Founder ruling: all questions go through Redmine (notes on the
relevant ticket, or umbrella #632), longer questions and durable
decision discussion through Discourse (community.turnsys.com).
Questions migrated to #639/#651 (netbird scope), #666 (SigNoz
reopen), #834 (SBOM format); Discourse API key provisioning
requested on #632.
Commits now authored as VpEngOps (vault: creds/vpengops-vpentops);
reachableceo is the human personal account. grind-stack gains `sbom`
(CycloneDX via pinned syft container, run before sweep) per #834;
GLPI catalog entries planned in #835 gated on #801 write access.
AGENTS.md packaging steps extended; questions-v1.md opened for the
founder (netbird scope, SigNoz reopen, SBOM format).
ClickHouse + ActiveMQ will be deployed on infra - CH/MQ requirements
are no longer blockers (protocol compat verified per app: ActiveMQ
Classic is not RabbitMQ/Kafka/NATS compatible). Ten killed tickets
closed at founder direction (#635#638#641#645#650#656#659#660#661#675).
Founder ruling: "we will use netbird for all enterprise network
access." Package dir deleted (11th package, f918a90, is hereby
retired); GitUrlList 41->40; counts 19->18; completed tables
renumbered; JOURNAL section retained as history with a superseding
addendum. Standing policy recorded: netbird for network access.
Official-image wrapper of inventree/inventree 1.5.2 (digest-pinned).
allauth OIDC provider JSON built from the platform env; invoke update
on boot; RQ worker behind the web-port gate; admin seeded with a
generated password. grind-stack: lowercase image names. 19th package.
Verified: health 200, SSO route 302s to issuer, migrations clean.
Detail: https://projects.knownelement.com/issues/658#note-5086
Out-of-scope recommendations with evidence on #646#649#654#655#663#670#672#676 (framework/job-engine/infra/CLI/desktop, no
Cloudron app story) and blocked-on-auth for #664 (hosted Clerk).
Human ruling pending on GitUrlList removals.
Build from source on ruby:3.4.10-trixie (trimmed from the upstream dev
Dockerfile: no Chromium, no sudo, fixed non-root user). Uses the
postgresql and localstorage addons; start.sh regenerates
database.yml/secrets.yml under /app/data every boot, seeds the DB once
(marker file) with a local admin, runs memcached in-container, and
backgrounds a delayed_job worker gated on migrations. Platform OIDC is
wired into secrets.yml; local login stays for the seeded admin.
Also drop --rm from the app container in grind-stack.sh so a crashed
container keeps its logs for `logs`.
Serial one-at-a-time test harness: builds under ukrrs-batch.slice,
ephemeral pg/redis/mysql per manifest addons, app driven by the real
CLOUDRON_* env contract. All resources labeled cloudron.grind=1 so
down/sweep cannot touch fleet containers. AGENTS.md documents the
per-package lifecycle (up/curl/logs/down/sweep) + host resource rules.
Env var name mismatch (CLOUDRON_API_TOKEN), dash echo corrupting the
1MB apps JSON (backslash escapes), scheme-prefixed fqdn filter that
matched nothing, unset curmbMB under set -u, and the wrong endpoint
(POST /configure/memory_limit is the real route). Apply now complete:
15/16 were already at target; photos floor-limited 4096->3584 (Immich
manifest floor), task 15687, healthy.
Detail: https://projects.knownelement.com/issues/685
Staged during the postgres/connection exhaustion fix; limits had grown to
160GB total on a 62GB box while chasing the flapping. Plan/canary/apply
modes, ~28GB of slider headroom reclaim.
FX 0.9.48 ("poor man's function as a service") as the 13th package:
pre-compiled goreleaser release binary with sha256 pin on
cloudron/base:4.0.0. fx is a CLI with no user concept, so the package
is a workstation: pinned binary + persistent workspace
(functions/ssh/kube) driven from the Cloudron web terminal, with an
auth-proxied landing page as the only HTTP surface (httpAuth proxy).
Deploys target remote Docker hosts over key-based SSH or Kubernetes
via FX_KUBECONF. Build green; runtime smoke (landing page, workspace
seeding, fx -v) green. Docs gardened to 13 packages.
Ticket: https://projects.knownelement.com/issues/640
Database Gateway 0.24.0 as the 12th package: multi-stage Go build
(CGO required by the libpg_query parser, hence an alpine:3.23 runtime
matching upstream), native OIDC wired to the Cloudron platform identity
provider, postgresql addon storage with goose migrations applied at
start, jq-generated config + OPA policy seeded to /app/data. Verified
end-to-end against a throwaway postgres (migrations, policy compile,
startup to the OIDC handoff). Docs gardened to 12 packages.
Ticket: https://projects.knownelement.com/issues/639
Server-mode Rathole 0.5.0 as the 11th package: pinned upstream binary
(sha256 gate) on cloudron/base:4.0.0, control port 2333 plus a 100-port
tunnel exit range, hot-reloading config in /app/data, auth-proxy verdict
(no user concept). Verified end-to-end with a live client tunnel.
Docs gardened (STATUS/README/JOURNAL to 11 packages).
Ticket: https://projects.knownelement.com/issues/650
Easy Gate 2.0.3 dashboard hub: multi-stage Go build (static binary on
cloudron/base 3.2.0), config persisted at /app/data/easy-gate.json with
real-time hot reload. No user model (IP-subnet groups only), so the app
ships behind the Cloudron auth proxy (httpAuth.type=proxy); localstorage
addon only, no database. Build validated green + smoke test HTTP 200.
Docs synced (STATUS/README/JOURNAL at 10/~57).
Ticket: https://projects.knownelement.com/issues/651💘 Generated with Crush
Assisted-by: Crush:glm-5.2
fonoster belongs in Communication, corteza in Low-Code, comply in
Security, hyperswitch in Financial-Payments, nautilus_trader in
Financial-Trading, and the WireViz repos in Documentation-Tools.
Existing clones were moved to match; new runs land correctly.
Detail: https://projects.knownelement.com/issues/632#note-1💘 Generated with Crush
Assisted-by: Crush:glm-5.2
46 build tickets filed (#633-#678) under umbrella #632 in Redmine
project 55; STATUS.md carries the full map. NetBox re-rated as a strong
candidate (Cloudron HAS a redis addon - earlier claim was wrong). README
inventory reconciled to GitUrlList.txt (57 rows); grist-core excluded
(packaged upstream); disposition flags on warp/policies/craig.
Detail: https://projects.knownelement.com/issues/632#note-1💘 Generated with Crush
Assisted-by: Crush:glm-5.2
The old condition only accepted lines that contained whitespace, so
every plain URL was skipped and the script was a silent no-op (0/0
clones). Strip each line and process all non-empty URLs.
Detail: https://projects.knownelement.com/issues/632#note-1💘 Generated with Crush
Assisted-by: Crush:glm-5.2
Windmill is an open-source workflow-automation / internal-apps platform
that turns scripts (Python, JS/TS, Go, Bash, SQL, Rust, ...) into HTTP
endpoints, scheduled jobs, and visual flows. It is PostgreSQL-only —
it uses Postgres LISTEN/NOTIFY for job queuing, so no Redis is required,
making it a clean Cloudron fit.
- Wraps the official ghcr.io/windmill-labs/windmill:1.514.1 image in
single-container server mode (embedded default worker)
- start.sh composes DATABASE_URL from the Cloudron postgresql addon and
waits for the DB (bash /dev/tcp, no pg_isready dependency)
- HTTP port 8000, health check on /api/version, 2GB memory limit
- OIDC/SAML supported via the in-app Admin Settings UI (post-install)
- Validated end-to-end: throwaway postgres + windmill ran migrations and
returned /api/version => "CE v1.514.1", HTTP 200
Gardening: STATUS/README/JOURNAL updated (9/~57 packaged; Automation
1/4). Windmill logged as a new OIDC-preferred completed package.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
draw.io (diagrams.net) is a client-side diagramming app. It has no user
model and no server-side state (diagrams live in the browser or cloud
storage), so this is the first package to use the Cloudron
authentication-proxy pattern: httpAuth.type=proxy gates access at the
platform edge — the admin restricts who can reach it and the browser
challenges for Cloudron credentials.
- Wraps the official jgraph/drawio:24.7.17 Tomcat image (pinned, verified)
- No database / no persistent storage; installs curl for the health check
- HTTP port 8080, health check on /
- Validated: docker build + run return HTTP 200, container healthy
Gardening: STATUS/README/JOURNAL updated (8/~57 packaged); new
"official-image wrapper + auth proxy" pattern documented in JOURNAL.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
Establishes a hard auth gate before any app is packaged: OIDC is
preferred, LDAP is acceptable (flagged risk), auth-proxy for user-less
utility apps, and local-only-auth apps are blocked from packaging
until they gain SSO.
- AGENTS.md: new "Authentication Policy" section with the verdict table
and Cloudron OIDC/LDAP/proxy-auth wiring notes.
- STATUS.md: new "Auth Status" matrix assessing all 7 completed
packages + the next candidates (draw.io proxy-eligible, Windmill
OIDC, NetBox OIDC but Redis-blocked, Gophish blocked-on-auth).
Flags tech debt: Webhook/WireViz need httpAuth proxy added; Puter
auth needs revisit.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
The docs had drifted to 5/58 packaged while Corteza (and Puter) were
already committed. Reconcile the headline count to 7/~57 everywhere
per the new gardening protocol (GitUrlList.txt is the source of truth
at 57 upstream apps).
- README.md: 5/58 -> 7, add Corteza to completed table, remove false
"Warp packaged" marker (duplicate, no package), Low-Code 0/3 -> 1/3,
link STATUS/AGENTS.
- JOURNAL.md: header + repository stats 5/58 -> 7/~57.
- RESUME.md: mark superseded by STATUS.md (was 2025-01-24, referenced
dead /home/tsys paths) to avoid two competing status docs.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
Mirror the agent workflow used across sibling TSYS/KNEL repos
(PFVCluster, KNEL-AIMiddleware): a living agent-maintained STATUS.md
plus a concise AGENTS.md carrying Git Policy and an Automatic Gardening
Protocol that keeps all docs in sync.
- Add STATUS.md: completed packages table (7), per-category progress,
known issues, next priorities, repo summary. Human read-only; agents
own it.
- Rewrite AGENTS.md (384 -> 140 lines): repo layout, git policy
(atomic, conventional, commit+push without prompting), gardening
protocol, packaging quick-reference. Fixes active model (GLM-4.7 ->
GLM-5.2), stale counts, and dead /home/tsys paths.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
- Create Dockerfile downloading pre-compiled binaries
- Add CloudronManifest.json with PostgreSQL and localstorage addons
- Create README.md with comprehensive low-code platform documentation
- Add .env.example for environment configuration
- Add CHANGELOG.md for version tracking
- Add logo.png (Corteza branding)
Corteza is an open-source low-code platform for building
database-driven applications without coding.
Package includes:
- Ubuntu 22.04 base with pre-compiled Corteza binaries (436MB)
- PostgreSQL addon for database storage
- Localstorage addon for application data
- Multi-stage download (simpler than building)
- Comprehensive documentation with visual builder examples
- Form builder, report builder, page builder examples
- User management and permissions documentation
Features supported:
- Visual app builder with drag-and-drop
- Form builder for data entry
- Report builder for custom reports
- Page builder for application pages
- API builder for REST APIs
- Workflow automation with triggers
- Database-driven applications
- Multi-tenancy support
- User management with role-based permissions
- Record management with import/export
- Theme customization
- Mobile-responsive design
- Audit trail
- Security features (row-level permissions)
Environment variables:
- CORTEZA_VERSION: Corteza version (default: 2022.9.0)
- STORAGE_PATH: Data storage path (default: /app/data)
- HTTP_ADDR: HTTP address (default: 0.0.0.0:80)
- HTTP_WEBAPP_ENABLED: Enable web app (default: true)
Ports:
- 80: Main HTTP port (web interface)
Addons:
- PostgreSQL: Database storage
- Localstorage: Application data
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Create comprehensive JOURNAL.md documenting all completed packages
- Document packaging patterns, challenges, and solutions
- Update AGENTS.md to reference JOURNAL.md
- Add knowledge base for Cloudron packaging
- Include Docker best practices and optimization techniques
- Capture lessons learned for future reference
JOURNAL.md contains:
- Detailed analysis of 5 completed packages
- 7 established packaging patterns
- 5 common challenges with solutions
- Cloudron-specific considerations
- Productivity insights and metrics
- Best practices and optimization guidelines
AGENTS.md now includes:
- Reference to JOURNAL.md for detailed insights
- Packaging patterns and templates
- Common challenges and solutions
- Cloudron best practices reference
- Expertise developed through project
- Future recommendations
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Create multi-stage Dockerfile with Node.js 23.9-alpine
- Add CloudronManifest.json with PostgreSQL and localstorage addons
- Create .dockerignore to exclude Cloudron package files
- Include README.md with comprehensive Internet OS documentation
- Add .env.example for environment configuration
- Add CHANGELOG.md for version tracking
- Add logo.png (Puter branding)
Puter is "The Internet OS" - an advanced, open-source
internet operating system designed to be feature-rich, exceptionally
fast, and highly extensible.
Package includes:
- Node.js 23.9-alpine based multi-stage build (361MB)
- PostgreSQL addon for database storage
- Localstorage addon for file storage
- Multi-stage Dockerfile (build + production)
- Comprehensive documentation with usage examples
- File management, app installation, and code editing examples
Features supported:
- Internet OS in browser (full desktop experience)
- Personal cloud storage (privacy-first, self-hosted)
- Web app builder and publisher
- App Store with growing ecosystem
- Built-in file manager with drag-and-drop
- Code editor with syntax highlighting
- Terminal with bash shell
- Multi-user support with permissions
- Games platform
- Remote desktop environment
- Alternative to Dropbox, Google Drive, OneDrive
- Window management, taskbar, start menu
- Keyboard shortcuts and efficiency features
- Themes and customizable interface
Environment variables:
- NO_VAR_RUNCUME: Assume no variable issues (default: 1)
Ports:
- 4100: Main HTTP port (web interface and API)
Addons:
- PostgreSQL: Database storage
- Localstorage: File storage and user data
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Create Dockerfile with Python 3 and Graphviz
- Add CloudronManifest.json with localstorage addon
- Create requirements.txt with WireViz and Flask dependencies
- Include README.md with comprehensive diagram tool documentation
- Add .env.example for environment configuration
- Add CHANGELOG.md for version tracking
- Add logo.png (WireViz branding placeholder)
WireViz Web is a Flask-based wrapper around WireViz tool
for documenting cables, wiring harnesses, and connector pinouts.
Takes YAML files as input and produces graphical output.
Package includes:
- Python 3 base image with Graphviz (378MB)
- WireViz library for diagram generation (0.4.1)
- Flask REST API for web access
- Localstorage addon for diagram storage
- Comprehensive documentation with YAML examples
- Color coding examples (IEC, DIN, custom)
- Connector and cable examples
- Complex harness example
Features supported:
- Cable and wiring diagram generation
- YAML-based input format (human-readable, version control friendly)
- Multiple output formats (SVG, PNG, etc.)
- Automatic BOM (Bill of Materials) generation
- IEC 60757, DIN 47100, and 25-pair color codes
- Wire gauge handling (mm² and AWG)
- Extensive connector type library
- REST API for programmatic access
- PlantUML Text Encoding compatibility
Environment variables:
- FLASK_APP: Flask application (default: wireviz_web)
- PYTHONUNBUFFERED: Disable Python output buffering (default: 1)
Ports:
- 3005: Main HTTP port (web interface and API)
API endpoints:
- POST /render: Generate diagram from YAML
- Accept headers: application/yaml, image/svg+xml, image/png, text/tab-separated-values
- Outputs: SVG, PNG, BOM (TSV)
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Create Dockerfile wrapping official Healthchecks image
- Add CloudronManifest.json with PostgreSQL addon
- Create start.sh script with PostgreSQL wait and Django migrations
- Include README.md with comprehensive monitoring documentation
- Add .env.example for environment configuration
- Add CHANGELOG.md for version tracking
- Add logo.png (Healthchecks branding)
Healthchecks is a cron job monitoring service that listens
for HTTP requests and email messages (pings) from your cron
jobs and sends alerts when pings are late.
Package includes:
- Official Healthchecks Docker image wrapper (105MB)
- Cloudron PostgreSQL addon for Django database
- Automatic database migrations on startup
- Superuser creation via environment variables
- Email configuration support for alerts
- Comprehensive documentation with monitoring examples
- Examples for cron, systemd, scripts, and webhook monitoring
Features supported:
- Cron job monitoring via HTTP pings
- 25+ notification integrations (Email, SMS, Slack, Telegram, Matrix, etc.)
- Live-updating web dashboard
- Status badges for public monitoring
- Team management (projects, team members, read-only access)
- Monthly email reports
- WebAuthn 2FA support
- Tag-based organization
- Project grouping
- Detailed event logs
- Grace time configuration
- Cron expression support
Environment variables:
- SECRET_KEY: Django secret key
- ALLOWED_HOSTS: Allowed hosts (default: *)
- SITE_ROOT: Site root URL
- EMAIL_HOST/PORT/USER/PASSWORD: SMTP configuration
- SUPERUSER_EMAIL/PASSWORD: Admin account creation
Ports:
- 8000: Main HTTP port (web interface and API)
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Create Dockerfile for webhook (Go application)
- Add CloudronManifest.json with basic configuration
- Include README.md with usage documentation
- Add hooks.json.example configuration template
- Add logo.png (256x256)
- Add CHANGELOG.md for version tracking
Webhook is a lightweight configurable tool written in Go
that allows creating HTTP endpoints (hooks) on your server
for executing configured commands.
Package includes:
- Multi-stage Dockerfile using golang:1.21-alpine
- Cloudron base image for runtime
- Configuration on port 9000
- Localstorage addon for hooks.json
- 256MB memory limit
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
vpengops
mrcharles