KNEL-TSYSDevStack-SupportStack-Cloudron/STATUS.md

Project Status

Human read-only. Agents maintain this file automatically after each work session. Do not edit by hand — the next agent run will overwrite it.

Last updated: 2026-09-01 by Crush (GLM-5.2) — Rathole packaged (#650, Infrastructure, 11th package); auth gate verdict: no user concept, status page behind the Cloudron auth proxy, tunnels token-authenticated.

Current State: STABLE (packaging phase, ongoing)

Cloudron packaging pipeline is operational. 11 of ~57 upstream applications are packaged, committed, and pushed. Packaging templates exist for the core patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync. All remaining apps now carry build tickets (#633-#678) under umbrella #632 in Redmine project 55 — ready for the sequential grind-driver pattern.

Completed Packages (11)

#	Application	Category	Pattern	Port(s)	Addons
1	Webhook	API-Gateway	Multi-stage (Go)	9000	localstorage
2	APISIX	API-Gateway	Official-image wrapper	9080, 9180, 9443	localstorage, etcd
3	Healthchecks	Monitoring	Django + PostgreSQL	8000	localstorage, postgresql
4	Review Board	Development	Django + PostgreSQL	8080	localstorage, postgresql
5	WireViz Web	Documentation-Tools	Python build	3005	localstorage
6	Puter	Development	Multi-stage (Node.js)	4100	localstorage, postgresql
7	Corteza	Low-Code	Pre-compiled binaries	80	localstorage, postgresql
8	draw.io	Documentation-Tools	Official-image wrapper + auth proxy	8080	none (stateless)
9	Windmill	Automation	Official-image wrapper + start.sh	8000	localstorage, postgresql
10	Easy-Gate	Infrastructure	Multi-stage (Go) + auth proxy	8080	localstorage
11	Rathole	Infrastructure	Pre-compiled binaries + auth proxy	8000, 2333, 5200-5299	localstorage

Each package lives in Package-Workspace/<Category>/<app>/ and contains a Dockerfile, CloudronManifest.json, README.md, CHANGELOG.md, logo.png, and (where relevant) start.sh + .env.example.

Build Ticket Map (46 open, filed 2026-09-01)

All under umbrella #632 (Redmine project 55, tracker Feature). Excluded: grist-core (a Cloudron package already exists upstream — do not package).

Ticket	App	Category	Flavor
#633	GoAlert	Monitoring	build (research queue)
#634	Tirreno	Security	build
#635	Runme	Automation	disposition (service story unclear)
#636	DataHub	Data-Management	build (heavy; disposition risk)
#637	Docassemble	Legal	build
#638	Pimcore	Business-Apps	build
#639	Database-Gateway	Infrastructure	build (httpAuth proxy candidate)
#640	FX	DevOps-Tools	build (proxy candidate)
#641	Fonoster	Communication	build
#642	Rundeck	Automation	build
#643	HyperSwitch	Financial-Payments	build
#644	PayrollEngine	Business-Apps	build
#645	OpenBoxes	Business-Apps	build
#646	Nautilus Trader	Financial-Trading	disposition (headless lib)
#647	Fleet	Monitoring	build (research queue)
#648	NetBox	Infrastructure	build (redis addon; strong candidate)
#649	SeaTunnel	Data-Management	disposition (service vs tool)
#650	Rathole	Infrastructure	build (proxy)
#651	Easy-Gate	Infrastructure	build (proxy)
#652	Huginn	Automation	build
#653	ConsulDemocracy	Collaboration	build
#654	BOINC	Scientific-Computing	disposition (server packaging heavy)
#655	Slurm	System-Administration	disposition (likely out of scope)
#656	Gophish	Security	blocked-on-auth
#657	SniperPhish	Security	build
#658	InvenTree	Business-Apps	build (research queue)
#659	Mender	System-Administration	build
#660	Langfuse	Monitoring	build (research queue)
#661	WireViz	Documentation-Tools	disposition (covered by wireviz-web)
#662	KillBill	Business-Apps	build
#663	AutoBOM	Development	disposition (service story unclear)
#664	Midday	Business-Apps	disposition (hosted-Clerk auth risk)
#665	OpenBlocks	Low-Code	build
#666	SigNoz	Monitoring	build (research queue)
#667	Sentry	Monitoring	build (research queue)
#668	ChirpStack	Infrastructure	build (OIDC promising)
#669	eLabFTW	Business-Apps	build (OIDC/LDAP promising)
#670	PLMore	Business-Apps	disposition
#671	Resgrid Core	Project-Management	build
#672	SDRangel	Infrastructure	disposition (desktop app)
#673	No-Code Architects Toolkit	Low-Code	build
#674	Warp	Development	disposition (duplicate entry)
#675	Security Awareness Training	Security	build
#676	Comply	Security	disposition (CLI toolkit)
#677	TODO Group Policies	Development	disposition (docs repo)
#678	Craig	Communication	disposition (Discord bot)

Packaging Patterns Established

1. Official-image wrapper — APISIX, Healthchecks, Review Board
2. Multi-stage build — Webhook (Go), Puter (Node.js)
3. Python build — WireViz Web
4. Django + PostgreSQL — Healthchecks, Review Board
5. Pre-compiled binaries — Corteza (download + extract from upstream releases)

Templates live in Package-Templates/ (python-app, django-app, official-wrapper). Full write-ups of each pattern + challenges are in JOURNAL.md.

Progress by Category

Category	Apps	Packaged	Notes
API-Gateway	2	2/2 (100%) ✅	Category complete
Development	4	2/4	reviewboard, puter done
Documentation-Tools	3	2/3	wireviz-web, draw.io done
Low-Code	3	1/3	corteza done
Monitoring	6	1/6	healthchecks done
Automation	4	1/4	windmill done
Business-Apps	8	0/8
Collaboration	2	0/2
Communication	1	0/1
Data-Management	2	0/2
DevOps-Tools	1	0/1
Financial-Payments	1	0/1
Financial-Trading	1	0/1
Infrastructure	6	2/6	easy-gate, rathole done
Legal	1	0/1
Project-Management	1	0/1
Scientific-Computing	2	0/2
Security	5	0/5
System-Administration	2	0/2

Auth Status

Auth capability is a hard gate before packaging (see AGENTS.md § Authentication Policy). ✅ = OIDC preferred, ⚠️ = LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only (unacceptable / blocked-on-auth).

Completed packages (11)

App	OIDC	LDAP	Verdict	Note
Webhook	n/a	n/a	🔄 proxy-eligible	No user concept; auth-gap: needs httpAuth proxy added
APISIX	plugin	plugin	⚠️ risk	openid-connect/ldap-auth gateway plugins (edge auth, not dashboard)
Healthchecks	no	no	🔄 proxy-eligible	REMOTE_USER_HEADER support; consider httpAuth proxy
Review Board	no	yes	⚠️ risk (LDAP)	SAML 2.0 via plugin; built-in LDAP/AD backend
WireViz Web	n/a	n/a	🔄 proxy-eligible	Stateless, no users; auth-gap: needs httpAuth proxy added
Puter	no	no	❌ risk	Own user system, no SSO federation — needs revisit
Corteza	yes	no	✅ preferred	Native OIDC via auth.external.providers.openid-connect.*
draw.io	n/a	n/a	🔄 proxy	Packaged with httpAuth.type=proxy (no users, stateless)
Windmill	yes	no	✅ preferred	Packaged; OIDC configured via Admin Settings UI (no env vars)
Easy-Gate	n/a	n/a	🔄 proxy	Packaged with httpAuth.type=proxy (no user concept; IP-subnet groups only)
Rathole	n/a	n/a	🔄 proxy	Packaged with httpAuth.type=proxy on the status page; tunnels secured by mandatory per-service tokens (Noise/TLS optional)

Candidates researched

App	OIDC	LDAP	Verdict	Note
NetBox	yes	yes	✅ preferred	OIDC+LDAP native; Cloudron redis addon available (corrected 2026-09-01 — earlier "no Redis" claim was wrong). Ticket #648
Gophish	no	no	❌ blocked	Local admin login only, no SSO — do not package until auth added

Immediate queue: work the build-ticket batch (#633-#678) via the grind pattern; auth research is embedded in each ticket (Sentry #667, SigNoz #666, Langfuse #660, Fleet #647, InvenTree #658, GoAlert #633 are the research queue). Deferred: Gophish #656 (blocked-on-auth). Tech debt: add httpAuth proxy to Webhook + WireViz Web (stateless apps); revise Puter auth.

Known Issues

Issue	Impact	Status
Inventory count drift	README inventory table was missing todogroup/policies + CraigChat/craig; grist-core excluded (packaged upstream)	Fixed 2026-09-01: README reconciled to GitUrlList.txt (57); dispositions ticketed (#674, #677, #678)
Erroneous "Warp" packaged marker	README inventory row marked Warp ✅ Packaged, but Warp is a duplicate (per RESUME) and no package dir exists	Fixed in this session (README marker removed)
No CI / build validation	Packages are built but not regression-tested in a pipeline	Future: cloudron build + manifest lint in CI
Packages not exercised on a live Cloudron	Untested end-to-end on the production Cloudron VPS	Future: install-test a sample package
Architecture is amd64-only	Pre-compiled-binary + multi-stage packages target linux/amd64	Acceptable for current target host
SniperPhish upstream gone	GemGeorge/SniperPhish 404s (deleted/private); clone impossible	Ticket #657 carries disposition; awaits ruling on GitUrlList removal

Pending (next session priorities)

1. Work the build-ticket batch (#633-#678, umbrella #632) — sequential headless workers, one ticket at a time (grind-driver pattern); auth gate first on every ticket. Night window (22:00-07:00 Central) allows wider parallel builds per the host day/night profile.
2. Resolve disposition tickets (#674, #677, #678, #661, ...) so the inventory reflects reality.
3. Validate one package end-to-end on the Cloudron VPS to prove the packaging patterns in production, not just at build time.
4. Stand up CI — cloudron build + CloudronManifest.json schema lint on every package change.
5. Continue until all packageable apps (~50 of 57 after dispositions) are done.

Repository Summary

Component	Details
Goal	Package ~57 upstream FLOSS apps for Cloudron (TSYS PaaS of choice)
Upstream source list	GitUrlList.txt (57 repos)
Workspace	Package-Workspace/<Category>/<app>/ (cloned upstream repo/ dirs are gitignored)
Templates	Package-Templates/ (python-app, django-app, official-wrapper)
Git remote	ssh://git@git.knownelement.com:29418/KNEL/TSYSDevStack-SupportStack-Cloudron.git (origin/main)
Sibling project	TSYSDevStack-SupportStack-LocalWorkstation (local Docker-Compose dev stack)