From b9bc032d2bbc66199b93bc2355f4a16f3f4f0b26 Mon Sep 17 00:00:00 2001 From: reachableceo Date: Sun, 6 Sep 2026 18:47:20 -0500 Subject: [PATCH] feat: add GoAlert Cloudron package (Monitoring) [#633] Official-image wrapper of goalert/goalert 0.34.1 (digest-pinned), single Go binary + postgresql only. Native generic OIDC wired from the platform provider (GOALERT_OIDC_*), data-encryption key persisted, optional first-admin basic auth. grind-stack verified: full migration chain, serving, origin canonicalization correct. 18th package; category table reconciled to the 46-app set. --- JOURNAL.md | 52 +++++++++++++ .../Monitoring/goalert/.dockerignore | 1 + .../Monitoring/goalert/CHANGELOG.md | 12 +++ .../Monitoring/goalert/CloudronManifest.json | 22 ++++++ .../Monitoring/goalert/Dockerfile | 35 +++++++++ .../Monitoring/goalert/README.md | 44 +++++++++++ Package-Workspace/Monitoring/goalert/logo.png | Bin 0 -> 5065 bytes Package-Workspace/Monitoring/goalert/start.sh | 73 ++++++++++++++++++ README.md | 15 ++-- STATUS.md | 42 +++++----- 10 files changed, 269 insertions(+), 27 deletions(-) create mode 100644 Package-Workspace/Monitoring/goalert/.dockerignore create mode 100644 Package-Workspace/Monitoring/goalert/CHANGELOG.md create mode 100644 Package-Workspace/Monitoring/goalert/CloudronManifest.json create mode 100644 Package-Workspace/Monitoring/goalert/Dockerfile create mode 100644 Package-Workspace/Monitoring/goalert/README.md create mode 100644 Package-Workspace/Monitoring/goalert/logo.png create mode 100755 Package-Workspace/Monitoring/goalert/start.sh diff --git a/JOURNAL.md b/JOURNAL.md index 03ea6a2..fddaec8 100644 --- a/JOURNAL.md +++ b/JOURNAL.md @@ -1367,6 +1367,58 @@ landed mid-flight) + verification hardening follow-up --- +### 18. GoAlert (Monitoring) ✅ +**Date**: 2026-09-06 +**Application**: GoAlert — Target's open-source on-call alerting +(escalation chains, rotations, Slack/Twilio notifications, heartbeats, +status dashboards). Upstream: https://github.com/target/goalert +(Apache-2.0), v0.34.1. The cleanest Cloudron shape in the workspace: a +single Go binary, PostgreSQL as the only store, migrations automatic. + +**Ticket**: [#633](https://projects.knownelement.com/issues/633) + +**Pattern**: official-image wrapper of `goalert/goalert:0.34.1` +(amd64-manifest digest pinned; alpine + `apk add bash` for the +/dev/tcp wait loop, same as ChirpStack). + +**Auth gate verdict**: ✅ OIDC preferred. Generic OIDC is first-class in +core (config.go OIDC struct on go-oidc, any issuer): +`GOALERT_OIDC_{ENABLE,ISSUER_URL,CLIENT_ID,CLIENT_SECRET,NEWUSERS}` +wired from `CLOUDRON_OIDC_*`. Callback: +`/api/v2/identity/providers/oidc/callback` (verified in +auth/handler.go:271,392 + oidc provider appends `/callback`). +GitHub OAuth + basic auth also exist; start.sh exposes optional +first-admin basic auth via `GOALERT_ADMIN_USER/PASS` app env vars. + +**Key decisions**: + +- `GOALERT_DB_URL` built from the postgresql addon env (sslmode=disable + — the addon is on the platform network). +- `GOALERT_DATA_ENCRYPTION_KEY` persisted under /app/data (rotating it + loses encrypted notification-provider credentials). +- `GOALERT_PUBLIC_URL` ← `CLOUDRON_APP_ORIGIN`: GoAlert canonicalizes + every request to the https origin — behind Cloudron's TLS proxy that + is exactly right; during local verification every path 307s to the + origin (expected, not a loop). +- Observed under the CPUWeight-25 batch slice: `slow cycle finished` + engine warnings (~5s cycles vs the 5s threshold) — contention + artifact, not a package defect; note for live sizing. + +**Verification** (grind-stack, ephemeral postgres): build green +(small image — single binary); boot = PG wait → key generation → full +migration chain applied → serving 307→https origin on :8081; container +stable 5+ min under load. + +**Files Created**: Dockerfile, CloudronManifest.json (port 8081, +localstorage + postgresql, 1024MB, healthCheckPath /api/v2/heartbeat), +start.sh, README.md (auth table + admin bootstrap), CHANGELOG.md, +.dockerignore, logo.png (Target org avatar — repo embeds its frontend, +no logo file ships). + +**Commit**: `feat: add GoAlert Cloudron package (Monitoring) [#633]` + +--- + ## Packaging Pattern: Download Pre-Compiled Binaries ### When to Use diff --git a/Package-Workspace/Monitoring/goalert/.dockerignore b/Package-Workspace/Monitoring/goalert/.dockerignore new file mode 100644 index 0000000..f606d5e --- /dev/null +++ b/Package-Workspace/Monitoring/goalert/.dockerignore @@ -0,0 +1 @@ +repo diff --git a/Package-Workspace/Monitoring/goalert/CHANGELOG.md b/Package-Workspace/Monitoring/goalert/CHANGELOG.md new file mode 100644 index 0000000..57c0944 --- /dev/null +++ b/Package-Workspace/Monitoring/goalert/CHANGELOG.md @@ -0,0 +1,12 @@ +# Changelog — GoAlert Cloudron Package + +## 1.0.0 — 2026-09-06 + +- Initial package: GoAlert 0.34.1 (official-image wrapper, digest-pinned + sha256:36b3962e…) +- postgresql + localstorage addons; web/API on :8081; bash added for the + addon wait loop +- GOALERT_DB_URL/PUBLIC_URL mapped from the platform env; data-encryption + key persisted under /app/data +- Native OIDC wired from the platform provider, new-user creation on; + optional first-admin basic auth via GOALERT_ADMIN_USER/PASS env vars diff --git a/Package-Workspace/Monitoring/goalert/CloudronManifest.json b/Package-Workspace/Monitoring/goalert/CloudronManifest.json new file mode 100644 index 0000000..444c187 --- /dev/null +++ b/Package-Workspace/Monitoring/goalert/CloudronManifest.json @@ -0,0 +1,22 @@ +{ + "manifestVersion": 2, + "type": "app", + "id": "io.cloudron.goalert", + "title": "GoAlert", + "description": "Open-source on-call and alerting system by Target: escalation chains, rotation schedules, notification rules (Slack, Twilio SMS/voice, and more), heartbeat checks, and status dashboards. Single Go service with PostgreSQL storage; schema migrations run automatically on start. SSO via the Cloudron OIDC provider; optional basic-auth bootstrap for the first admin.", + "author": "Target Corporation / GoAlert contributors", + "website": "https://goalert.io/", + "contactEmail": "cloudron@tsys.dev", + "tagline": "On-call scheduling, escalations and alert routing", + "version": "0.34.1", + "healthCheckPath": "/api/v2/heartbeat", + "httpPort": 8081, + "memoryLimit": 1024, + "addons": { + "localstorage": {}, + "postgresql": {} + }, + "mediaLinks": [], + "changelog": "Initial Cloudron package for GoAlert 0.34.1 (official-image wrapper of goalert/goalert, digest pinned). start.sh waits for the postgresql addon, persists the data-encryption key under /app/data, maps GOALERT_DB_URL/PUBLIC_URL from the platform env, and wires native generic OIDC (GOALERT_OIDC_*) from the Cloudron OIDC provider with new-user creation enabled. Optional first-admin via GOALERT_ADMIN_USER/PASS app env vars (basic auth).", + "icon": "file://logo.png" +} diff --git a/Package-Workspace/Monitoring/goalert/Dockerfile b/Package-Workspace/Monitoring/goalert/Dockerfile new file mode 100644 index 0000000..c8319c5 --- /dev/null +++ b/Package-Workspace/Monitoring/goalert/Dockerfile @@ -0,0 +1,35 @@ +# GoAlert Cloudron Package +# +# GoAlert is Target's open-source on-call alerting system: escalation +# chains, schedules/rotations, notification rules (SMS/phone via +# Twilio/VictorOps etc., Slack), heartbeat checks, status dashboards — +# a single Go binary serving web UI + REST API on :8081 with +# PostgreSQL as the only backing store. +# +# Upstream: https://github.com/target/goalert (Apache-2.0), v0.34.1. +# - Official image goalert/goalert (alpine, /usr/bin/goalert, runs a +# build-time self-test). DB schema migrations run automatically at +# startup; no separate worker/scheduler processes. +# - Configuration is envconfig-style: GOALERT_
_ +# (GOALERT_DB_URL, GOALERT_PUBLIC_URL, GOALERT_OIDC_*, ...). +# +# Authentication: NATIVE OIDC (preferred). Generic OpenID Connect in +# core (config/config.go OIDC struct; go-oidc against any issuer): +# start.sh wires GOALERT_OIDC_ENABLE/ISSUER_URL/CLIENT_ID/CLIENT_SECRET +# from the Cloudron platform provider (CLOUDRON_OIDC_*), with +# new-user creation enabled. GitHub OAuth and basic-auth also exist. +# +# Pattern: official-image wrapper. Image pinned by tag AND digest +# (amd64 manifest digest of v0.34.1 from docker manifest inspect). +FROM goalert/goalert:v0.34.1@sha256:36b3962e3171de7ba6b964bcba21a9fee3fe331dc01d9716ee8bbd7bc01ba935 + +# bash for start.sh (alpine's ash lacks /dev/tcp used by the addon wait) +USER root +RUN apk add --no-cache bash + +COPY start.sh /app/start.sh + +# web UI + REST API; notifications are all outbound (no extra listeners) +EXPOSE 8081 + +ENTRYPOINT ["/bin/bash", "/app/start.sh"] diff --git a/Package-Workspace/Monitoring/goalert/README.md b/Package-Workspace/Monitoring/goalert/README.md new file mode 100644 index 0000000..6ad5976 --- /dev/null +++ b/Package-Workspace/Monitoring/goalert/README.md @@ -0,0 +1,44 @@ +# GoAlert — Cloudron Package + +[GoAlert](https://github.com/target/goalert) v0.34.1 — Target's open-source +on-call alerting: escalation chains, schedules and rotations, notification +rules (Slack, Twilio SMS/voice, VictorOps, ...), heartbeats, status +dashboards. A **single Go binary** with PostgreSQL as its only store — +packaged as an official-image wrapper around `goalert/goalert` +(digest-pinned), the cleanest Cloudron shape in this workspace. + +## Authentication (auth gate: ✅ OIDC preferred) + +Generic OpenID Connect is first-class in core (`config/config.go` OIDC +struct on go-oidc — any compliant issuer). `start.sh` wires it from the +Cloudron platform provider: + +| GoAlert env | Source | +|-------------|--------| +| `GOALERT_OIDC_ENABLE=true` | fixed | +| `GOALERT_OIDC_ISSUER_URL` | `CLOUDRON_OIDC_ISSUER` | +| `GOALERT_OIDC_CLIENT_ID` | `CLOUDRON_OIDC_CLIENT_ID` | +| `GOALERT_OIDC_CLIENT_SECRET` | `CLOUDRON_OIDC_CLIENT_SECRET` | +| `GOALERT_OIDC_NEWUSERS=true` | overridable (`GOALERT_OIDC_NEWUSERS`) | + +- SSO redirect: `https:///api/v2/identity/providers/oidc/callback` +- OIDC-registered users are created **without** privileges. First admin: + set `GOALERT_ADMIN_USER` + `GOALERT_ADMIN_PASS` app env vars once — + start.sh exposes them as basic auth — log in, promote your SSO account, + then unset them (README + `.env.example`). + +## Runtime layout + +| Concern | How | +|---------|-----| +| Database | Cloudron `postgresql` addon; migrations run automatically at startup | +| Encryption key | `GOALERT_DATA_ENCRYPTION_KEY` generated once, persisted in `/app/data` (rotating loses provider credentials) | +| Public URL | `GOALERT_PUBLIC_URL` ← `CLOUDRON_APP_ORIGIN` | +| Notifications | All outbound (Slack/Twilio/webhooks) — no inbound ports beyond 8081 | +| Storage | `/app/data` (localstorage) — key + future runtime files | + +## Notes + +- Version upgrades: bump tag+digest in the Dockerfile, rebuild — + migrations run on first boot. +- Package pattern + verification: repo `JOURNAL.md`, GoAlert section. diff --git a/Package-Workspace/Monitoring/goalert/logo.png b/Package-Workspace/Monitoring/goalert/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..0b976420b016ccccd7ecb157c07a68fdeecec9c1 GIT binary patch literal 5065 zcmV;)6E^ILP)30{{R3Ns^%l0001@P)t-s%F4?A z{{GF)&Gz>8&d$!}=H~3|?BnC(&(F``;Na@&>hSRJ(b3V^*x35|`snEB-{0TV)YR_o z?&Rd;^78WA+uPF8(%jtK_4W1F*Vp^|`}Fkm`1ttH(9q1x%+=M^`T6g5{PXkk*4EbX@$u{H>*C_#_xJbN z+1ZWTJHh|}65>fjK~#8N?7)W&gD?;PK+o|uy`}f;zZzl+By^XK1^@s60000000000 z000000002!s^&k=m*M=*zY_5{ZTg6|HvAL|j%fTNz3YJ8ldJNg4G$C5^2r2rPBTx%3j# zwT%E$Mj=D5!2Y3f&la#jQ(B5H6 ziW_yIxfUbkxf|%rERhyw9NKD(NfRR*nwq<$jbQ~k;x*C)Si4m*a8=f8y~LMvPxsG2FSRjA$8F9{e6y!JPEbsa?it|+Z=E5T z9On*xs?$ALC?!jG74SEc*^uN=z13sLV02Fb3MtTC%);OC`JP^{-{ZKYME9@?lu==H zR~xrAa*ST8eZd`dy36;V2+ybc&bY^}x$-vHuo&GnwV?!aOb>K%pP7A8Ow9%!+0%U) z0}9}6dSD7b#+Z&1Jhr9>mQX;A9yuWZtH>x(nG1p#=y0IEp@-%Oq}!zA3=15AaF-tG zKynjC50$0s^T28bf@;$vepmHL15p)$@xqV-@;^q$Wv-abuJgZSx5eD*I2sS>k$nTf zZRw$m1DP%9v1NoEIowRC*xFng7RMc?SDEK)%Zy8ZGps{IhaSs8VrL4V6-jTKkL9*L zupq{q%(Kl8M*p=kA*4(J)YTr4#K%?st%TFv&*~Eg;qgX&ws-0Osym2s=`q)Xq>M2I z;X#zQr(edo!h|CVe6m#2|l$eFjD4Y?84xA4XwpC@? z;FqC?hAaQnp-17&p^GyK>!`79w}LkKo+Q8QU{NSl6Z+^f62vSdX+fcMpp!L;DoB59 zPPBwpoT=3NVPy)#EkiFosrUa|GH!mWu2NE}e#^w^1 zIp@>;@8{O`c}a_s8qnEDzCp<+VO3~tO+top-dtTlYZvM2$?7Do4y_p^W`npD(;?~E zgX)=#_k>&yy`4zNNXDgX8=5;yww!H{xEVBek*o#QCOtU+$(F2YAxq*0&>fSj+sKl{ z+0fmGT-6n062>@mSCXp3sYBwX(B6r}IMQtj?V-J`RMWd%TJRFZ@l8j%;;|F7SC{G% z;+DkKpuM?N7u=dr^dL+x8<(UjOvG^Dj`od|1bNQvGkSVhyeJPj!)TbH|4 zx_9?ONwx+Kr8J};_KDXIq=$Y564Xb0G895T4e5uE#Bar^O<23*F_^59t8iElHwNKSp8npu0ASLVPHce0mrB2kD-qB6K%Ye@rSt zbDY!nvHX>2Yq&E`NeQ;l@!nzrSvxClTxjs3&rf}A2;Y)J$m<0;w2%RlR*e2md zY6*l^t6msY1@ zu~^IgqgMRKs(EaWGUMuy{>4mas=Un2vgdlQ(y$$T;#T)?nb-5JY_0fz+w3}DpYIM` z699O5u&E@mZmW)(wfy|@^iUyUrIjy~|+IwV|oixXMUS z1u?TL^>uDPWhBT;cUKeYO3O2hLYk#V=fAm#*ObC?9q8yNVOiahLR+M7yM#Unyr$5` z9Qw)2csagD;mx6+jEo1>9)&a<w$}wv-sN*6_kAxMpGe%ac}DzZg$9Q+DHQuIiMv1_4Mt&n zAOYohZNw;~sR3=YDU_l-JBs>OIrk`>jWo4~`d5@0Qwpb?cs;y0zpT@&LDsMJH|aTj z2O8K>NI6;Vr|Ultx2hD8*!=P*Nt^Dc4iGE}h}(vy~Q zEV;$`btu89(bMKglHpQx+6~CBGNvm<3QJZLAvQB0H!DXGILUP8C2m;fkeAc)DGCQ9 zi&rUHV`*dJ^(jT-14+wL)W#bwWkh3&NFGTmQ}m{J6LPUyRf-C;k+>4Yz%4c)53lG_ zbXG{-j^fd-8<2rf-&3RpNFJXCs`OVP^U70&d4zb@m8)hP~1 z#PHN{@G9n}=~CnhxRPhr!R_LUT{|}Ce77Va?y_znd5v?MQ4D+sFHsBD)Xf_HD)RGI zBq+1p8Ay&-XbveRYg|b*3$OD3&M@`>aOjh;{%r0ccIKtEtWtcKg%@cCTD&=*$*>MS z@fM>H{Lj)tj(FIYd~-@ME8wG(rsj`00Y|~S!`_;CvE8`iv{A`(VDLGAvyDhWU&x)P{Z_?A+HlES#Q?eRTmyMRJ z@6TNa{6tUMay-W=Qj(gIfAFL_$8X&X5fwSWSM&^4!1K_qImPDysjR|| zqZjwZMF|F@xXd6Ivl`~EEf;ApvX$ZsNXf72lK*!79#@4A8g3nUAFuro-kD-jfpnUp zKl$$WT*7El0L(!=CKQjEx(zRn_-%7Nde{u<5qFE2a98`6-PKNTj>buY69N?4Hs~xM?eA=~57x&q7fsj0biK)IF>I)(EvIq2O zgnyak$)IwWlpTD6RXK3nVo$RIAuS6@P47C8*h+l;PdPoMLmQHt(_#;qYxI3(A^ zPcB7?RUo}BJ+`=W4KDld?!_4o>_tPm@rU{pr3K{2OQBDdt@ZNM!zZh?I$iL9MIk~O z;iqaWmx`62Jd8M=*SiuV+&q(K#C^P2>!M-1ob1Nhx zhLB1Qpm|DEt$C4$WF#2U(E;>NiD-1bmlJR7Bo3+MKxyWl0-LTD6%*g^?(SS1xik_E zDX}rB$)PysNJ57FWpSI&FV6W^_Ou*L8GXq_7LtwcGW3iShw^xnA|M`;nNUbI=zyPI z5|WJ{W-)|xh9+9thQxZ%#)jz`l3#&FDt`1K87~iM+=W)Wv3?=7O=!kECKghcK6!D6 zbmGtspT!c=2|svAgv1umQr(Rqq}*#lsve-J$yk?=_7=2dEcFPf#-X!3ODd#BY#|MI z(A;61P)LWkLTcO4o{^(4J|qc=wK(3v+$V8UIYP=z@FwiiD?{?|-JXJ~Id~s+{}mzC zo(ySR!CSFQafful580KM#+%v~}I%HxA=@5NLD+_On z7ltZ?lo{Zy88a4BNS&xcsunojows}{q~@)V=Fx=Yt{tR+!TyPmma&G!PBy-zb{RQC zT6J-i>Sg2$srfz5RHrXhNG#{!r_^pww^i}O{g4XJgv5$v{9S6YVswKaV@OB(({OF! zwp6+12R)hPAw!zry9NDMrtaXrlvD2q>yluE3~7MxOrL&Zs|tchO-^oru3olqNUd92 z5e544akdat%Gk8&Pxj9!Z-unG)#xXGv;Ah1i2T#wf9>7dO2a@924G7x5iQgMT1`!= zQA}$*P^|C&YJz&V89`}7FTVXQ_i|WfmxX^6;E%@V>vZl?n%A~WH@avh)?+v_r(U&F zo#zu7Ue4lC>GR^lC*FYe=hNb-t$Q{`J3nd4Di))%EN`;eY8P*D000000000000000 f000000D$!g&?1*xFp3|#00000NkvXXu0mjf>(Bb5 literal 0 HcmV?d00001 diff --git a/Package-Workspace/Monitoring/goalert/start.sh b/Package-Workspace/Monitoring/goalert/start.sh new file mode 100755 index 0000000..5354a1a --- /dev/null +++ b/Package-Workspace/Monitoring/goalert/start.sh @@ -0,0 +1,73 @@ +#!/bin/bash +set -euo pipefail + +# GoAlert runtime setup for Cloudron: +# 1. wait for the postgresql addon (GoAlert's startup runs migrations +# itself, but gives up quickly if the DB is slow to accept - the +# /dev/tcp wait removes that race) +# 2. persist GOALERT_DATA_ENCRYPTION_KEY (rotating it loses encrypted +# notification-provider credentials) +# 3. map the Cloudron addon + platform env onto GOALERT_* vars +# 4. exec /usr/bin/goalert (migrations + web/API on :8081) +# +# Authentication: OIDC via the Cloudron platform provider. OIDC users +# are created on first login (NewUsers=true); they arrive WITHOUT +# admin rights - an admin logs in once with basic auth (GOALERT_BASIC_AUTH +# below, set only when the operator provides GOALERT_ADMIN_USER/PASS env) +# or via OIDC and is promoted from the admin panel. + +DATA_DIR="/app/data" +KEY_FILE="${DATA_DIR}/.data_encryption_key" + +mkdir -p "${DATA_DIR}" + +# --- 1. wait for the addon ------------------------------------------------------- +wait_tcp() { + local host="$1" port="$2" name="$3" + echo "Waiting for ${name} at ${host}:${port} ..." + until (exec 3<>"/dev/tcp/${host}/${port}") 2>/dev/null; do + echo "${name} is unavailable - sleeping" + sleep 2 + done + echo "${name} is up" +} + +DB_HOST="${CLOUDRON_POSTGRESQL_HOST:-127.0.0.1}" +DB_PORT="${CLOUDRON_POSTGRESQL_PORT:-5432}" +DB_NAME="${CLOUDRON_POSTGRESQL_DATABASE:-goalert}" +DB_USER="${CLOUDRON_POSTGRESQL_USERNAME:-goalert}" +DB_PASS="${CLOUDRON_POSTGRESQL_PASSWORD:-}" + +wait_tcp "${DB_HOST}" "${DB_PORT}" "PostgreSQL" + +# --- 2. persistent data-encryption key ------------------------------------------- +if [[ ! -s "${KEY_FILE}" ]]; then + ( umask 077; head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' > "${KEY_FILE}" ) + echo "Generated new data encryption key" +fi + +# --- 3. Cloudron -> GOALERT_* environment ---------------------------------------- +export GOALERT_DB_URL="postgres://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}?sslmode=disable" +export GOALERT_PUBLIC_URL="${CLOUDRON_APP_ORIGIN:-http://localhost}" +export GOALERT_DATA_ENCRYPTION_KEY="$(cat "${KEY_FILE}")" +export GOALERT_LISTEN=":8081" + +# optional admin bootstrap: when GOALERT_ADMIN_USER/GOALERT_ADMIN_PASS +# are set as app env vars, basic auth allows the first admin login +# (promote/deactivate the account after SSO users exist) +if [[ -n "${GOALERT_ADMIN_USER:-}" && -n "${GOALERT_ADMIN_PASS:-}" ]]; then + export GOALERT_BASIC_AUTH="${GOALERT_ADMIN_USER}:${GOALERT_ADMIN_PASS}" +else + unset GOALERT_BASIC_AUTH || true +fi + +# platform OIDC provider -> goalert oidc config +export GOALERT_OIDC_ENABLE="${GOALERT_OIDC_ENABLE:-true}" +export GOALERT_OIDC_ISSUER_URL="${CLOUDRON_OIDC_ISSUER:-}" +export GOALERT_OIDC_CLIENT_ID="${CLOUDRON_OIDC_CLIENT_ID:-}" +export GOALERT_OIDC_CLIENT_SECRET="${CLOUDRON_OIDC_CLIENT_SECRET:-}" +export GOALERT_OIDC_NEWUSERS="${GOALERT_OIDC_NEWUSERS:-true}" +export GOALERT_OIDC_OVERRIDE_NAME="${GOALERT_OIDC_OVERRIDE_NAME:-Cloudron}" + +echo "Starting GoAlert (migrations run automatically) ..." +exec /usr/bin/goalert diff --git a/README.md b/README.md index bf903a4..27c6568 100644 --- a/README.md +++ b/README.md @@ -9,9 +9,9 @@ The Cloudron component focuses on packaging upstream free/libre/open application ### 📊 Current Progress - **Total Applications**: 46 (see [GitUrlList.txt](GitUrlList.txt); pruned 2026-09-06 by human rulings: no-Node policy, k8s redirects, out-of-scope) -- **Completed Packages**: 17/~57 (~30%) +- **Completed Packages**: 18/46 (~39% of the post-ruling set) - **Packaging Templates**: Created ✅ -- **Packages Committed & Pushed**: 17 ✅ +- **Packages Committed & Pushed**: 18 ✅ - **Build Tickets**: rulings synced 2026-09-06 (#633-#678 batch, umbrella [#632](https://projects.knownelement.com/issues/632), Redmine project 55); grist-core excluded (packaged upstream) @@ -39,6 +39,7 @@ The Cloudron component focuses on packaging upstream free/libre/open application | 15 | eLabFTW | Business-Apps | ~209MB (compressed) | 443 | localstorage, mysql, ldap | ✅ Committed | | 16 | NetBox | Infrastructure | ~1GB | 8080 | localstorage, postgresql, redis | ✅ Committed | | 17 | ConsulDemocracy | Collaboration | ~1.6GB | 3000 | localstorage, postgresql | ✅ Committed | +| 18 | GoAlert | Monitoring | ~40MB | 8081 | localstorage, postgresql | ✅ Committed | ### 📦 Packages in Development @@ -113,7 +114,7 @@ Applications are organized by function rather than programming language: | Application Name | Repository | Description | Functional Category | Package Status | |---|---|---|---|---| -| [GoAlert](https://github.com/target/goalert) | [GitHub](https://github.com/target/goalert) | On-call scheduling, escalation, and alerting platform | Monitoring | +| [GoAlert](https://github.com/target/goalert) | [GitHub](https://github.com/target/goalert) | On-call scheduling, escalation, and alerting platform | Monitoring | ✅ Packaged | | [Tirreno](https://github.com/tirrenotechnologies/tirreno) | [GitHub](https://github.com/tirrenotechnologies/tirreno) | Security and threat intelligence platform | Security | | [Runme](https://github.com/runmedev/runme) | [GitHub](https://github.com/runmedev/runme) | Execute your README.md as interactive scripts | Automation | | [DataHub](https://github.com/datahub-project/datahub) | [GitHub](https://github.com/datahub-project/datahub) | Modern data stack for end-to-end data management | Data-Management | @@ -131,11 +132,11 @@ Applications are organized by function rather than programming language: | [Grist Core](https://github.com/gristlabs/grist-core) | [GitHub](https://github.com/gristlabs/grist-core) | Modern data spreadsheet and database | Collaboration | ⏭ Excluded — packaged upstream (Cloudron App Store) | | [Healthchecks](https://github.com/healthchecks/healthchecks) | [GitHub](https://github.com/healthchecks/healthchecks) | Cron job monitoring service | Monitoring | ✅ Packaged | | [Fleet](https://github.com/fleetdm/fleet) | [GitHub](https://github.com/fleetdm/fleet) | Device management and monitoring | Monitoring | -| [NetBox](https://github.com/netbox-community/netbox) | [GitHub](https://github.com/netbox-community/netbox) | IP address management (IPAM) and data center infrastructure management | Infrastructure | +| [NetBox](https://github.com/netbox-community/netbox) | [GitHub](https://github.com/netbox-community/netbox) | IP address management (IPAM) and data center infrastructure management | Infrastructure | ✅ Packaged | [SeaTunnel](https://github.com/apache/seatunnel) | [GitHub](https://github.com/apache/seatunnel) | Data integration and streaming platform | Data-Management | | [Rathole](https://github.com/rapiz1/rathole) | [GitHub](https://github.com/rapiz1/rathole) | Lightweight and high-performance reverse proxy | Infrastructure | ✅ Packaged | | [Easy-Gate](https://github.com/wiredlush/easy-gate) | [GitHub](https://github.com/wiredlush/easy-gate) | Gateway and proxy solution | Infrastructure | ✅ Packaged | -| [ConsulDemocracy](https://github.com/consuldemocracy/consuldemocracy) | [GitHub](https://github.com/consuldemocracy/consuldemocracy) | Open-source citizen participation platform | Collaboration | +| [ConsulDemocracy](https://github.com/consuldemocracy/consuldemocracy) | [GitHub](https://github.com/consuldemocracy/consuldemocracy) | Open-source citizen participation platform | Collaboration | ✅ Packaged | [BOINC](https://github.com/BOINC/boinc) | [GitHub](https://github.com/BOINC/boinc) | Open-source software for volunteer computing | Scientific-Computing | | [Slurm](https://github.com/SchedMD/slurm) | [GitHub](https://github.com/SchedMD/slurm) | Workload manager and job scheduling system | System-Administration | | [Gophish](https://github.com/gophish/gophish) | [GitHub](https://github.com/gophish/gophish) | Open-source phishing toolkit | Security | @@ -149,14 +150,14 @@ Applications are organized by function rather than programming language: | [SigNoz](https://github.com/SigNoz/signoz) | [GitHub](https://github.com/SigNoz/signoz) | Open-source observability platform | Monitoring | | [Sentry](https://github.com/getsentry/sentry) | [GitHub](https://github.com/getsentry/sentry) | Error tracking and performance monitoring | Monitoring | | [ChirpStack](https://github.com/chirpstack/chirpstack) | [GitHub](https://github.com/chirpstack/chirpstack) | Open-source LoRaWAN network server | Infrastructure | ✅ Packaged | -| [eLabFTW](https://github.com/elabftw/elabftw) | [GitHub](https://github.com/elabftw/elabftw) | Electronic lab notebook for research teams | Business-Apps | +| [eLabFTW](https://github.com/elabftw/elabftw) | [GitHub](https://github.com/elabftw/elabftw) | Electronic lab notebook for research teams | Business-Apps | ✅ Packaged | [Jamovi](https://github.com/jamovi/jamovi) | [GitHub](https://github.com/jamovi/jamovi) | Statistical spreadsheet software | Scientific-Computing | | [Review Board](https://github.com/reviewboard/reviewboard) | [GitHub](https://github.com/reviewboard/reviewboard) | Code review and collaboration tool | Development | ✅ Packaged | | [Core](https://github.com/Resgrid/Core) | [GitHub](https://github.com/Resgrid/Core) | Emergency management and incident response system | Project-Management | | [SDRangel](https://github.com/f4exb/sdrangel) | [GitHub](https://github.com/f4exb/sdrangel) | Software defined radio application | Infrastructure | | [No-Code Architects Toolkit](https://github.com/stephengpope/no-code-architects-toolkit) | [GitHub](https://github.com/stephengpope/no-code-architects-toolkit) | No-code development toolkit | Low-Code | | [Windmill](https://github.com/windmill-labs/windmill) | [GitHub](https://github.com/windmill-labs/windmill) | Open-source workflow automation platform | Automation | ✅ Packaged | -| [Corteza](https://github.com/cortezaproject/corteza) | [GitHub](https://github.com/cortezaproject/corteza) | Open-source low-code platform | Low-Code | +| [Corteza](https://github.com/cortezaproject/corteza) | [GitHub](https://github.com/cortezaproject/corteza) | Open-source low-code platform | Low-Code | ✅ Packaged | [Security Awareness Training](https://github.com/security-companion/security-awareness-training) | [GitHub](https://github.com/security-companion/security-awareness-training) | Security awareness training platform | Security | | [Puter](https://github.com/HeyPuter/puter) | [GitHub](https://github.com/HeyPuter/puter) | The Internet OS - Personal Cloud Computer | Development | ✅ Packaged | diff --git a/STATUS.md b/STATUS.md index a2e44f3..6fb6787 100644 --- a/STATUS.md +++ b/STATUS.md @@ -3,7 +3,8 @@ > **Human read-only. Agents maintain this file automatically after each work > session.** Do not edit by hand — the next agent run will overwrite it. > -> **Last updated:** 2026-09-06 by ZCode (GLM-5.3) — ConsulDemocracy packaged (17th; verified via grind lifecycle) +> **Last updated:** 2026-09-06 by ZCode (GLM-5.3) — GoAlert packaged (18th; rulings synced: +> GitUrlList 56→46, no-Node policy live) > (#648, Infrastructure, 16th package); auth gate verdict: native OIDC via > python-social-auth (OpenIdConnectAuth + SOCIAL_AUTH_OIDC_*) wired to the > platform provider; official-image wrapper of netboxcommunity/netbox @@ -13,14 +14,14 @@ ## Current State: STABLE (packaging phase, ongoing) -Cloudron packaging pipeline is operational. 17 of ~57 upstream applications are +Cloudron packaging pipeline is operational. 18 of 46 remaining-set applications are packaged, committed, and pushed. Packaging templates exist for the core patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync. All remaining apps now carry build tickets (#633-#678) under umbrella [#632](https://projects.knownelement.com/issues/632) in Redmine project 55 — ready for the sequential grind-driver pattern. -## Completed Packages (17) +## Completed Packages (18) | # | Application | Category | Pattern | Port(s) | Addons | |---|-------------|----------|---------|---------|--------| @@ -56,7 +57,7 @@ GitUrlList pruned 56 → 46 accordingly. | Ticket | App | Category | Flavor | |--------|-----|----------|--------| -| #633 | GoAlert | Monitoring | GO: verify passed 2026-09-06, commit landing next | +| #633 | GoAlert | Monitoring | DONE 2026-09-06 (18th package, grind-verified) | | #634 | Tirreno | Security | build (already live on Cloudron — verify packaging need) | | #635 | Runme | Automation | pending service-story ruling (Go CLI runner, NOT node) | | #636 | DataHub | Data-Management | build (heavy; disposition risk) | @@ -105,27 +106,27 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md). ## Progress by Category +| Category | Apps | Packaged | Notes | | Category | Apps | Packaged | Notes | |----------|------|----------|-------| | **API-Gateway** | 2 | 2/2 (100%) ✅ | Category complete | -| Development | 4 | 2/4 | reviewboard, puter done | +| **DevOps-Tools** | 1 | 1/1 (100%) ✅ | Category complete | +| **Development** | 2 | 2/2 (100%) ✅ | reviewboard, puter (autobom removed) | | Documentation-Tools | 3 | 2/3 | wireviz-web, draw.io done | -| Low-Code | 3 | 1/3 | corteza done | -| Monitoring | 6 | 1/6 | healthchecks done | -| Automation | 4 | 1/4 | windmill done | -| Business-Apps | 8 | 1/8 | elabftw done | +| Low-Code | 2 | 1/2 | corteza done (openblocks removed) | +| Monitoring | 5 | 2/5 | healthchecks, goalert done (langfuse removed) | +| Automation | 3 | 1/3 | windmill done (huginn removed) | +| Business-Apps | 6 | 1/6 | elabftw done (midday removed) | | Collaboration | 2 | 1/2 | consuldemocracy done | -| Communication | 1 | 0/1 | | -| Data-Management | 2 | 0/2 | | -| DevOps-Tools | 1 | 1/1 (100%) ✅ | fx done | -| Financial-Payments | 1 | 0/1 | | -| Financial-Trading | 1 | 0/1 | | | Infrastructure | 6 | 5/6 | easy-gate, rathole, database-gateway, chirpstack, netbox done | -| Legal | 1 | 0/1 | | -| Project-Management | 1 | 0/1 | | -| Scientific-Computing | 2 | 0/2 | | -| Security | 5 | 0/5 | | -| System-Administration | 2 | 0/2 | | +| Data-Management | 2 | 0/2 | datahub, seatunnel | +| Security | 4 | 0/4 | tirreno, gophish, sniperphish, sat (comply removed) | +| System-Administration | 2 | 0/2 | mender, slurm | +| Scientific-Computing | 2 | 0/2 | boinc, jamovi | +| Financial-Payments | 1 | 0/1 | hyperswitch | +| Financial-Trading | 1 | 0/1 | nautilus (out-of-scope pending ruling) | +| Legal | 1 | 0/1 | docassemble | +| Project-Management | 1 | 0/1 | resgrid | ## Auth Status @@ -134,7 +135,7 @@ Auth capability is a hard gate before packaging (see LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only (unacceptable / blocked-on-auth). -### Completed packages (17) +### Completed packages (18) | App | OIDC | LDAP | Verdict | Note | |-----|------|------|---------|------| @@ -155,6 +156,7 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only | eLabFTW | no | yes | ⚠️ risk (LDAP) | **Packaged**; no OIDC upstream (auth = local/SAML/LDAP per `src/Enums/AuthMethod.php`); `ldap` addon enabled, README maps `CLOUDRON_LDAP_*` → sysconfig LDAP panel — must be validated on the live Cloudron before production; SAML possible via external IdP | | NetBox | yes | plugin | ✅ preferred | **Packaged**; python-social-auth OIDC (`REMOTE_AUTH_BACKEND=OpenIdConnectAuth` + `SOCIAL_AUTH_OIDC_*`) wired from `CLOUDRON_OIDC_*`; local Django login retained for admin bootstrap; SSO users register without privileges (README) | | ConsulDemocracy | yes | no | ✅ preferred | **Packaged**; omniauth_openid_connect (discovery) wired into generated secrets.yml; `feature.oidc_login` auto-enabled on first boot when the provider is present (admin-panel toggle afterwards); SAML also available; local admin seeded | +| GoAlert | yes | no | ✅ preferred | **Packaged**; native generic OIDC (go-oidc, any issuer) wired via GOALERT_OIDC_* from the platform provider; new-user creation on; optional first-admin basic auth via GOALERT_ADMIN_USER/PASS; callback /api/v2/identity/providers/oidc/callback | ### Candidates researched