cloudron UAT); builds ON HOLD pending the +> founder's queue review. Standing policies: no-Node, no-open-core, no-SSO-tax, +> netbird for network access, RustFS makes S3 a non-blocker. ## Current State: STABLE (packaging phase, ongoing) -Cloudron packaging pipeline is operational. 19 of 46 remaining-set applications are +Cloudron packaging pipeline is operational. 18 of 40 remaining-set applications are packaged, committed, and pushed. Packaging templates exist for the core patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync. All remaining apps now carry build tickets (#633-#678) under umbrella [#632](https://projects.knownelement.com/issues/632) in Redmine project 55 — ready for the sequential grind-driver pattern. -## Completed Packages (19) +## Completed Packages (18) | # | Application | Category | Pattern | Port(s) | Addons | |---|-------------|----------|---------|---------|--------| @@ -35,12 +33,11 @@ ready for the sequential grind-driver pattern. | 8 | draw.io | Documentation-Tools | Official-image wrapper + auth proxy | 8080 | none (stateless) | | 9 | Windmill | Automation | Official-image wrapper + start.sh | 8000 | localstorage, postgresql | | 10 | Easy-Gate | Infrastructure | Multi-stage (Go) + auth proxy | 8080 | localstorage | -| 11 | Rathole | Infrastructure | Pre-compiled binaries + auth proxy | 8000, 2333, 5200-5299 | localstorage | -| 12 | Database Gateway | Infrastructure | Multi-stage (Go, CGO) | 8080 | localstorage, postgresql | -| 13 | FX | DevOps-Tools | Pre-compiled binaries + auth proxy | 8000 | localstorage | -| 14 | ChirpStack | Infrastructure | Official-image wrapper | 8080 | localstorage, postgresql, redis | -| 15 | eLabFTW | Business-Apps | Official-image wrapper | 443 | localstorage, mysql, ldap | -| 16 | NetBox | Infrastructure | Official-image wrapper + start.sh | 8080 | localstorage, postgresql, redis | +| 11 | Database Gateway | Infrastructure | Multi-stage (Go, CGO) | 8080 | localstorage, postgresql | +| 12 | FX | DevOps-Tools | Pre-compiled binaries + auth proxy | 8000 | localstorage | +| 13 | ChirpStack | Infrastructure | Official-image wrapper | 8080 | localstorage, postgresql, redis | +| 14 | eLabFTW | Business-Apps | Official-image wrapper | 443 | localstorage, mysql, ldap | +| 15 | NetBox | Infrastructure | Official-image wrapper + start.sh | 8080 | localstorage, postgresql, redis | Each package lives in `Package-Workspace///` and contains a `Dockerfile`, `CloudronManifest.json`, `README.md`, `CHANGELOG.md`, `logo.png`, @@ -73,7 +70,6 @@ GitUrlList pruned 56 → 46 accordingly. | #647 | Fleet | Monitoring | GO-with-risk (SAML first-class; build parked pending ruling) | | #648 | NetBox | Infrastructure | DONE (16th package) | | #649 | SeaTunnel | Data-Management | disposition: OUT OF SCOPE (job engine) — ruling pending | -| #650 | Rathole | Infrastructure | DONE (11th package) | | #651 | Easy-Gate | Infrastructure | DONE (10th package) | | #653 | ConsulDemocracy | Collaboration | DONE (17th package, grind-verified) | | #654 | BOINC | Scientific-Computing | disposition: OUT OF SCOPE — ruling pending | @@ -118,7 +114,7 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md). | Automation | 2 | 1/2 | windmill done (huginn, runme removed) | | Business-Apps | 4 | 2/4 | elabftw, inventree done (midday, openboxes, pimcore removed) | | Collaboration | 2 | 1/2 | consuldemocracy done | -| Infrastructure | 6 | 5/6 | easy-gate, rathole, database-gateway, chirpstack, netbox done | +| Infrastructure | 5 | 4/5 | easy-gate, database-gateway, chirpstack, netbox done (rathole removed) | | Data-Management | 2 | 0/2 | datahub, seatunnel | | Security | 2 | 0/2 | tirreno pending ruling (gophish, sniperphish, sat, comply removed) | | System-Administration | 1 | 0/1 | slurm (mender removed) | @@ -135,7 +131,7 @@ Auth capability is a hard gate before packaging (see LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only (unacceptable / blocked-on-auth). -### Completed packages (19) +### Completed packages (18) | App | OIDC | LDAP | Verdict | Note | |-----|------|------|---------|------| @@ -149,7 +145,6 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only | draw.io | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` (no users, stateless) | | Windmill | yes | no | ✅ preferred | **Packaged**; OIDC configured via Admin Settings UI (no env vars) | | Easy-Gate | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` (no user concept; IP-subnet groups only) | -| Rathole | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` on the status page; tunnels secured by mandatory per-service tokens (Noise/TLS optional) | | Database Gateway | yes | no | ✅ preferred | **Packaged**; native OIDC-only app — platform provider env (`CLOUDRON_OIDC_*`) seeded into config.json; roles from the `groups` claim | | FX | n/a | n/a | 🔄 proxy | **Packaged**; CLI-only FaaS tool with no user concept — pinned binary + workspace driven from the Cloudron terminal; landing page gated by `httpAuth.type=proxy` | | ChirpStack | yes | no | ✅ preferred | **Packaged**; native `[user_authentication.openid_connect]` wired to `CLOUDRON_OIDC_*`; OIDC-registered users are non-admin — one-time `CHIRPSTACK_AUTH_MODE=internal` bootstrap links the seeded `admin` to your SSO email (README) | @@ -173,11 +168,11 @@ HOLD while the founder reviews the queue.** | Bucket | Tickets | |--------|---------| -| Landed — Feedback (awaiting UAT) | #633 #639 #640 #648 #650 #651 #653 #658 #668 #669 | +| Landed — Feedback (awaiting UAT) | #633 #639 #640 #648 #651 #653 #658 #668 #669 | | APPROVED — queued (hold) | #673 NCA Toolkit (proxy-eligible Flask API; RustFS makes S3 a non-issue) | | GO — no explicit ruling yet | #634 Tirreno (verify-only; already deployed) · #642 Rundeck (OSS LDAP, no OIDC) · #662 KillBill · #647 Fleet (SAML risk; digest banked) · #833 jamovi (new; proxy; 3-origin risk) | | GO-with-risk — no ruling yet | #637 Docassemble · #643 HyperSwitch (no-node dashboard workaround needed) · #671 Resgrid (bundle RabbitMQ) | -| KILLED by rulings (this wave) | #635 Runme · #645 OpenBoxes · #656 Gophish · #661 WireViz · #638 Pimcore (open-core) · #659 Mender (SSO tax) | +| KILLED by rulings | #635 Runme · #645 OpenBoxes · #656 Gophish · #661 WireViz · #638 Pimcore (open-core) · #659 Mender (SSO tax) · **#650 Rathole (superseded by netbird — package dir deleted)** | | → k8s queue | #636 DataHub (joins #663 #678) | | OUT OF SCOPE (ruling pending) | #646 Nautilus · #649 SeaTunnel · #654 BOINC · #655 Slurm · #672 SDRangel · #675 SAT | | Upstream gone | #657 SniperPhish (404) |