mrcharles
b9bc032d2b
Official-image wrapper of goalert/goalert 0.34.1 (digest-pinned), single Go binary + postgresql only. Native generic OIDC wired from the platform provider (GOALERT_OIDC_*), data-encryption key persisted, optional first-admin basic auth. grind-stack verified: full migration chain, serving, origin canonicalization correct. 18th package; category table reconciled to the 46-app set.
14 KiB
14 KiB
Project Status
Human read-only. Agents maintain this file automatically after each work session. Do not edit by hand — the next agent run will overwrite it.
Last updated: 2026-09-06 by ZCode (GLM-5.3) — GoAlert packaged (18th; rulings synced: GitUrlList 56→46, no-Node policy live) (#648, Infrastructure, 16th package); auth gate verdict: native OIDC via python-social-auth (OpenIdConnectAuth + SOCIAL_AUTH_OIDC_*) wired to the platform provider; official-image wrapper of netboxcommunity/netbox v4.6.10 (netbox-docker 5.0.2), full-stack verified (migrations, Granian, gated RQ worker, OIDC login button). Session also finished #685's apply pass (memlimits script repairs + photos floor-limit).
Current State: STABLE (packaging phase, ongoing)
Cloudron packaging pipeline is operational. 18 of 46 remaining-set applications are packaged, committed, and pushed. Packaging templates exist for the core patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync. All remaining apps now carry build tickets (#633-#678) under umbrella #632 in Redmine project 55 — ready for the sequential grind-driver pattern.
Completed Packages (18)
| # | Application | Category | Pattern | Port(s) | Addons |
|---|---|---|---|---|---|
| 1 | Webhook | API-Gateway | Multi-stage (Go) | 9000 | localstorage |
| 2 | APISIX | API-Gateway | Official-image wrapper | 9080, 9180, 9443 | localstorage, etcd |
| 3 | Healthchecks | Monitoring | Django + PostgreSQL | 8000 | localstorage, postgresql |
| 4 | Review Board | Development | Django + PostgreSQL | 8080 | localstorage, postgresql |
| 5 | WireViz Web | Documentation-Tools | Python build | 3005 | localstorage |
| 6 | Puter | Development | Multi-stage (Node.js) | 4100 | localstorage, postgresql |
| 7 | Corteza | Low-Code | Pre-compiled binaries | 80 | localstorage, postgresql |
| 8 | draw.io | Documentation-Tools | Official-image wrapper + auth proxy | 8080 | none (stateless) |
| 9 | Windmill | Automation | Official-image wrapper + start.sh | 8000 | localstorage, postgresql |
| 10 | Easy-Gate | Infrastructure | Multi-stage (Go) + auth proxy | 8080 | localstorage |
| 11 | Rathole | Infrastructure | Pre-compiled binaries + auth proxy | 8000, 2333, 5200-5299 | localstorage |
| 12 | Database Gateway | Infrastructure | Multi-stage (Go, CGO) | 8080 | localstorage, postgresql |
| 13 | FX | DevOps-Tools | Pre-compiled binaries + auth proxy | 8000 | localstorage |
| 14 | ChirpStack | Infrastructure | Official-image wrapper | 8080 | localstorage, postgresql, redis |
| 15 | eLabFTW | Business-Apps | Official-image wrapper | 443 | localstorage, mysql, ldap |
| 16 | NetBox | Infrastructure | Official-image wrapper + start.sh | 8080 | localstorage, postgresql, redis |
Each package lives in Package-Workspace/<Category>/<app>/ and contains a
Dockerfile, CloudronManifest.json, README.md, CHANGELOG.md, logo.png,
and (where relevant) start.sh + .env.example.
Build Ticket Map (rulings synced 2026-09-06: 46 filed, 8 landed, 11 removed/redirected by human ruling — no-node policy, k8s lane, out-of-scope; remaining tracked below)
All under umbrella #632
(Redmine cloudron project; moved from project 55). Excluded:
grist-core (packaged upstream). Rulings synced 2026-09-06 — human
deleted 6 tickets (accepted dispositions), redirected AutoBOM/Craig to
k8s, removed Langfuse + a standing no-Node-apps policy (also takes
out Fonoster and PLMore/NestJS); Runme confirmed Go (not affected).
GitUrlList pruned 56 → 46 accordingly.
| Ticket | App | Category | Flavor |
|---|---|---|---|
| #633 | GoAlert | Monitoring | DONE 2026-09-06 (18th package, grind-verified) |
| #634 | Tirreno | Security | build (already live on Cloudron — verify packaging need) |
| #635 | Runme | Automation | pending service-story ruling (Go CLI runner, NOT node) |
| #636 | DataHub | Data-Management | build (heavy; disposition risk) |
| #637 | Docassemble | Legal | build |
| #638 | Pimcore | Business-Apps | build |
| #639 | Database-Gateway | Infrastructure | DONE (12th package) |
| #640 | FX | DevOps-Tools | DONE (13th package) |
| #642 | Rundeck | Automation | build |
| #643 | HyperSwitch | Financial-Payments | build |
| #644 | PayrollEngine | Business-Apps | blocked-on-auth (WebApp local-only + MSSQL) |
| #645 | OpenBoxes | Business-Apps | needs LDAP runtime verification |
| #646 | Nautilus Trader | Financial-Trading | disposition: OUT OF SCOPE (framework) — ruling pending |
| #647 | Fleet | Monitoring | GO-with-risk: SAML-only SSO, mysql+redis addons |
| #648 | NetBox | Infrastructure | DONE (16th package) |
| #649 | SeaTunnel | Data-Management | disposition: OUT OF SCOPE (job engine) — ruling pending |
| #650 | Rathole | Infrastructure | DONE (11th package) |
| #651 | Easy-Gate | Infrastructure | DONE (10th package) |
| #653 | ConsulDemocracy | Collaboration | DONE (17th package, grind-verified) |
| #654 | BOINC | Scientific-Computing | disposition: OUT OF SCOPE — ruling pending |
| #655 | Slurm | System-Administration | disposition: OUT OF SCOPE — ruling pending |
| #656 | Gophish | Security | blocked-on-auth |
| #657 | SniperPhish | Security | upstream gone (404) — ruling pending |
| #658 | InvenTree | Business-Apps | GO: official image, OIDC+LDAP core |
| #659 | Mender | System-Administration | build |
| #661 | WireViz | Documentation-Tools | disposition: covered by wireviz-web package |
| #662 | KillBill | Business-Apps | build |
| #666 | SigNoz | Monitoring | blocked: OSS local-only auth + mandatory ClickHouse |
| #667 | Sentry | Monitoring | blocked: 56-service Kafka/CH mesh |
| #668 | ChirpStack | Infrastructure | DONE (14th package) |
| #669 | eLabFTW | Business-Apps | DONE (15th package) |
| #671 | Resgrid Core | Project-Management | build |
| #672 | SDRangel | Infrastructure | disposition: OUT OF SCOPE (Qt desktop) — ruling pending |
| #673 | No-Code Architects Toolkit | Low-Code | build (Python/FastAPI, not node) |
| #675 | Security Awareness Training | Security | build |
Packaging Patterns Established
- Official-image wrapper — APISIX, Healthchecks, Review Board
- Multi-stage build — Webhook (Go), Puter (Node.js)
- Python build — WireViz Web
- Django + PostgreSQL — Healthchecks, Review Board
- Pre-compiled binaries — Corteza (download + extract from upstream releases)
Templates live in Package-Templates/ (python-app, django-app, official-wrapper).
Full write-ups of each pattern + challenges are in JOURNAL.md.
Progress by Category
| Category | Apps | Packaged | Notes |
| Category | Apps | Packaged | Notes |
|---|---|---|---|
| API-Gateway | 2 | 2/2 (100%) ✅ | Category complete |
| DevOps-Tools | 1 | 1/1 (100%) ✅ | Category complete |
| Development | 2 | 2/2 (100%) ✅ | reviewboard, puter (autobom removed) |
| Documentation-Tools | 3 | 2/3 | wireviz-web, draw.io done |
| Low-Code | 2 | 1/2 | corteza done (openblocks removed) |
| Monitoring | 5 | 2/5 | healthchecks, goalert done (langfuse removed) |
| Automation | 3 | 1/3 | windmill done (huginn removed) |
| Business-Apps | 6 | 1/6 | elabftw done (midday removed) |
| Collaboration | 2 | 1/2 | consuldemocracy done |
| Infrastructure | 6 | 5/6 | easy-gate, rathole, database-gateway, chirpstack, netbox done |
| Data-Management | 2 | 0/2 | datahub, seatunnel |
| Security | 4 | 0/4 | tirreno, gophish, sniperphish, sat (comply removed) |
| System-Administration | 2 | 0/2 | mender, slurm |
| Scientific-Computing | 2 | 0/2 | boinc, jamovi |
| Financial-Payments | 1 | 0/1 | hyperswitch |
| Financial-Trading | 1 | 0/1 | nautilus (out-of-scope pending ruling) |
| Legal | 1 | 0/1 | docassemble |
| Project-Management | 1 | 0/1 | resgrid |
Auth Status
Auth capability is a hard gate before packaging (see AGENTS.md § Authentication Policy). ✅ = OIDC preferred, ⚠️ = LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only (unacceptable / blocked-on-auth).
Completed packages (18)
| App | OIDC | LDAP | Verdict | Note |
|---|---|---|---|---|
| Webhook | n/a | n/a | 🔄 proxy-eligible | No user concept; auth-gap: needs httpAuth proxy added |
| APISIX | plugin | plugin | ⚠️ risk | openid-connect/ldap-auth gateway plugins (edge auth, not dashboard) |
| Healthchecks | no | no | 🔄 proxy-eligible | REMOTE_USER_HEADER support; consider httpAuth proxy |
| Review Board | no | yes | ⚠️ risk (LDAP) | SAML 2.0 via plugin; built-in LDAP/AD backend |
| WireViz Web | n/a | n/a | 🔄 proxy-eligible | Stateless, no users; auth-gap: needs httpAuth proxy added |
| Puter | no | no | ❌ risk | Own user system, no SSO federation — needs revisit |
| Corteza | yes | no | ✅ preferred | Native OIDC via auth.external.providers.openid-connect.* |
| draw.io | n/a | n/a | 🔄 proxy | Packaged with httpAuth.type=proxy (no users, stateless) |
| Windmill | yes | no | ✅ preferred | Packaged; OIDC configured via Admin Settings UI (no env vars) |
| Easy-Gate | n/a | n/a | 🔄 proxy | Packaged with httpAuth.type=proxy (no user concept; IP-subnet groups only) |
| Rathole | n/a | n/a | 🔄 proxy | Packaged with httpAuth.type=proxy on the status page; tunnels secured by mandatory per-service tokens (Noise/TLS optional) |
| Database Gateway | yes | no | ✅ preferred | Packaged; native OIDC-only app — platform provider env (CLOUDRON_OIDC_*) seeded into config.json; roles from the groups claim |
| FX | n/a | n/a | 🔄 proxy | Packaged; CLI-only FaaS tool with no user concept — pinned binary + workspace driven from the Cloudron terminal; landing page gated by httpAuth.type=proxy |
| ChirpStack | yes | no | ✅ preferred | Packaged; native [user_authentication.openid_connect] wired to CLOUDRON_OIDC_*; OIDC-registered users are non-admin — one-time CHIRPSTACK_AUTH_MODE=internal bootstrap links the seeded admin to your SSO email (README) |
| eLabFTW | no | yes | ⚠️ risk (LDAP) | Packaged; no OIDC upstream (auth = local/SAML/LDAP per src/Enums/AuthMethod.php); ldap addon enabled, README maps CLOUDRON_LDAP_* → sysconfig LDAP panel — must be validated on the live Cloudron before production; SAML possible via external IdP |
| NetBox | yes | plugin | ✅ preferred | Packaged; python-social-auth OIDC (REMOTE_AUTH_BACKEND=OpenIdConnectAuth + SOCIAL_AUTH_OIDC_*) wired from CLOUDRON_OIDC_*; local Django login retained for admin bootstrap; SSO users register without privileges (README) |
| ConsulDemocracy | yes | no | ✅ preferred | Packaged; omniauth_openid_connect (discovery) wired into generated secrets.yml; feature.oidc_login auto-enabled on first boot when the provider is present (admin-panel toggle afterwards); SAML also available; local admin seeded |
| GoAlert | yes | no | ✅ preferred | Packaged; native generic OIDC (go-oidc, any issuer) wired via GOALERT_OIDC_* from the platform provider; new-user creation on; optional first-admin basic auth via GOALERT_ADMIN_USER/PASS; callback /api/v2/identity/providers/oidc/callback |
Candidates researched
| App | OIDC | LDAP | Verdict | Note |
|---|---|---|---|---|
| NetBox | yes | yes | ✅ preferred | OIDC+LDAP native; Cloudron redis addon available (corrected 2026-09-01 — earlier "no Redis" claim was wrong). Ticket #648 |
| Gophish | no | no | ❌ blocked | Local admin login only, no SSO — do not package until auth added |
Immediate queue: work the build-ticket batch (#633-#678) via the grind
pattern; auth research is embedded in each ticket (Sentry #667, SigNoz #666,
Langfuse #660, Fleet #647, InvenTree #658, GoAlert #633 are the research
queue).
Deferred: Gophish #656 (blocked-on-auth).
Tech debt: add httpAuth proxy to Webhook + WireViz Web (stateless apps);
revise Puter auth.
Known Issues
| Issue | Impact | Status |
|---|---|---|
| Inventory count drift | README inventory table was missing todogroup/policies + CraigChat/craig; grist-core excluded (packaged upstream) |
Fixed 2026-09-01: README reconciled to GitUrlList.txt (57); dispositions ticketed (#674, #677, #678) |
| Erroneous "Warp" packaged marker | README inventory row marked Warp ✅ Packaged, but Warp is a duplicate (per RESUME) and no package dir exists | Fixed in this session (README marker removed) |
| No CI / build validation | Packages are built but not regression-tested in a pipeline | Future: cloudron build + manifest lint in CI |
| Packages not exercised on a live Cloudron | Untested end-to-end on the production Cloudron VPS | Future: install-test a sample package |
| Architecture is amd64-only | Pre-compiled-binary + multi-stage packages target linux/amd64 | Acceptable for current target host |
| SniperPhish upstream gone | GemGeorge/SniperPhish 404s (deleted/private); clone impossible |
Ticket #657 carries disposition; awaits ruling on GitUrlList removal |
Pending (next session priorities)
- Work the build-ticket batch (#633-#678, umbrella #632) — sequential headless workers, one ticket at a time (grind-driver pattern); auth gate first on every ticket. Night window (22:00-07:00 Central) allows wider parallel builds per the host day/night profile.
- Resolve disposition tickets (#674, #677, #678, #661, ...) so the inventory reflects reality.
- Validate one package end-to-end on the Cloudron VPS to prove the packaging patterns in production, not just at build time.
- Stand up CI —
cloudron build+ CloudronManifest.json schema lint on every package change. - Continue until all packageable apps (~50 of 57 after dispositions) are done.
Repository Summary
| Component | Details |
|---|---|
| Goal | Package ~57 upstream FLOSS apps for Cloudron (TSYS PaaS of choice) |
| Upstream source list | GitUrlList.txt (57 repos) |
| Workspace | Package-Workspace/<Category>/<app>/ (cloned upstream repo/ dirs are gitignored) |
| Templates | Package-Templates/ (python-app, django-app, official-wrapper) |
| Git remote | ssh://git@git.knownelement.com:29418/KNEL/TSYSDevStack-SupportStack-Cloudron.git (origin/main) |
| Sibling project | TSYSDevStack-SupportStack-LocalWorkstation (local Docker-Compose dev stack) |