KNEL-TSYSDevStack-SupportStack-Cloudron/STATUS.md

# Project Status

> **Human read-only. Agents maintain this file automatically after each work
> session.** Do not edit by hand — the next agent run will overwrite it.
>
> **Last updated:** 2026-09-06 by VpEngOps agent (ZCode/GLM-5.3) — rathole
> REMOVED by founder ruling ("we will use netbird for all enterprise network
> access"): package dir deleted, GitUrlList 46→36, completed count 19→18.
> Landed tickets sit in **Feedback** (awaiting live-Cloudron UAT); builds ON
> HOLD pending the founder's queue review. Standing policies: no-Node,
> no-open-core, no-SSO-tax, netbird for network access, RustFS makes S3 a
> non-blocker, ClickHouse + ActiveMQ on infra (CH/MQ reqs = not blockers;
> verify protocol compat per app). Killed tickets Closed at founder direction.
>
> IDENTITY (2026-09-06): agent commits now authored as **VpEngOps**
> <tsgstaff-coo-vpengops@turnsys.com> (vault item `creds/vpengops-vpentops`);
> `reachableceo` is the human's personal account and is no longer used by
> agents. Cloudron-side logins use the `vpentops` platform account.
> Plans filed: SBOMs **#834**, GLPI software catalog **#835** (gated on
> #801 write access). QUESTIONS go via Redmine notes on the relevant ticket
> (never .md files); longer questions and durable decision records go to
> Discourse (community.turnsys.com - API key provisioning requested on #632).

## Current State: STABLE (packaging phase, ongoing)

Cloudron packaging pipeline is operational. 18 of 40 remaining-set applications are
packaged, committed, and pushed. Packaging templates exist for the core
patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
All remaining apps now carry build tickets (#633-#678) under umbrella
[#632](https://projects.knownelement.com/issues/632) in Redmine project 55 —
ready for the sequential grind-driver pattern.

## Completed Packages (18)

| # | Application | Category | Pattern | Port(s) | Addons |
|---|-------------|----------|---------|---------|--------|
| 1 | Webhook | API-Gateway | Multi-stage (Go) | 9000 | localstorage |
| 2 | APISIX | API-Gateway | Official-image wrapper | 9080, 9180, 9443 | localstorage, etcd |
| 3 | Healthchecks | Monitoring | Django + PostgreSQL | 8000 | localstorage, postgresql |
| 4 | Review Board | Development | Django + PostgreSQL | 8080 | localstorage, postgresql |
| 5 | WireViz Web | Documentation-Tools | Python build | 3005 | localstorage |
| 6 | Puter | Development | Multi-stage (Node.js) | 4100 | localstorage, postgresql |
| 7 | Corteza | Low-Code | Pre-compiled binaries | 80 | localstorage, postgresql |
| 8 | draw.io | Documentation-Tools | Official-image wrapper + auth proxy | 8080 | none (stateless) |
| 9 | Windmill | Automation | Official-image wrapper + start.sh | 8000 | localstorage, postgresql |
| 10 | Easy-Gate | Infrastructure | Multi-stage (Go) + auth proxy | 8080 | localstorage |
| 11 | Database Gateway | Infrastructure | Multi-stage (Go, CGO) | 8080 | localstorage, postgresql |
| 12 | FX | DevOps-Tools | Pre-compiled binaries + auth proxy | 8000 | localstorage |
| 13 | ChirpStack | Infrastructure | Official-image wrapper | 8080 | localstorage, postgresql, redis |
| 14 | eLabFTW | Business-Apps | Official-image wrapper | 443 | localstorage, mysql, ldap |
| 15 | NetBox | Infrastructure | Official-image wrapper + start.sh | 8080 | localstorage, postgresql, redis |

Each package lives in `Package-Workspace/<Category>/<app>/` and contains a
`Dockerfile`, `CloudronManifest.json`, `README.md`, `CHANGELOG.md`, `logo.png`,
and (where relevant) `start.sh` + `.env.example`.

## Build Ticket Map (rulings synced 2026-09-06: 46 filed, 8 landed, 11 removed/redirected by human ruling — no-node policy, k8s lane, out-of-scope; remaining tracked below)
All under umbrella [#632](https://projects.knownelement.com/issues/632)
(Redmine `cloudron` project; moved from project 55). Excluded:
**grist-core** (packaged upstream). **Rulings synced 2026-09-06** — human
deleted 6 tickets (accepted dispositions), redirected AutoBOM/Craig to
k8s, removed Langfuse + a standing **no-Node-apps policy** (also takes
out Fonoster and PLMore/NestJS); Runme confirmed Go (not affected).
GitUrlList pruned 56 → 46 accordingly.

| Ticket | App | Category | Flavor |
|--------|-----|----------|--------|
| #633 | GoAlert | Monitoring | DONE 2026-09-06 (18th package, grind-verified) |
| #634 | Tirreno | Security | KILLED by ruling (wazuh serves this need) | CLOSED |
| #635 | Runme | Automation | KILLED by ruling (CLI tool) |
| #636 | DataHub | Data-Management | → k8s queue by ruling (was: blocked) |
| #637 | Docassemble | Legal | GO (native LDAP confirmed by founder; monolith container) |
| #638 | Pimcore | Business-Apps | KILLED by ruling (open-core license) |
| #639 | Database-Gateway | Infrastructure | DONE (12th package) |
| #640 | FX | DevOps-Tools | DONE (13th package) |
| #642 | Rundeck | Automation | KILLED by ruling (SSO tax) | CLOSED |
| #643 | HyperSwitch | Financial-Payments | KILLED by ruling | CLOSED |
| #644 | PayrollEngine | Business-Apps | BLOCKED (local-only WebApp + MSSQL) |
| #645 | OpenBoxes | Business-Apps | KILLED by ruling (local-only auth not accepted) |
| #646 | Nautilus Trader | Financial-Trading | disposition: OUT OF SCOPE (framework) — ruling pending |
| #647 | Fleet | Monitoring | GO - Keycloak SAML IdP clears auth risk; queued (hold) |
| #648 | NetBox | Infrastructure | DONE (16th package) |
| #649 | SeaTunnel | Data-Management | disposition: OUT OF SCOPE (job engine) — ruling pending |
| #651 | Easy-Gate | Infrastructure | DONE (10th package) |
| #653 | ConsulDemocracy | Collaboration | DONE (17th package, grind-verified) |
| #654 | BOINC | Scientific-Computing | disposition: OUT OF SCOPE — ruling pending |
| #655 | Slurm | System-Administration | disposition: OUT OF SCOPE — ruling pending |
| #656 | Gophish | Security | KILLED by ruling |
| #657 | SniperPhish | Security | upstream GONE (404 reconfirmed 09-06) |
| #658 | InvenTree | Business-Apps | DONE 2026-09-06 (19th package, grind-verified) |
| #659 | Mender | System-Administration | KILLED by ruling (SSO tax) |
| #661 | WireViz | Documentation-Tools | KILLED by ruling (covered by wireviz-web) |
| #662 | KillBill | Business-Apps | GO (killbill+kaui in 1 container; mariadb addon) |
| #666 | SigNoz | Monitoring | KILLED by ruling | CLOSED |
| #667 | Sentry | Monitoring | blocked: 56-service Kafka/CH mesh |
| #668 | ChirpStack | Infrastructure | DONE (14th package) |
| #669 | eLabFTW | Business-Apps | DONE (15th package) |
| #671 | Resgrid Core | Project-Management | GO-with-risk (bundle RabbitMQ; 5 processes) |
| #672 | SDRangel | Infrastructure | disposition: OUT OF SCOPE (Qt desktop) — ruling pending |
| #673 | NCA Toolkit | Low-Code | APPROVED by ruling — queued (builds on hold) |
| #675 | Security Awareness Training | Security | OUT OF SCOPE (Marp slide deck, not an app) |

## Packaging Patterns Established

1. **Official-image wrapper** — APISIX, Healthchecks, Review Board
2. **Multi-stage build** — Webhook (Go), Puter (Node.js)
3. **Python build** — WireViz Web
4. **Django + PostgreSQL** — Healthchecks, Review Board
5. **Pre-compiled binaries** — Corteza (download + extract from upstream releases)

Templates live in `Package-Templates/` (python-app, django-app, official-wrapper).
Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).

## Progress by Category

| Category | Apps | Packaged | Notes |
|----------|------|----------|-------|
| **API-Gateway** | 2 | 2/2 (100%) ✅ | Category complete |
| **Automation** | 1 | 1/1 (100%) ✅ | windmill |
| **Development** | 2 | 2/2 (100%) ✅ | reviewboard, puter |
| **DevOps-Tools** | 1 | 1/1 (100%) ✅ | fx |
| **Documentation-Tools** | 2 | 2/2 (100%) ✅ | wireviz-web, draw.io (wireviz CLI killed) |
| **Infrastructure** | 5 | 4/5 (80%) | easy-gate, database-gateway, chirpstack, netbox done (rathole removed) |
| **Business-Apps** | 4 | 2/4 | elabftw, inventree done; killbill GO, payrollengine blocked |
| **Collaboration** | 2 | 1/2 | consuldemocracy done; grist-core excluded (packaged upstream) |
| **Low-Code** | 2 | 1/2 | corteza done; nca-toolkit APPROVED |
| **Monitoring** | 4 | 2/4 | healthchecks, goalert done; fleet GO, sentry killed |
| **Data-Management** | 2 | 0/2 | datahub (k8s queue), seatunnel (ruling pending) |
| **Financial-Trading** | 1 | 0/1 | nautilus (ruling pending) |
| **Legal** | 1 | 0/1 | docassemble GO (native LDAP confirmed) |
| **Project-Management** | 1 | 0/1 | resgrid / opencad replacement under evaluation |
| **Scientific-Computing** | 2 | 0/2 | boinc (ruling pending), jamovi GO-with-risk |
| **Security** | 2 | 0/2 | both remaining security apps under ruling review |
| **System-Administration** | 1 | 0/1 | slurm (ruling pending) |
| Scientific-Computing | 2 | 0/2 | boinc, jamovi |
| Financial-Trading | 1 | 0/1 | nautilus (out-of-scope pending ruling) |
| Legal | 1 | 0/1 | docassemble |
| Project-Management | 1 | 0/1 | resgrid |

## Auth Status

Auth capability is a hard gate before packaging (see
[AGENTS.md § Authentication Policy](AGENTS.md)). ✅ = OIDC preferred, ⚠️ =
LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
(unacceptable / blocked-on-auth).

### Completed packages (18)

| App | OIDC | LDAP | Verdict | Note |
|-----|------|------|---------|------|
| Webhook | n/a | n/a | 🔄 proxy-eligible | No user concept; **auth-gap: needs `httpAuth` proxy added** |
| APISIX | plugin | plugin | ⚠️ risk | openid-connect/ldap-auth gateway plugins (edge auth, not dashboard) |
| Healthchecks | no | no | 🔄 proxy-eligible | REMOTE_USER_HEADER support; consider httpAuth proxy |
| Review Board | no | yes | ⚠️ risk (LDAP) | SAML 2.0 via plugin; built-in LDAP/AD backend |
| WireViz Web | n/a | n/a | 🔄 proxy-eligible | Stateless, no users; **auth-gap: needs `httpAuth` proxy added** |
| Puter | no | no | ❌ risk | Own user system, no SSO federation — needs revisit |
| Corteza | yes | no | ✅ preferred | Native OIDC via `auth.external.providers.openid-connect.*` |
| draw.io | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` (no users, stateless) |
| Windmill | yes | no | ✅ preferred | **Packaged**; OIDC configured via Admin Settings UI (no env vars) |
| Easy-Gate | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` (no user concept; IP-subnet groups only) |
| Database Gateway | yes | no | ✅ preferred | **Packaged**; native OIDC-only app — platform provider env (`CLOUDRON_OIDC_*`) seeded into config.json; roles from the `groups` claim |
| FX | n/a | n/a | 🔄 proxy | **Packaged**; CLI-only FaaS tool with no user concept — pinned binary + workspace driven from the Cloudron terminal; landing page gated by `httpAuth.type=proxy` |
| ChirpStack | yes | no | ✅ preferred | **Packaged**; native `[user_authentication.openid_connect]` wired to `CLOUDRON_OIDC_*`; OIDC-registered users are non-admin — one-time `CHIRPSTACK_AUTH_MODE=internal` bootstrap links the seeded `admin` to your SSO email (README) |
| eLabFTW | no | yes | ⚠️ risk (LDAP) | **Packaged**; no OIDC upstream (auth = local/SAML/LDAP per `src/Enums/AuthMethod.php`); `ldap` addon enabled, README maps `CLOUDRON_LDAP_*` → sysconfig LDAP panel — must be validated on the live Cloudron before production; SAML possible via external IdP |
| NetBox | yes | plugin | ✅ preferred | **Packaged**; python-social-auth OIDC (`REMOTE_AUTH_BACKEND=OpenIdConnectAuth` + `SOCIAL_AUTH_OIDC_*`) wired from `CLOUDRON_OIDC_*`; local Django login retained for admin bootstrap; SSO users register without privileges (README) |
| ConsulDemocracy | yes | no | ✅ preferred | **Packaged**; omniauth_openid_connect (discovery) wired into generated secrets.yml; `feature.oidc_login` auto-enabled on first boot when the provider is present (admin-panel toggle afterwards); SAML also available; local admin seeded |
| GoAlert | yes | no | ✅ preferred | **Packaged**; native generic OIDC (go-oidc, any issuer) wired via GOALERT_OIDC_* from the platform provider; new-user creation on; optional first-admin basic auth via GOALERT_ADMIN_USER/PASS; callback /api/v2/identity/providers/oidc/callback |
| InvenTree | yes | yes | ✅ preferred | **Packaged**; django-allauth openid_connect provider JSON built from CLOUDRON_OIDC_* (server_url discovery, PKCE); SSO at /accounts/oidc/cloudron/; LDAP also available; local admin seeded (generated password in /app/data/.admin_password) |

### Candidates researched

| App | OIDC | LDAP | Verdict | Note |
|-----|------|------|---------|------|
| NetBox | yes | yes | ✅ preferred | OIDC+LDAP native; Cloudron redis addon available (**corrected 2026-09-01** — earlier "no Redis" claim was wrong). Ticket #648 |
| Gophish | no | no | ❌ blocked | Local admin login only, no SSO — do not package until auth added |

**State (2026-09-06, end of disposition pass): every remaining ticket
**State (2026-09-06 evening, after the founder's ruling wave): landed
packages sit in Feedback (awaiting live-Cloudron UAT); builds are ON
HOLD while the founder reviews the queue.**

| Bucket | Tickets |
|--------|---------|
| Landed — Feedback (awaiting UAT) | #633 #639 #640 #648 #651 #653 #658 #668 #669 |
| APPROVED — queued (hold) | #673 NCA Toolkit (proxy-eligible Flask API; RustFS makes S3 a non-issue) |
| GO — no explicit ruling yet | #634 Tirreno (verify-only; already deployed) · #642 Rundeck (OSS LDAP, no OIDC) · #662 KillBill · #647 Fleet (SAML risk; digest banked) · #833 jamovi (new; proxy; 3-origin risk) |
| GO-with-risk — no ruling yet | #637 Docassemble · #643 HyperSwitch (no-node dashboard workaround needed) · #671 Resgrid (bundle RabbitMQ) |
| KILLED by rulings | #635 Runme · #645 OpenBoxes · #656 Gophish · #661 WireViz · #638 Pimcore (open-core) · #659 Mender (SSO tax) · **#650 Rathole (superseded by netbird — package dir deleted)** |
| → k8s queue | #636 DataHub (joins #663 #678) |
| OUT OF SCOPE (ruling pending) | #646 Nautilus · #649 SeaTunnel · #654 BOINC · #655 Slurm · #672 SDRangel · #675 SAT |
| Upstream gone | #657 SniperPhish (404) |
| Ruled earlier (removed) | #660 #641 #670 (no-node) · deleted: Huginn/Midday/OpenBlocks/Warp/Comply/TODO-policies |

**Standing policies (founder, 2026-09-06): no Node-served apps; no
open-core licenses; NO SSO TAX (enterprise-gated SSO = dealbreaker);
RustFS on the Cloudron makes S3-compatible storage a non-blocker.**

**Tech debt:** add `httpAuth` proxy to Webhook + WireViz Web (stateless apps);
revise Puter auth.
**Deferred:** Gophish #656 (blocked-on-auth, policy-sensitive).
**Tech debt:** add `httpAuth` proxy to Webhook + WireViz Web (stateless apps);
revise Puter auth.

## Known Issues

| Issue | Impact | Status |
|-------|--------|--------|
| **Inventory count drift** | README inventory table was missing `todogroup/policies` + `CraigChat/craig`; grist-core excluded (packaged upstream) | Fixed 2026-09-01: README reconciled to GitUrlList.txt (57); dispositions ticketed (#674, #677, #678) |
| **Erroneous "Warp" packaged marker** | README inventory row marked Warp ✅ Packaged, but Warp is a duplicate (per RESUME) and no package dir exists | Fixed in this session (README marker removed) |
| **No CI / build validation** | Packages are built but not regression-tested in a pipeline | Future: `cloudron build` + manifest lint in CI |
| **Packages not exercised on a live Cloudron** | Untested end-to-end on the production Cloudron VPS | Future: install-test a sample package |
| **Architecture is amd64-only** | Pre-compiled-binary + multi-stage packages target linux/amd64 | Acceptable for current target host |
| **SniperPhish upstream gone** | `GemGeorge/SniperPhish` 404s (deleted/private); clone impossible | Ticket #657 carries disposition; awaits ruling on GitUrlList removal |

## Pending (next session priorities)

1. **Work the build-ticket batch** (#633-#678, umbrella #632) — sequential
   headless workers, one ticket at a time (grind-driver pattern); auth gate
   first on every ticket. Night window (22:00-07:00 Central) allows wider
   parallel builds per the host day/night profile.
2. **Resolve disposition tickets** (#674, #677, #678, #661, ...) so the
   inventory reflects reality.
3. **Validate one package end-to-end** on the Cloudron VPS to prove the
   packaging patterns in production, not just at build time.
4. **Stand up CI** — `cloudron build` + CloudronManifest.json schema lint on
   every package change.
5. Continue until all packageable apps (~50 of 57 after dispositions) are
   done.

## Repository Summary

| Component | Details |
|-----------|---------|
| Goal | Package ~57 upstream FLOSS apps for Cloudron (TSYS PaaS of choice) |
| Upstream source list | [`GitUrlList.txt`](GitUrlList.txt) (41 repos after the 09-06 rulings) |
| Workspace | `Package-Workspace/<Category>/<app>/` (cloned upstream `repo/` dirs are gitignored) |
| Templates | `Package-Templates/` (python-app, django-app, official-wrapper) |
| Git remote | `ssh://git@git.knownelement.com:29418/KNEL/TSYSDevStack-SupportStack-Cloudron.git` (`origin/main`) |
| Sibling project | [`TSYSDevStack-SupportStack-LocalWorkstation`](../TSYSDevStack-SupportStack-LocalWorkstation) (local Docker-Compose dev stack) |