KNEL/TSYSDevStack-SupportStack-Cloudron
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add Windmill Cloudron package (Automation)

Browse Source 
Windmill is an open-source workflow-automation / internal-apps platform
that turns scripts (Python, JS/TS, Go, Bash, SQL, Rust, ...) into HTTP
endpoints, scheduled jobs, and visual flows. It is PostgreSQL-only —
it uses Postgres LISTEN/NOTIFY for job queuing, so no Redis is required,
making it a clean Cloudron fit.

- Wraps the official ghcr.io/windmill-labs/windmill:1.514.1 image in
  single-container server mode (embedded default worker)
- start.sh composes DATABASE_URL from the Cloudron postgresql addon and
  waits for the DB (bash /dev/tcp, no pg_isready dependency)
- HTTP port 8000, health check on /api/version, 2GB memory limit
- OIDC/SAML supported via the in-app Admin Settings UI (post-install)
- Validated end-to-end: throwaway postgres + windmill ran migrations and
  returned /api/version => "CE v1.514.1", HTTP 200

Gardening: STATUS/README/JOURNAL updated (9/~57 packaged; Automation
1/4). Windmill logged as a new OIDC-preferred completed package.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-07-30 16:15:23 -05:00
parent ac82c22af3
commit 10e558500f
10 changed files with 235 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
STATUS.md
+12 -10
View File
@@ -3,16 +3,16 @@
> **Human read-only. Agents maintain this file automatically after each work
> session.** Do not edit by hand — the next agent run will overwrite it.
>
> **Last updated:** 2026-07-30 by Crush (GLM-5.2) — draw.io packaged (auth-proxy
> pattern); mandatory auth policy established.
> **Last updated:** 2026-07-30 by Crush (GLM-5.2) — Windmill packaged (OIDC,
> PostgreSQL, no Redis); draw.io + Windmill validated end-to-end with docker.
## Current State: STABLE (packaging phase, ongoing)
Cloudron packaging pipeline is operational. 8 of ~57 upstream applications are
Cloudron packaging pipeline is operational. 9 of ~57 upstream applications are
packaged, committed, and pushed. Packaging templates exist for the core
patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
## Completed Packages (8)
## Completed Packages (9)
| # | Application | Category | Pattern | Port(s) | Addons |
|---|-------------|----------|---------|---------|--------|
@@ -24,6 +24,7 @@ patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
| 6 | Puter | Development | Multi-stage (Node.js) | 4100 | localstorage, postgresql |
| 7 | Corteza | Low-Code | Pre-compiled binaries | 80 | localstorage, postgresql |
| 8 | draw.io | Documentation-Tools | Official-image wrapper + auth proxy | 8080 | none (stateless) |
| 9 | Windmill | Automation | Official-image wrapper + start.sh | 8000 | localstorage, postgresql |
Each package lives in `Package-Workspace/<Category>/<app>/` and contains a
`Dockerfile`, `CloudronManifest.json`, `README.md`, `CHANGELOG.md`, `logo.png`,
@@ -49,7 +50,7 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
| Documentation-Tools | 3 | 2/3 | wireviz-web, draw.io done |
| Low-Code | 3 | 1/3 | corteza done |
| Monitoring | 6 | 1/6 | healthchecks done |
| Automation | 4 | 0/4 | |
| Automation | 4 | 1/4 | windmill done |
| Business-Apps | 8 | 0/8 | |
| Collaboration | 2 | 0/2 | |
| Communication | 1 | 0/1 | |
@@ -71,7 +72,7 @@ Auth capability is a hard gate before packaging (see
LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
(unacceptable / blocked-on-auth).
### Completed packages (7)
### Completed packages (9)
| App | OIDC | LDAP | Verdict | Note |
|-----|------|------|---------|------|
@@ -82,21 +83,22 @@ LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
| WireViz Web | n/a | n/a | 🔄 proxy-eligible | Stateless, no users; **auth-gap: needs `httpAuth` proxy added** |
| Puter | no | no | ❌ risk | Own user system, no SSO federation — needs revisit |
| Corteza | yes | no | ✅ preferred | Native OIDC via `auth.external.providers.openid-connect.*` |
| draw.io | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` (no users, stateless) |
| Windmill | yes | no | ✅ preferred | **Packaged**; OIDC configured via Admin Settings UI (no env vars) |
### Candidates researched
| App | OIDC | LDAP | Verdict | Note |
|-----|------|------|---------|------|
| docker-drawio | n/a | n/a | 🔄 proxy-eligible | Stateless diagramming; package with `httpAuth` proxy |
| Windmill | yes | no | ✅ preferred | OIDC native; configured via Admin Settings UI (no env vars) |
| NetBox | yes | yes | ✅ auth, ❌ Redis | OIDC+LDAP native, but HARD Redis dep (Cloudron has none) — Complex |
| Gophish | no | no | ❌ blocked | Local admin login only, no SSO — do not package until auth added |
**Immediate queue:** Windmill (OIDC).
**Immediate queue:** research next OIDC/auth-proxy candidates (Sentry, SigNoz,
Langfuse, Fleet, InvenTree, GoAlert) and pick the cleanest wins.
**Deferred:** NetBox (bundle Valkey+supervisor — significant), Gophish
(blocked-on-auth).
**Tech debt:** add `httpAuth` proxy to Webhook + WireViz Web (stateless apps);
revise Puter auth. draw.io ✅ packaged with auth proxy.
revise Puter auth.
## Known Issues