Founder direction. Active upstream (AGPL, official docker image
openenergymonitor/emoncms 11.6.10). AUTH GATE: local-only (no
OIDC/LDAP/SAML in core) - package does NOT ship until the founder
explicitly accepts local auth, per policy. Also restored wireviz-web
to GitUrlList (over-pruned during the wireviz CLI kill - it is a
shipped package). Set: 36 apps, 18 packaged.
Founder ruling: all questions go through Redmine (notes on the
relevant ticket, or umbrella #632), longer questions and durable
decision discussion through Discourse (community.turnsys.com).
Questions migrated to #639/#651 (netbird scope), #666 (SigNoz
reopen), #834 (SBOM format); Discourse API key provisioning
requested on #632.
Commits now authored as VpEngOps (vault: creds/vpengops-vpentops);
reachableceo is the human personal account. grind-stack gains `sbom`
(CycloneDX via pinned syft container, run before sweep) per #834;
GLPI catalog entries planned in #835 gated on #801 write access.
AGENTS.md packaging steps extended; questions-v1.md opened for the
founder (netbird scope, SigNoz reopen, SBOM format).
ClickHouse + ActiveMQ will be deployed on infra - CH/MQ requirements
are no longer blockers (protocol compat verified per app: ActiveMQ
Classic is not RabbitMQ/Kafka/NATS compatible). Ten killed tickets
closed at founder direction (#635#638#641#645#650#656#659#660#661#675).
Founder ruling: "we will use netbird for all enterprise network
access." Package dir deleted (11th package, f918a90, is hereby
retired); GitUrlList 41->40; counts 19->18; completed tables
renumbered; JOURNAL section retained as history with a superseding
addendum. Standing policy recorded: netbird for network access.
Official-image wrapper of inventree/inventree 1.5.2 (digest-pinned).
allauth OIDC provider JSON built from the platform env; invoke update
on boot; RQ worker behind the web-port gate; admin seeded with a
generated password. grind-stack: lowercase image names. 19th package.
Verified: health 200, SSO route 302s to issuer, migrations clean.
Detail: https://projects.knownelement.com/issues/658#note-5086
Out-of-scope recommendations with evidence on #646#649#654#655#663#670#672#676 (framework/job-engine/infra/CLI/desktop, no
Cloudron app story) and blocked-on-auth for #664 (hosted Clerk).
Human ruling pending on GitUrlList removals.
FX 0.9.48 ("poor man's function as a service") as the 13th package:
pre-compiled goreleaser release binary with sha256 pin on
cloudron/base:4.0.0. fx is a CLI with no user concept, so the package
is a workstation: pinned binary + persistent workspace
(functions/ssh/kube) driven from the Cloudron web terminal, with an
auth-proxied landing page as the only HTTP surface (httpAuth proxy).
Deploys target remote Docker hosts over key-based SSH or Kubernetes
via FX_KUBECONF. Build green; runtime smoke (landing page, workspace
seeding, fx -v) green. Docs gardened to 13 packages.
Ticket: https://projects.knownelement.com/issues/640
Database Gateway 0.24.0 as the 12th package: multi-stage Go build
(CGO required by the libpg_query parser, hence an alpine:3.23 runtime
matching upstream), native OIDC wired to the Cloudron platform identity
provider, postgresql addon storage with goose migrations applied at
start, jq-generated config + OPA policy seeded to /app/data. Verified
end-to-end against a throwaway postgres (migrations, policy compile,
startup to the OIDC handoff). Docs gardened to 12 packages.
Ticket: https://projects.knownelement.com/issues/639
Server-mode Rathole 0.5.0 as the 11th package: pinned upstream binary
(sha256 gate) on cloudron/base:4.0.0, control port 2333 plus a 100-port
tunnel exit range, hot-reloading config in /app/data, auth-proxy verdict
(no user concept). Verified end-to-end with a live client tunnel.
Docs gardened (STATUS/README/JOURNAL to 11 packages).
Ticket: https://projects.knownelement.com/issues/650
Easy Gate 2.0.3 dashboard hub: multi-stage Go build (static binary on
cloudron/base 3.2.0), config persisted at /app/data/easy-gate.json with
real-time hot reload. No user model (IP-subnet groups only), so the app
ships behind the Cloudron auth proxy (httpAuth.type=proxy); localstorage
addon only, no database. Build validated green + smoke test HTTP 200.
Docs synced (STATUS/README/JOURNAL at 10/~57).
Ticket: https://projects.knownelement.com/issues/651💘 Generated with Crush
Assisted-by: Crush:glm-5.2
46 build tickets filed (#633-#678) under umbrella #632 in Redmine
project 55; STATUS.md carries the full map. NetBox re-rated as a strong
candidate (Cloudron HAS a redis addon - earlier claim was wrong). README
inventory reconciled to GitUrlList.txt (57 rows); grist-core excluded
(packaged upstream); disposition flags on warp/policies/craig.
Detail: https://projects.knownelement.com/issues/632#note-1💘 Generated with Crush
Assisted-by: Crush:glm-5.2
Windmill is an open-source workflow-automation / internal-apps platform
that turns scripts (Python, JS/TS, Go, Bash, SQL, Rust, ...) into HTTP
endpoints, scheduled jobs, and visual flows. It is PostgreSQL-only —
it uses Postgres LISTEN/NOTIFY for job queuing, so no Redis is required,
making it a clean Cloudron fit.
- Wraps the official ghcr.io/windmill-labs/windmill:1.514.1 image in
single-container server mode (embedded default worker)
- start.sh composes DATABASE_URL from the Cloudron postgresql addon and
waits for the DB (bash /dev/tcp, no pg_isready dependency)
- HTTP port 8000, health check on /api/version, 2GB memory limit
- OIDC/SAML supported via the in-app Admin Settings UI (post-install)
- Validated end-to-end: throwaway postgres + windmill ran migrations and
returned /api/version => "CE v1.514.1", HTTP 200
Gardening: STATUS/README/JOURNAL updated (9/~57 packaged; Automation
1/4). Windmill logged as a new OIDC-preferred completed package.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
draw.io (diagrams.net) is a client-side diagramming app. It has no user
model and no server-side state (diagrams live in the browser or cloud
storage), so this is the first package to use the Cloudron
authentication-proxy pattern: httpAuth.type=proxy gates access at the
platform edge — the admin restricts who can reach it and the browser
challenges for Cloudron credentials.
- Wraps the official jgraph/drawio:24.7.17 Tomcat image (pinned, verified)
- No database / no persistent storage; installs curl for the health check
- HTTP port 8080, health check on /
- Validated: docker build + run return HTTP 200, container healthy
Gardening: STATUS/README/JOURNAL updated (8/~57 packaged); new
"official-image wrapper + auth proxy" pattern documented in JOURNAL.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
Establishes a hard auth gate before any app is packaged: OIDC is
preferred, LDAP is acceptable (flagged risk), auth-proxy for user-less
utility apps, and local-only-auth apps are blocked from packaging
until they gain SSO.
- AGENTS.md: new "Authentication Policy" section with the verdict table
and Cloudron OIDC/LDAP/proxy-auth wiring notes.
- STATUS.md: new "Auth Status" matrix assessing all 7 completed
packages + the next candidates (draw.io proxy-eligible, Windmill
OIDC, NetBox OIDC but Redis-blocked, Gophish blocked-on-auth).
Flags tech debt: Webhook/WireViz need httpAuth proxy added; Puter
auth needs revisit.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
Mirror the agent workflow used across sibling TSYS/KNEL repos
(PFVCluster, KNEL-AIMiddleware): a living agent-maintained STATUS.md
plus a concise AGENTS.md carrying Git Policy and an Automatic Gardening
Protocol that keeps all docs in sync.
- Add STATUS.md: completed packages table (7), per-category progress,
known issues, next priorities, repo summary. Human read-only; agents
own it.
- Rewrite AGENTS.md (384 -> 140 lines): repo layout, git policy
(atomic, conventional, commit+push without prompting), gardening
protocol, packaging quick-reference. Fixes active model (GLM-4.7 ->
GLM-5.2), stale counts, and dead /home/tsys paths.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
vpengops
mrcharles