KNEL/KNEL-TSYSDevStack-SupportStack-Cloudron
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add NetBox Cloudron package (Infrastructure) [#648]

Browse Source 
Official-image wrapper of netboxcommunity/netbox v4.6.10
(netbox-docker 5.0.2, Granian), digest-pinned. OIDC via
python-social-auth wired to the platform provider; RQ worker
backgrounded behind a web-port gate; addon waits cover the 30s
upstream DB timeout. Full-stack verified: migrations, Granian,
worker, login page + SSO button. 16/~57.

Detail + verification: https://projects.knownelement.com/issues/648#note-4976
This commit is contained in:
mrcharles
2026-09-06 06:26:54 -05:00
parent ee5344f5a5
commit cead1523ad
11 changed files with 392 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
STATUS.md
+14 -11
View File
@@ -3,23 +3,24 @@
> **Human read-only. Agents maintain this file automatically after each work
> session.** Do not edit by hand — the next agent run will overwrite it.
>
> **Last updated:** 2026-09-02 by ZCode (GLM-5.3) — eLabFTW commit landed
> (#669, Business-Apps, 15th package; packaged 2026-09-01 by Crush
> GLM-5.2, gardening finished + committed 2026-09-02 after the prior
> session ended before committing). Auth gate verdict: no OIDC upstream
> (local/SAML/LDAP only) → native LDAP wired to the platform directory
> with an auth-risk flag; official-image wrapper of elabimg 5.6.12.
> **Last updated:** 2026-09-06 by ZCode (GLM-5.3) — NetBox packaged
> (#648, Infrastructure, 16th package); auth gate verdict: native OIDC via
> python-social-auth (OpenIdConnectAuth + SOCIAL_AUTH_OIDC_*) wired to the
> platform provider; official-image wrapper of netboxcommunity/netbox
> v4.6.10 (netbox-docker 5.0.2), full-stack verified (migrations, Granian,
> gated RQ worker, OIDC login button). Session also finished #685's apply
> pass (memlimits script repairs + photos floor-limit).
## Current State: STABLE (packaging phase, ongoing)
Cloudron packaging pipeline is operational. 15 of ~57 upstream applications are
Cloudron packaging pipeline is operational. 16 of ~57 upstream applications are
packaged, committed, and pushed. Packaging templates exist for the core
patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
All remaining apps now carry build tickets (#633-#678) under umbrella
[#632](https://projects.knownelement.com/issues/632) in Redmine project 55 —
ready for the sequential grind-driver pattern.
## Completed Packages (15)
## Completed Packages (16)
| # | Application | Category | Pattern | Port(s) | Addons |
|---|-------------|----------|---------|---------|--------|
@@ -38,12 +39,13 @@ ready for the sequential grind-driver pattern.
| 13 | FX | DevOps-Tools | Pre-compiled binaries + auth proxy | 8000 | localstorage |
| 14 | ChirpStack | Infrastructure | Official-image wrapper | 8080 | localstorage, postgresql, redis |
| 15 | eLabFTW | Business-Apps | Official-image wrapper | 443 | localstorage, mysql, ldap |
| 16 | NetBox | Infrastructure | Official-image wrapper + start.sh | 8080 | localstorage, postgresql, redis |
Each package lives in `Package-Workspace/<Category>/<app>/` and contains a
`Dockerfile`, `CloudronManifest.json`, `README.md`, `CHANGELOG.md`, `logo.png`,
and (where relevant) `start.sh` + `.env.example`.
## Build Ticket Map (46 filed 2026-09-01; 40 open — 6 landed: #639, #640, #650, #651, #668, #669)
## Build Ticket Map (46 filed 2026-09-01; 39 open — 7 landed: #639, #640, #648, #650, #651, #668, #669)
All under umbrella [#632](https://projects.knownelement.com/issues/632)
(Redmine project 55, tracker Feature). Excluded: **grist-core** (a Cloudron
@@ -126,7 +128,7 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
| DevOps-Tools | 1 | 1/1 (100%) ✅ | fx done |
| Financial-Payments | 1 | 0/1 | |
| Financial-Trading | 1 | 0/1 | |
| Infrastructure | 6 | 4/6 | easy-gate, rathole, database-gateway, chirpstack done |
| Infrastructure | 6 | 5/6 | easy-gate, rathole, database-gateway, chirpstack, netbox done |
| Legal | 1 | 0/1 | |
| Project-Management | 1 | 0/1 | |
| Scientific-Computing | 2 | 0/2 | |
@@ -140,7 +142,7 @@ Auth capability is a hard gate before packaging (see
LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
(unacceptable / blocked-on-auth).
### Completed packages (15)
### Completed packages (16)
| App | OIDC | LDAP | Verdict | Note |
|-----|------|------|---------|------|
@@ -159,6 +161,7 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
| FX | n/a | n/a | 🔄 proxy | **Packaged**; CLI-only FaaS tool with no user concept — pinned binary + workspace driven from the Cloudron terminal; landing page gated by `httpAuth.type=proxy` |
| ChirpStack | yes | no | ✅ preferred | **Packaged**; native `[user_authentication.openid_connect]` wired to `CLOUDRON_OIDC_*`; OIDC-registered users are non-admin — one-time `CHIRPSTACK_AUTH_MODE=internal` bootstrap links the seeded `admin` to your SSO email (README) |
| eLabFTW | no | yes | ⚠️ risk (LDAP) | **Packaged**; no OIDC upstream (auth = local/SAML/LDAP per `src/Enums/AuthMethod.php`); `ldap` addon enabled, README maps `CLOUDRON_LDAP_*` → sysconfig LDAP panel — must be validated on the live Cloudron before production; SAML possible via external IdP |
| NetBox | yes | plugin | ✅ preferred | **Packaged**; python-social-auth OIDC (`REMOTE_AUTH_BACKEND=OpenIdConnectAuth` + `SOCIAL_AUTH_OIDC_*`) wired from `CLOUDRON_OIDC_*`; local Django login retained for admin bootstrap; SSO users register without privileges (README) |
### Candidates researched