draw.io (diagrams.net) is a client-side diagramming app. It has no user
model and no server-side state (diagrams live in the browser or cloud
storage), so this is the first package to use the Cloudron
authentication-proxy pattern: httpAuth.type=proxy gates access at the
platform edge — the admin restricts who can reach it and the browser
challenges for Cloudron credentials.
- Wraps the official jgraph/drawio:24.7.17 Tomcat image (pinned, verified)
- No database / no persistent storage; installs curl for the health check
- HTTP port 8080, health check on /
- Validated: docker build + run return HTTP 200, container healthy
Gardening: STATUS/README/JOURNAL updated (8/~57 packaged); new
"official-image wrapper + auth proxy" pattern documented in JOURNAL.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
Establishes a hard auth gate before any app is packaged: OIDC is
preferred, LDAP is acceptable (flagged risk), auth-proxy for user-less
utility apps, and local-only-auth apps are blocked from packaging
until they gain SSO.
- AGENTS.md: new "Authentication Policy" section with the verdict table
and Cloudron OIDC/LDAP/proxy-auth wiring notes.
- STATUS.md: new "Auth Status" matrix assessing all 7 completed
packages + the next candidates (draw.io proxy-eligible, Windmill
OIDC, NetBox OIDC but Redis-blocked, Gophish blocked-on-auth).
Flags tech debt: Webhook/WireViz need httpAuth proxy added; Puter
auth needs revisit.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
Mirror the agent workflow used across sibling TSYS/KNEL repos
(PFVCluster, KNEL-AIMiddleware): a living agent-maintained STATUS.md
plus a concise AGENTS.md carrying Git Policy and an Automatic Gardening
Protocol that keeps all docs in sync.
- Add STATUS.md: completed packages table (7), per-category progress,
known issues, next priorities, repo summary. Human read-only; agents
own it.
- Rewrite AGENTS.md (384 -> 140 lines): repo layout, git policy
(atomic, conventional, commit+push without prompting), gardening
protocol, packaging quick-reference. Fixes active model (GLM-4.7 ->
GLM-5.2), stale counts, and dead /home/tsys paths.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
mrcharles