diff --git a/GitUrlList.txt b/GitUrlList.txt index 20bf63c..5c3839a 100644 --- a/GitUrlList.txt +++ b/GitUrlList.txt @@ -1,16 +1,13 @@ https://github.com/target/goalert https://github.com/tirrenotechnologies/tirreno -https://github.com/runmedev/runme https://github.com/datahub-project/datahub https://github.com/jhpyle/docassemble -https://github.com/pimcore/pimcore https://github.com/kazhuravlev/database-gateway https://github.com/adnanh/webhook https://github.com/metrue/fx https://github.com/rundeck/rundeck https://github.com/juspay/hyperswitch https://github.com/Payroll-Engine/PayrollEngine -https://github.com/openboxes/openboxes https://github.com/nautechsystems/nautilus_trader https://github.com/apache/apisix https://github.com/gristlabs/grist-core @@ -23,10 +20,8 @@ https://github.com/wiredlush/easy-gate https://github.com/consuldemocracy/consuldemocracy https://github.com/BOINC/boinc https://github.com/SchedMD/slurm -https://github.com/gophish/gophish https://github.com/GemGeorge/SniperPhish https://github.com/inventree/InvenTree -https://github.com/mendersoftware/mender https://github.com/wireviz/wireviz-web https://github.com/wireviz/WireViz https://github.com/killbill/killbill diff --git a/README.md b/README.md index cf45ece..ef4b2fc 100644 --- a/README.md +++ b/README.md @@ -8,8 +8,8 @@ The Cloudron component focuses on packaging upstream free/libre/open application ### 📊 Current Progress -- **Total Applications**: 46 (see [GitUrlList.txt](GitUrlList.txt); pruned 2026-09-06 by human rulings: no-Node policy, k8s redirects, out-of-scope) -- **Completed Packages**: 19/46 (~41% of the post-ruling set) +- **Total Applications**: 41 (see [GitUrlList.txt](GitUrlList.txt); pruned 2026-09-06 by rulings: no-Node, no-open-core, no-SSO-tax, k8s redirects, out-of-scope) +- **Completed Packages**: 19/41 (~46% of the post-ruling set) - **Packaging Templates**: Created ✅ - **Packages Committed & Pushed**: 19 ✅ - **Build Tickets**: rulings synced 2026-09-06 (#633-#678 batch, umbrella @@ -117,17 +117,14 @@ Applications are organized by function rather than programming language: |---|---|---|---|---| | [GoAlert](https://github.com/target/goalert) | [GitHub](https://github.com/target/goalert) | On-call scheduling, escalation, and alerting platform | Monitoring | ✅ Packaged | | [Tirreno](https://github.com/tirrenotechnologies/tirreno) | [GitHub](https://github.com/tirrenotechnologies/tirreno) | Security and threat intelligence platform | Security | -| [Runme](https://github.com/runmedev/runme) | [GitHub](https://github.com/runmedev/runme) | Execute your README.md as interactive scripts | Automation | | [DataHub](https://github.com/datahub-project/datahub) | [GitHub](https://github.com/datahub-project/datahub) | Modern data stack for end-to-end data management | Data-Management | | [Docassemble](https://github.com/jhpyle/docassemble) | [GitHub](https://github.com/jhpyle/docassemble) | Open-source expert system for guided interviews | Legal | -| [Pimcore](https://github.com/pimcore/pimcore) | [GitHub](https://github.com/pimcore/pimcore) | Open-source digital experience platform | Business-Apps | | [Database-Gateway](https://github.com/kazhuravlev/database-gateway) | [GitHub](https://github.com/kazhuravlev/database-gateway) | Database gateway and connection management | Infrastructure | ✅ Packaged | | [Webhook](https://github.com/adnanh/webhook) | [GitHub](https://github.com/adnanh/webhook) | Lightweight webhook receiver | API-Gateway | ✅ Packaged | | [FX](https://github.com/metrue/fx) | [GitHub](https://github.com/metrue/fx) | Function as a Service platform | DevOps-Tools | ✅ Packaged | | [Rundeck](https://github.com/rundeck/rundeck) | [GitHub](https://github.com/rundeck/rundeck) | Job scheduling and automation platform | Automation | | [HyperSwitch](https://github.com/juspay/hyperswitch) | [GitHub](https://github.com/juspay/hyperswitch) | Open-source payment switch | Financial-Payments | | [PayrollEngine](https://github.com/Payroll-Engine/PayrollEngine) | [GitHub](https://github.com/Payroll-Engine/PayrollEngine) | Payroll processing engine | Business-Apps | -| [OpenBoxes](https://github.com/openboxes/openboxes) | [GitHub](https://github.com/openboxes/openboxes) | Supply chain management for inventory | Business-Apps | | [Nautilus Trader](https://github.com/nautechsystems/nautilus_trader) | [GitHub](https://github.com/nautechsystems/nautilus_trader) | Algorithmic trading platform | Financial-Trading | | [APISIX](https://github.com/apache/apisix) | [GitHub](https://github.com/apache/apisix) | Cloud-native API gateway | API-Gateway | ✅ Packaged | | [Grist Core](https://github.com/gristlabs/grist-core) | [GitHub](https://github.com/gristlabs/grist-core) | Modern data spreadsheet and database | Collaboration | ⏭ Excluded — packaged upstream (Cloudron App Store) | @@ -140,10 +137,8 @@ Applications are organized by function rather than programming language: | [ConsulDemocracy](https://github.com/consuldemocracy/consuldemocracy) | [GitHub](https://github.com/consuldemocracy/consuldemocracy) | Open-source citizen participation platform | Collaboration | ✅ Packaged | [BOINC](https://github.com/BOINC/boinc) | [GitHub](https://github.com/BOINC/boinc) | Open-source software for volunteer computing | Scientific-Computing | | [Slurm](https://github.com/SchedMD/slurm) | [GitHub](https://github.com/SchedMD/slurm) | Workload manager and job scheduling system | System-Administration | -| [Gophish](https://github.com/gophish/gophish) | [GitHub](https://github.com/gophish/gophish) | Open-source phishing toolkit | Security | | [SniperPhish](https://github.com/GemGeorge/SniperPhish) | [GitHub](https://github.com/GemGeorge/SniperPhish) | Phishing campaign management platform | Security | | [InvenTree](https://github.com/inventree/InvenTree) | [GitHub](https://github.com/inventree/InvenTree) | Open-source inventory management system | Business-Apps | -| [Mender](https://github.com/mendersoftware/mender) | [GitHub](https://github.com/mendersoftware/mender) | Over-the-air (OTA) software updater for IoT devices | System-Administration | | [WireViz Web](https://github.com/wireviz/wireviz-web) | [GitHub](https://github.com/wireviz/wireviz-web) | Cable and wiring harness visualization tool | Documentation-Tools | ✅ Packaged | | [WireViz](https://github.com/wireviz/WireViz) | [GitHub](https://github.com/wireviz/WireViz) | Cable and wiring harness documentation tool | Documentation-Tools | | [KillBill](https://github.com/killbill/killbill) | [GitHub](https://github.com/killbill/killbill) | Open-source subscription billing and payment platform | Business-Apps | diff --git a/STATUS.md b/STATUS.md index f298fac..7c1586c 100644 --- a/STATUS.md +++ b/STATUS.md @@ -59,16 +59,16 @@ GitUrlList pruned 56 → 46 accordingly. |--------|-----|----------|--------| | #633 | GoAlert | Monitoring | DONE 2026-09-06 (18th package, grind-verified) | | #634 | Tirreno | Security | GO (verify-only; already deployed; local auth) | -| #635 | Runme | Automation | disposition: OUT OF SCOPE (CLI/editor tool, no service) | -| #636 | DataHub | Data-Management | BLOCKED (ES + Kafka, ~8 services) | +| #635 | Runme | Automation | KILLED by ruling (CLI tool) | +| #636 | DataHub | Data-Management | → k8s queue by ruling (was: blocked) | | #637 | Docassemble | Legal | GO-with-risk (monolith container; OIDC via social config) | -| #638 | Pimcore | Business-Apps | GO-with-risk (composer build; OIDC bundle; PHP 8.4 pin) | +| #638 | Pimcore | Business-Apps | KILLED by ruling (open-core license) | | #639 | Database-Gateway | Infrastructure | DONE (12th package) | | #640 | FX | DevOps-Tools | DONE (13th package) | | #642 | Rundeck | Automation | GO (official image; OSS LDAP, no OIDC) | | #643 | HyperSwitch | Financial-Payments | GO-with-risk (no-node hit on dashboard; local auth) | | #644 | PayrollEngine | Business-Apps | BLOCKED (local-only WebApp + MSSQL) | -| #645 | OpenBoxes | Business-Apps | GO w/ explicit local-auth acceptance (LDAP = dead config) | +| #645 | OpenBoxes | Business-Apps | KILLED by ruling (local-only auth not accepted) | | #646 | Nautilus Trader | Financial-Trading | disposition: OUT OF SCOPE (framework) — ruling pending | | #647 | Fleet | Monitoring | GO-with-risk (SAML first-class; build parked pending ruling) | | #648 | NetBox | Infrastructure | DONE (16th package) | @@ -78,11 +78,11 @@ GitUrlList pruned 56 → 46 accordingly. | #653 | ConsulDemocracy | Collaboration | DONE (17th package, grind-verified) | | #654 | BOINC | Scientific-Computing | disposition: OUT OF SCOPE — ruling pending | | #655 | Slurm | System-Administration | disposition: OUT OF SCOPE — ruling pending | -| #656 | Gophish | Security | BLOCKED (local-only confirmed; phishing-console policy) | +| #656 | Gophish | Security | KILLED by ruling | | #657 | SniperPhish | Security | upstream GONE (404 reconfirmed 09-06) | | #658 | InvenTree | Business-Apps | DONE 2026-09-06 (19th package, grind-verified) | -| #659 | Mender | System-Administration | BLOCKED (Mongo + NATS + S3, ~10 services) | -| #661 | WireViz | Documentation-Tools | disposition: covered by wireviz-web package | +| #659 | Mender | System-Administration | KILLED by ruling (SSO tax) | +| #661 | WireViz | Documentation-Tools | KILLED by ruling (covered by wireviz-web) | | #662 | KillBill | Business-Apps | GO (killbill+kaui in 1 container; mariadb addon) | | #666 | SigNoz | Monitoring | blocked: OSS local-only auth + mandatory ClickHouse | | #667 | Sentry | Monitoring | blocked: 56-service Kafka/CH mesh | @@ -90,7 +90,7 @@ GitUrlList pruned 56 → 46 accordingly. | #669 | eLabFTW | Business-Apps | DONE (15th package) | | #671 | Resgrid Core | Project-Management | GO-with-risk (bundle RabbitMQ; 5 processes) | | #672 | SDRangel | Infrastructure | disposition: OUT OF SCOPE (Qt desktop) — ruling pending | -| #673 | NCA Toolkit | Low-Code | GO (Flask API-key only; proxy-eligible; stale upstream) | +| #673 | NCA Toolkit | Low-Code | APPROVED by ruling — queued (builds on hold) | | #675 | Security Awareness Training | Security | OUT OF SCOPE (Marp slide deck, not an app) | ## Packaging Patterns Established @@ -115,13 +115,13 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md). | Documentation-Tools | 3 | 2/3 | wireviz-web, draw.io done | | Low-Code | 2 | 1/2 | corteza done (openblocks removed) | | Monitoring | 5 | 2/5 | healthchecks, goalert done (langfuse removed) | -| Automation | 3 | 1/3 | windmill done (huginn removed) | -| Business-Apps | 6 | 2/6 | elabftw, inventree done (midday removed) | +| Automation | 2 | 1/2 | windmill done (huginn, runme removed) | +| Business-Apps | 4 | 2/4 | elabftw, inventree done (midday, openboxes, pimcore removed) | | Collaboration | 2 | 1/2 | consuldemocracy done | | Infrastructure | 6 | 5/6 | easy-gate, rathole, database-gateway, chirpstack, netbox done | | Data-Management | 2 | 0/2 | datahub, seatunnel | -| Security | 4 | 0/4 | tirreno, gophish, sniperphish, sat (comply removed) | -| System-Administration | 2 | 0/2 | mender, slurm | +| Security | 2 | 0/2 | tirreno pending ruling (gophish, sniperphish, sat, comply removed) | +| System-Administration | 1 | 0/1 | slurm (mender removed) | | Scientific-Computing | 2 | 0/2 | boinc, jamovi | | Financial-Payments | 1 | 0/1 | hyperswitch | | Financial-Trading | 1 | 0/1 | nautilus (out-of-scope pending ruling) | @@ -167,19 +167,28 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only | Gophish | no | no | ❌ blocked | Local admin login only, no SSO — do not package until auth added | **State (2026-09-06, end of disposition pass): every remaining ticket -carries a researched disposition note on Redmine — the full list now -awaits human rulings before any further builds.** +**State (2026-09-06 evening, after the founder's ruling wave): landed +packages sit in Feedback (awaiting live-Cloudron UAT); builds are ON +HOLD while the founder reviews the queue.** | Bucket | Tickets | |--------|---------| -| Landed (Resolved) | #633 #639 #640 #648 #650 #651 #653 #658 #668 #669 | -| GO — awaiting go-order | #634 (verify-only) · #642 Rundeck · #662 KillBill · #673 NCA Toolkit (proxy) · #645 OpenBoxes (needs explicit local-auth acceptance) · #647 Fleet (SAML risk; research+digest banked) · #833 jamovi (new ticket; proxy; 3-origin risk) | -| GO-with-risk — heavier | #637 Docassemble · #638 Pimcore · #643 HyperSwitch (no-node dashboard workaround) · #671 Resgrid (bundle RabbitMQ) | -| BLOCKED | #636 DataHub · #644 PayrollEngine · #656 Gophish · #659 Mender · #666 SigNoz · #667 Sentry | -| OUT OF SCOPE (ruling pending) | #635 Runme · #646 Nautilus · #649 SeaTunnel · #654 BOINC · #655 Slurm · #672 SDRangel · #675 SAT (slide deck) | -| Upstream gone / covered | #657 SniperPhish (404) · #661 WireViz (covered by wireviz-web) | -| Ruled already (removed/k8s) | #660 #641 #670 (no-node) · #663 #678 (k8s) · deleted: Huginn/Midday/OpenBlocks/Warp/Comply/TODO-policies | +| Landed — Feedback (awaiting UAT) | #633 #639 #640 #648 #650 #651 #653 #658 #668 #669 | +| APPROVED — queued (hold) | #673 NCA Toolkit (proxy-eligible Flask API; RustFS makes S3 a non-issue) | +| GO — no explicit ruling yet | #634 Tirreno (verify-only; already deployed) · #642 Rundeck (OSS LDAP, no OIDC) · #662 KillBill · #647 Fleet (SAML risk; digest banked) · #833 jamovi (new; proxy; 3-origin risk) | +| GO-with-risk — no ruling yet | #637 Docassemble · #643 HyperSwitch (no-node dashboard workaround needed) · #671 Resgrid (bundle RabbitMQ) | +| KILLED by rulings (this wave) | #635 Runme · #645 OpenBoxes · #656 Gophish · #661 WireViz · #638 Pimcore (open-core) · #659 Mender (SSO tax) | +| → k8s queue | #636 DataHub (joins #663 #678) | +| OUT OF SCOPE (ruling pending) | #646 Nautilus · #649 SeaTunnel · #654 BOINC · #655 Slurm · #672 SDRangel · #675 SAT | +| Upstream gone | #657 SniperPhish (404) | +| Ruled earlier (removed) | #660 #641 #670 (no-node) · deleted: Huginn/Midday/OpenBlocks/Warp/Comply/TODO-policies | +**Standing policies (founder, 2026-09-06): no Node-served apps; no +open-core licenses; NO SSO TAX (enterprise-gated SSO = dealbreaker); +RustFS on the Cloudron makes S3-compatible storage a non-blocker.** + +**Tech debt:** add `httpAuth` proxy to Webhook + WireViz Web (stateless apps); +revise Puter auth. **Deferred:** Gophish #656 (blocked-on-auth, policy-sensitive). **Tech debt:** add `httpAuth` proxy to Webhook + WireViz Web (stateless apps); revise Puter auth. @@ -215,7 +224,7 @@ revise Puter auth. | Component | Details | |-----------|---------| | Goal | Package ~57 upstream FLOSS apps for Cloudron (TSYS PaaS of choice) | -| Upstream source list | [`GitUrlList.txt`](GitUrlList.txt) (46 repos after the 09-06 rulings) | +| Upstream source list | [`GitUrlList.txt`](GitUrlList.txt) (41 repos after the 09-06 rulings) | | Workspace | `Package-Workspace///` (cloned upstream `repo/` dirs are gitignored) | | Templates | `Package-Templates/` (python-app, django-app, official-wrapper) | | Git remote | `ssh://git@git.knownelement.com:29418/KNEL/TSYSDevStack-SupportStack-Cloudron.git` (`origin/main`) |