Commits now authored as VpEngOps (vault: creds/vpengops-vpentops);
reachableceo is the human personal account. grind-stack gains `sbom`
(CycloneDX via pinned syft container, run before sweep) per #834;
GLPI catalog entries planned in #835 gated on #801 write access.
AGENTS.md packaging steps extended; questions-v1.md opened for the
founder (netbird scope, SigNoz reopen, SBOM format).
Official-image wrapper of inventree/inventree 1.5.2 (digest-pinned).
allauth OIDC provider JSON built from the platform env; invoke update
on boot; RQ worker behind the web-port gate; admin seeded with a
generated password. grind-stack: lowercase image names. 19th package.
Verified: health 200, SSO route 302s to issuer, migrations clean.
Detail: https://projects.knownelement.com/issues/658#note-5086
Build from source on ruby:3.4.10-trixie (trimmed from the upstream dev
Dockerfile: no Chromium, no sudo, fixed non-root user). Uses the
postgresql and localstorage addons; start.sh regenerates
database.yml/secrets.yml under /app/data every boot, seeds the DB once
(marker file) with a local admin, runs memcached in-container, and
backgrounds a delayed_job worker gated on migrations. Platform OIDC is
wired into secrets.yml; local login stays for the seeded admin.
Also drop --rm from the app container in grind-stack.sh so a crashed
container keeps its logs for `logs`.
Serial one-at-a-time test harness: builds under ukrrs-batch.slice,
ephemeral pg/redis/mysql per manifest addons, app driven by the real
CLOUDRON_* env contract. All resources labeled cloudron.grind=1 so
down/sweep cannot touch fleet containers. AGENTS.md documents the
per-package lifecycle (up/curl/logs/down/sweep) + host resource rules.
Env var name mismatch (CLOUDRON_API_TOKEN), dash echo corrupting the
1MB apps JSON (backslash escapes), scheme-prefixed fqdn filter that
matched nothing, unset curmbMB under set -u, and the wrong endpoint
(POST /configure/memory_limit is the real route). Apply now complete:
15/16 were already at target; photos floor-limited 4096->3584 (Immich
manifest floor), task 15687, healthy.
Detail: https://projects.knownelement.com/issues/685
Staged during the postgres/connection exhaustion fix; limits had grown to
160GB total on a 62GB box while chasing the flapping. Plan/canary/apply
modes, ~28GB of slider headroom reclaim.
vpengops
mrcharles