feat: add Windmill Cloudron package (Automation)

Windmill is an open-source workflow-automation / internal-apps platform
that turns scripts (Python, JS/TS, Go, Bash, SQL, Rust, ...) into HTTP
endpoints, scheduled jobs, and visual flows. It is PostgreSQL-only —
it uses Postgres LISTEN/NOTIFY for job queuing, so no Redis is required,
making it a clean Cloudron fit.

- Wraps the official ghcr.io/windmill-labs/windmill:1.514.1 image in
  single-container server mode (embedded default worker)
- start.sh composes DATABASE_URL from the Cloudron postgresql addon and
  waits for the DB (bash /dev/tcp, no pg_isready dependency)
- HTTP port 8000, health check on /api/version, 2GB memory limit
- OIDC/SAML supported via the in-app Admin Settings UI (post-install)
- Validated end-to-end: throwaway postgres + windmill ran migrations and
  returned /api/version => "CE v1.514.1", HTTP 200

Gardening: STATUS/README/JOURNAL updated (9/~57 packaged; Automation
1/4). Windmill logged as a new OIDC-preferred completed package.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

Package-Workspace/Automation/windmill/.env.example

@@ -0,0 +1,5 @@
+# Windmill derives DATABASE_URL from the Cloudron PostgreSQL addon at runtime.
+# Only MODE is overridable; the default (server) embeds a worker.
+
+# Run mode: server (server + default worker), worker, or indexer.
+MODE=server

Package-Workspace/Automation/windmill/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+## 1.514.1 — Initial Cloudron package
+
+- First Cloudron package for Windmill
+- Wraps the official `ghcr.io/windmill-labs/windmill:1.514.1` image
+- Single-container server mode (embedded default worker)
+- PostgreSQL-backed via the Cloudron `postgresql` addon (no Redis required)
+- `start.sh` derives `DATABASE_URL` from Cloudron env and waits for the DB
+- HTTP port 8000, health check on `/api/version`
+- OIDC/SAML supported via the in-app Admin Settings UI (post-install config)

Package-Workspace/Automation/windmill/CloudronManifest.json

@@ -0,0 +1,25 @@
+{
+  "version": 1,
+  "manifestVersion": 2,
+  "type": "app",
+  "id": "io.cloudron.windmill",
+  "title": "Windmill",
+  "description": "Windmill is an open-source workflow automation platform. Turn scripts (Python, JS/TS, Go, Bash, SQL, PHP, Rust, PowerShell) into sharable HTTP endpoints and background jobs, chain them into flows, and build internal apps on top. Uses PostgreSQL for state and queuing (no Redis required).",
+  "author": "Windmill Labs",
+  "website": "https://www.windmill.dev",
+  "contactEmail": "cloudron@tsys.dev",
+  "tagline": "Open-source workflow automation and internal apps platform",
+  "version": "1.514.1",
+  "healthCheckPath": "/api/version",
+  "httpPort": 8000,
+  "memoryLimit": 2048,
+  "addons": {
+    "localstorage": true,
+    "postgresql": {
+      "version": "14"
+    }
+  },
+  "mediaLinks": [],
+  "changelog": "Initial Cloudron package for Windmill. PostgreSQL-backed (no Redis); single-container server mode with embedded worker. OIDC/SAML supported via the in-app Admin Settings.",
+  "icon": "file://logo.png"
+}

Package-Workspace/Automation/windmill/Dockerfile

@@ -0,0 +1,25 @@
+# Windmill Cloudron Package
+#
+# Windmill is an open-source workflow automation platform (scripts, flows,
+# apps, schedules) that turns scripts into sharable HTTP endpoints and
+# background jobs. The server embeds a default worker for single-container use.
+#
+# Upstream image: ghcr.io/windmill-labs/windmill:1.514.1
+#   - WorkingDir /usr/src/app, binary `windmill` on PATH, listens on 8000
+#   - Requires PostgreSQL (job queue uses Postgres LISTEN/NOTIFY; NO Redis)
+#   - Auto-runs SQL migrations on startup
+#
+# Authentication: Windmill supports OIDC and SAML natively. OIDC is configured
+# in the Admin Settings UI (persisted in the database), not via env vars. See
+# README.md for the post-install OIDC setup steps.
+FROM ghcr.io/windmill-labs/windmill:1.514.1
+
+ENV MODE=server
+
+# start.sh builds DATABASE_URL from the Cloudron PostgreSQL addon, waits for
+# the DB, then execs the windmill server. Made executable on the host.
+COPY start.sh /app/start.sh
+
+EXPOSE 8000
+
+CMD ["/bin/bash", "/app/start.sh"]

Package-Workspace/Automation/windmill/README.md

@@ -0,0 +1,78 @@
+# Windmill Cloudron Package
+
+## Description
+
+Windmill is an open-source developer platform to turn scripts into workflows
+and internal apps. Write scripts in Python, JavaScript/TypeScript, Go, Bash,
+SQL, PHP, Rust, PowerShell, or Deno; Windmill turns them into sharable HTTP
+endpoints, cron-scheduled jobs, and steps in visual **Flows**. It also
+generates internal apps from those flows.
+
+This package wraps the official `ghcr.io/windmill-labs/windmill` image in
+single-container **server mode** (the server embeds a default worker, so no
+separate worker container is needed).
+
+State lives entirely in **PostgreSQL** (Cloudron `postgresql` addon). Windmill
+uses Postgres `LISTEN/NOTIFY` for job queuing, so **no Redis is required**.
+
+## Authentication
+
+Windmill supports **OIDC** and **SAML** natively. Unlike many apps, these are
+configured in the **in-app Admin Settings UI** (persisted in the database),
+not via environment variables.
+
+### Post-install OIDC setup (recommended)
+
+1. Open the Windmill app and sign in as the bootstrap superadmin (the first run
+   prints a `SUPERADMIN_SECRET` / creates an admin — see Windmill docs).
+2. Go to **Admin Settings → Auth → OIDC**.
+3. Enter your identity provider details (Cloudron's OIDC provider issuer,
+   client ID, and client secret). The platform OIDC issuer / client creds come
+   from your Cloudron instance's app SSO configuration.
+4. Save; users can then log in via OIDC.
+
+> OIDC is the preferred auth path for this app. Until OIDC is configured,
+   access is limited to the local superadmin account.
+
+## Features
+
+- **Scripts to endpoints**: any script becomes a typed HTTP API + background job
+- **Flows**: visually chain scripts with branching, loops, retries, error handling
+- **Schedules**: cron-based job scheduling
+- **Apps**: generate internal UIs from flows
+- **Multi-language**: Python, JS/TS, Go, Bash, SQL, PHP, Rust, PowerShell, Deno
+- **Secrets**: encrypted secret management with inheritance
+- **Queuing**: Postgres `LISTEN/NOTIFY` (no external broker)
+
+## Configuration
+
+### Ports
+- **8000**: Windmill web UI + REST API
+
+### Addons
+- **postgresql** (v14): all persistent state, jobs, flows, users, queue
+- **localstorage** (`/app/data`): ephemeral job working files
+
+### Environment Variables
+The `start.sh` entrypoint derives `DATABASE_URL` automatically from the
+Cloudron PostgreSQL addon. The only fixed knob is:
+
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `MODE` | `server` | Run mode (server embeds a default worker) |
+
+`DATABASE_URL` is composed at runtime as
+`postgres://$USER:$PASS@$HOST:$PORT/$DB?sslmode=disable`.
+
+## Usage
+
+1. Install the package on Cloudron (provisions a PostgreSQL database).
+2. On first boot, Windmill runs migrations and bootstraps a superadmin.
+3. Sign in, then immediately configure OIDC under Admin Settings (above).
+4. Create a script, expose it as a flow/app, schedule it, or call its HTTP endpoint.
+
+## Upstream
+
+- **Repository**: https://github.com/windmill-labs/windmill
+- **Image**: `ghcr.io/windmill-labs/windmill:1.514.1`
+- **Docs**: https://www.windmill.dev/docs

Package-Workspace/Automation/windmill/start.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+set -euo pipefail
+
+# Build the PostgreSQL connection URL from the Cloudron postgresql addon.
+export DATABASE_URL="postgres://${CLOUDRON_POSTGRESQL_USERNAME}:${CLOUDRON_POSTGRESQL_PASSWORD}@${CLOUDRON_POSTGRESQL_HOST}:${CLOUDRON_POSTGRESQL_PORT}/${CLOUDRON_POSTGRESQL_DATABASE}?sslmode=disable"
+
+# Single-container server mode (server embeds a default worker).
+export MODE="${MODE:-server}"
+
+# Wait for PostgreSQL to accept connections before starting. Windmill runs SQL
+# migrations on startup, so the DB must be reachable. Uses bash /dev/tcp (no
+# pg_isready dependency).
+echo "Waiting for PostgreSQL at ${CLOUDRON_POSTGRESQL_HOST}:${CLOUDRON_POSTGRESQL_PORT} ..."
+for i in $(seq 1 60); do
+  if (exec 3<>"/dev/tcp/${CLOUDRON_POSTGRESQL_HOST}/${CLOUDRON_POSTGRESQL_PORT}") 2>/dev/null; then
+    exec 3>&- 3<&- || true
+    echo "PostgreSQL is reachable."
+    break
+  fi
+  echo "  not ready yet, retrying in 2s ($i/60)"
+  sleep 2
+done
+
+cd /usr/src/app
+exec windmill