KNEL/TSYSDevStack-SupportStack-Cloudron
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: add mandatory authentication policy to AGENTS and STATUS

Browse Source 
Establishes a hard auth gate before any app is packaged: OIDC is
preferred, LDAP is acceptable (flagged risk), auth-proxy for user-less
utility apps, and local-only-auth apps are blocked from packaging
until they gain SSO.

- AGENTS.md: new "Authentication Policy" section with the verdict table
  and Cloudron OIDC/LDAP/proxy-auth wiring notes.
- STATUS.md: new "Auth Status" matrix assessing all 7 completed
  packages + the next candidates (draw.io proxy-eligible, Windmill
  OIDC, NetBox OIDC but Redis-blocked, Gophish blocked-on-auth).
  Flags tech debt: Webhook/WireViz need httpAuth proxy added; Puter
  auth needs revisit.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-07-30 16:07:56 -05:00
parent c56e77c59c
commit 06a2205949
2 changed files with 56 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
STATUS.md
+33
View File
@@ -64,6 +64,39 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
| Security | 5 | 0/5 | |
| System-Administration | 2 | 0/2 | |
## Auth Status
Auth capability is a hard gate before packaging (see
[AGENTS.md § Authentication Policy](AGENTS.md)). ✅ = OIDC preferred, ⚠️ =
LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
(unacceptable / blocked-on-auth).
### Completed packages (7)
| App | OIDC | LDAP | Verdict | Note |
|-----|------|------|---------|------|
| Webhook | n/a | n/a | 🔄 proxy-eligible | No user concept; **auth-gap: needs `httpAuth` proxy added** |
| APISIX | plugin | plugin | ⚠️ risk | openid-connect/ldap-auth gateway plugins (edge auth, not dashboard) |
| Healthchecks | no | no | 🔄 proxy-eligible | REMOTE_USER_HEADER support; consider httpAuth proxy |
| Review Board | no | yes | ⚠️ risk (LDAP) | SAML 2.0 via plugin; built-in LDAP/AD backend |
| WireViz Web | n/a | n/a | 🔄 proxy-eligible | Stateless, no users; **auth-gap: needs `httpAuth` proxy added** |
| Puter | no | no | ❌ risk | Own user system, no SSO federation — needs revisit |
| Corteza | yes | no | ✅ preferred | Native OIDC via `auth.external.providers.openid-connect.*` |
### Candidates researched
| App | OIDC | LDAP | Verdict | Note |
|-----|------|------|---------|------|
| docker-drawio | n/a | n/a | 🔄 proxy-eligible | Stateless diagramming; package with `httpAuth` proxy |
| Windmill | yes | no | ✅ preferred | OIDC native; configured via Admin Settings UI (no env vars) |
| NetBox | yes | yes | ✅ auth, ❌ Redis | OIDC+LDAP native, but HARD Redis dep (Cloudron has none) — Complex |
| Gophish | no | no | ❌ blocked | Local admin login only, no SSO — do not package until auth added |
**Immediate queue:** docker-drawio (proxy auth), Windmill (OIDC).
**Deferred:** NetBox (bundle Valkey+supervisor — significant), Gophish
(blocked-on-auth).
**Tech debt:** add `httpAuth` proxy to Webhook + WireViz Web; revisit Puter auth.
## Known Issues
| Issue | Impact | Status |