KNEL/TSYSDevStack-SupportStack-Cloudron
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: add mandatory authentication policy to AGENTS and STATUS

Browse Source 
Establishes a hard auth gate before any app is packaged: OIDC is
preferred, LDAP is acceptable (flagged risk), auth-proxy for user-less
utility apps, and local-only-auth apps are blocked from packaging
until they gain SSO.

- AGENTS.md: new "Authentication Policy" section with the verdict table
  and Cloudron OIDC/LDAP/proxy-auth wiring notes.
- STATUS.md: new "Auth Status" matrix assessing all 7 completed
  packages + the next candidates (draw.io proxy-eligible, Windmill
  OIDC, NetBox OIDC but Redis-blocked, Gophish blocked-on-auth).
  Flags tech debt: Webhook/WireViz need httpAuth proxy added; Puter
  auth needs revisit.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-07-30 16:07:56 -05:00
parent c56e77c59c
commit 06a2205949
2 changed files with 56 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+23
View File
@@ -98,6 +98,29 @@ Docs and code drift apart. After any work session, an agent MUST:
| [`GitUrlList.txt`](GitUrlList.txt) | Master upstream repo list (source of truth) |
| [`Package-Templates/`](Package-Templates/) | Reusable templates per packaging pattern |
## Authentication Policy (MANDATORY)
Every app must have an auth story **before** packaging. Research it up front and
record it in the [Auth Status](STATUS.md#auth-status) matrix.
| Auth type | Verdict | Action |
|-----------|---------|--------|
| **OIDC client** (native or plugin) | ✅ PREFERRED | Package; wire Cloudron OIDC provider env vars. |
| **LDAP** (native or plugin) | ⚠️ ACCEPTABLE w/ RISK | Package, but FLAG as "auth-risk: LDAP" in STATUS + README — must be fixed/validated before production. |
| **Local-only** (built-in user DB, no SSO) | ❌ UNACCEPTABLE | Do NOT package. Record in STATUS as blocked-on-auth. |
| **No user concept** (stateless/utility app) | ✅ via AUTH PROXY | Package with `httpAuth: {"type":"proxy"}` so Cloudron gates access at the proxy. Admin restricts who can reach it. |
**OIDC env vars Cloudron exposes** (when the app consumes the platform OIDC
provider): `CLOUDRON_OIDC_ISSUER`, `CLOUDRON_OIDC_CLIENT_ID`,
`CLOUDRON_OIDC_CLIENT_SECRET`, `CLOUDRON_OIDC_TOKEN_SIGNATURE_ALGORITHM`
(manifestVersion 2 / platform OIDC). LDAP addon env vars:
`CLOUDRON_LDAP_*`. See `CloudronManifest.json` `addons` (no extra addon needed
for proxy auth; use the `httpAuth` field).
**Before writing a Dockerfile**, determine which row applies and write the
finding into STATUS.md's Auth Status table. Never silently ship a local-only-
auth app.
## Cloudron Packaging — Quick Reference
**Pick a pattern** (see JOURNAL.md for full templates and worked examples):