feat: add Windmill Cloudron package (Automation)

Windmill is an open-source workflow-automation / internal-apps platform
that turns scripts (Python, JS/TS, Go, Bash, SQL, Rust, ...) into HTTP
endpoints, scheduled jobs, and visual flows. It is PostgreSQL-only —
it uses Postgres LISTEN/NOTIFY for job queuing, so no Redis is required,
making it a clean Cloudron fit.

- Wraps the official ghcr.io/windmill-labs/windmill:1.514.1 image in
  single-container server mode (embedded default worker)
- start.sh composes DATABASE_URL from the Cloudron postgresql addon and
  waits for the DB (bash /dev/tcp, no pg_isready dependency)
- HTTP port 8000, health check on /api/version, 2GB memory limit
- OIDC/SAML supported via the in-app Admin Settings UI (post-install)
- Validated end-to-end: throwaway postgres + windmill ran migrations and
  returned /api/version => "CE v1.514.1", HTTP 200

Gardening: STATUS/README/JOURNAL updated (9/~57 packaged; Automation
1/4). Windmill logged as a new OIDC-preferred completed package.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

AGENTS.md

@@ -98,6 +98,29 @@ Docs and code drift apart. After any work session, an agent MUST:
 | [`GitUrlList.txt`](GitUrlList.txt) | Master upstream repo list (source of truth) |
 | [`Package-Templates/`](Package-Templates/) | Reusable templates per packaging pattern |
 
+## Authentication Policy (MANDATORY)
+
+Every app must have an auth story **before** packaging. Research it up front and
+record it in the [Auth Status](STATUS.md#auth-status) matrix.
+
+| Auth type | Verdict | Action |
+|-----------|---------|--------|
+| **OIDC client** (native or plugin) | ✅ PREFERRED | Package; wire Cloudron OIDC provider env vars. |
+| **LDAP** (native or plugin) | ⚠️ ACCEPTABLE w/ RISK | Package, but FLAG as "auth-risk: LDAP" in STATUS + README — must be fixed/validated before production. |
+| **Local-only** (built-in user DB, no SSO) | ❌ UNACCEPTABLE | Do NOT package. Record in STATUS as blocked-on-auth. |
+| **No user concept** (stateless/utility app) | ✅ via AUTH PROXY | Package with `httpAuth: {"type":"proxy"}` so Cloudron gates access at the proxy. Admin restricts who can reach it. |
+
+**OIDC env vars Cloudron exposes** (when the app consumes the platform OIDC
+provider): `CLOUDRON_OIDC_ISSUER`, `CLOUDRON_OIDC_CLIENT_ID`,
+`CLOUDRON_OIDC_CLIENT_SECRET`, `CLOUDRON_OIDC_TOKEN_SIGNATURE_ALGORITHM`
+(manifestVersion 2 / platform OIDC). LDAP addon env vars:
+`CLOUDRON_LDAP_*`. See `CloudronManifest.json` `addons` (no extra addon needed
+for proxy auth; use the `httpAuth` field).
+
+**Before writing a Dockerfile**, determine which row applies and write the
+finding into STATUS.md's Auth Status table. Never silently ship a local-only-
+auth app.
+
 ## Cloudron Packaging — Quick Reference
 
 **Pick a pattern** (see JOURNAL.md for full templates and worked examples):

JOURNAL.md

@@ -678,6 +678,100 @@ Dockerfile
 
 ---
 
+### 8. draw.io (Documentation-Tools) ✅
+**Date**: 2026-07-30
+**Application**: draw.io (diagrams.net) — client-side diagramming tool
+**Package Size**: ~600MB (Tomcat base)
+**Port**: 8080
+**Addons**: none (stateless; no database, no persistent storage)
+
+**Key Learnings**:
+- First package to use the **Cloudron authentication proxy** pattern
+  (`httpAuth.type = proxy`) for a user-less utility app
+- Stateless: diagrams live in browser localStorage or cloud storage (Google
+  Drive, OneDrive, GitHub) — no server-side state at all
+- Verified image tag before pinning via `docker manifest inspect` to avoid a
+  build failure on a non-existent tag
+- Confirmed base image (Tomcat/Debian-slim) lacks curl → installed it in the
+  wrapper for the Docker HEALTHCHECK
+
+**Build Process**:
+- Base: `jgraph/drawio:24.7.17` (pinned, verified tag)
+- `apt-get install curl` for the health check
+- Inherits upstream ENTRYPOINT (`/docker-entrypoint.sh`) + CMD (`catalina.sh run`)
+- No build stage, no runtime setup script needed
+
+**Auth Pattern (NEW)**:
+- draw.io has no user model → use Cloudron `httpAuth.type = proxy`
+- Cloudron admin restricts which platform users reach the app; the browser
+  challenges for Cloudron credentials before the editor loads
+- This is the template for all future stateless / no-user apps
+
+**Validation**:
+- `docker build` → success
+- `docker run` + `curl http://localhost:8080/` → HTTP 200, container healthy
+
+**Files Created**:
+- Dockerfile (official-image wrapper + curl)
+- CloudronManifest.json (port 8080, httpAuth proxy, healthCheckPath /)
+- README.md (auth-proxy usage, features, optional env vars)
+- CHANGELOG.md
+- .env.example (optional DRAWIO_* knobs)
+- logo.png (draw.io brand icon from upstream repo)
+
+**Commit**: `feat: add draw.io Cloudron package (Documentation-Tools)`
+
+---
+
+### 9. Windmill (Automation) ✅
+**Date**: 2026-07-30
+**Application**: Windmill — open-source workflow automation / internal-apps platform
+**Package Size**: ~2GB (bundles Python, Go, Rust runtimes for user scripts)
+**Port**: 8000
+**Addons**: localstorage, postgresql
+
+**Key Learnings**:
+- Official-image wrapper around `ghcr.io/windmill-labs/windmill:1.514.1`
+- **PostgreSQL-only**: Windmill uses Postgres `LISTEN/NOTIFY` for job queuing,
+  so **no Redis is required** (unlike NetBox). This makes it a clean Cloudron fit.
+- Single-container **server mode** embeds a default worker (no separate worker
+  container needed)
+- `DATABASE_URL` is composed at runtime in `start.sh` from the Cloudron
+  PostgreSQL addon env vars — Windmill has no per-var DB config, just the URI
+- **OIDC/SAML are configured in the in-app Admin Settings UI** (persisted to
+  the DB), not via environment variables — so the package supports OIDC but
+  the admin enables it post-install
+
+**Build Process**:
+- Base: `ghcr.io/windmill-labs/windmill:1.514.1` (pinned, verified)
+- Image config inspected (no full pull) via `docker buildx imagetools inspect`
+  to confirm WorkingDir `/usr/src/app`, binary `windmill` on PATH, port 8000
+- `start.sh` waits for Postgres (bash `/dev/tcp`, no `pg_isready` dependency),
+  then `exec windmill`
+- Logo extracted from inside the image (`/static_frontend/logo.svg`) and
+  converted to PNG with ImageMagick
+
+**Validation (full integration test)**:
+- `docker build` → success
+- Ran a throwaway `postgres:14-alpine` + the windmill image on a shared network
+- Migrations completed (`v2 finalization step successfully applied`)
+- `GET /api/version` → `CE v1.514.1`, HTTP 200 ✅
+- Non-fatal: logs an embeddings-DB error when no AI API key is set (expected;
+  Windmill runs fine without AI embeddings)
+
+**Files Created**:
+- Dockerfile (official-image wrapper)
+- CloudronManifest.json (port 8000, postgresql + localstorage, healthCheckPath /api/version, 2GB memory)
+- start.sh (DB wait + DATABASE_URL composition) — committed executable
+- README.md (OIDC post-install setup, features, addons)
+- CHANGELOG.md
+- .env.example
+- logo.png (brand icon from upstream image, SVG→PNG)
+
+**Commit**: `feat: add Windmill Cloudron package (Automation)`
+
+---
+
 ## Packaging Pattern: Download Pre-Compiled Binaries
 
 ### When to Use

Package-Workspace/Automation/windmill/.env.example

@@ -0,0 +1,5 @@
+# Windmill derives DATABASE_URL from the Cloudron PostgreSQL addon at runtime.
+# Only MODE is overridable; the default (server) embeds a worker.
+
+# Run mode: server (server + default worker), worker, or indexer.
+MODE=server

Package-Workspace/Automation/windmill/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+## 1.514.1 — Initial Cloudron package
+
+- First Cloudron package for Windmill
+- Wraps the official `ghcr.io/windmill-labs/windmill:1.514.1` image
+- Single-container server mode (embedded default worker)
+- PostgreSQL-backed via the Cloudron `postgresql` addon (no Redis required)
+- `start.sh` derives `DATABASE_URL` from Cloudron env and waits for the DB
+- HTTP port 8000, health check on `/api/version`
+- OIDC/SAML supported via the in-app Admin Settings UI (post-install config)

Package-Workspace/Automation/windmill/CloudronManifest.json

@@ -0,0 +1,25 @@
+{
+  "version": 1,
+  "manifestVersion": 2,
+  "type": "app",
+  "id": "io.cloudron.windmill",
+  "title": "Windmill",
+  "description": "Windmill is an open-source workflow automation platform. Turn scripts (Python, JS/TS, Go, Bash, SQL, PHP, Rust, PowerShell) into sharable HTTP endpoints and background jobs, chain them into flows, and build internal apps on top. Uses PostgreSQL for state and queuing (no Redis required).",
+  "author": "Windmill Labs",
+  "website": "https://www.windmill.dev",
+  "contactEmail": "cloudron@tsys.dev",
+  "tagline": "Open-source workflow automation and internal apps platform",
+  "version": "1.514.1",
+  "healthCheckPath": "/api/version",
+  "httpPort": 8000,
+  "memoryLimit": 2048,
+  "addons": {
+    "localstorage": true,
+    "postgresql": {
+      "version": "14"
+    }
+  },
+  "mediaLinks": [],
+  "changelog": "Initial Cloudron package for Windmill. PostgreSQL-backed (no Redis); single-container server mode with embedded worker. OIDC/SAML supported via the in-app Admin Settings.",
+  "icon": "file://logo.png"
+}

Package-Workspace/Automation/windmill/Dockerfile

@@ -0,0 +1,25 @@
+# Windmill Cloudron Package
+#
+# Windmill is an open-source workflow automation platform (scripts, flows,
+# apps, schedules) that turns scripts into sharable HTTP endpoints and
+# background jobs. The server embeds a default worker for single-container use.
+#
+# Upstream image: ghcr.io/windmill-labs/windmill:1.514.1
+#   - WorkingDir /usr/src/app, binary `windmill` on PATH, listens on 8000
+#   - Requires PostgreSQL (job queue uses Postgres LISTEN/NOTIFY; NO Redis)
+#   - Auto-runs SQL migrations on startup
+#
+# Authentication: Windmill supports OIDC and SAML natively. OIDC is configured
+# in the Admin Settings UI (persisted in the database), not via env vars. See
+# README.md for the post-install OIDC setup steps.
+FROM ghcr.io/windmill-labs/windmill:1.514.1
+
+ENV MODE=server
+
+# start.sh builds DATABASE_URL from the Cloudron PostgreSQL addon, waits for
+# the DB, then execs the windmill server. Made executable on the host.
+COPY start.sh /app/start.sh
+
+EXPOSE 8000
+
+CMD ["/bin/bash", "/app/start.sh"]

Package-Workspace/Automation/windmill/README.md

@@ -0,0 +1,78 @@
+# Windmill Cloudron Package
+
+## Description
+
+Windmill is an open-source developer platform to turn scripts into workflows
+and internal apps. Write scripts in Python, JavaScript/TypeScript, Go, Bash,
+SQL, PHP, Rust, PowerShell, or Deno; Windmill turns them into sharable HTTP
+endpoints, cron-scheduled jobs, and steps in visual **Flows**. It also
+generates internal apps from those flows.
+
+This package wraps the official `ghcr.io/windmill-labs/windmill` image in
+single-container **server mode** (the server embeds a default worker, so no
+separate worker container is needed).
+
+State lives entirely in **PostgreSQL** (Cloudron `postgresql` addon). Windmill
+uses Postgres `LISTEN/NOTIFY` for job queuing, so **no Redis is required**.
+
+## Authentication
+
+Windmill supports **OIDC** and **SAML** natively. Unlike many apps, these are
+configured in the **in-app Admin Settings UI** (persisted in the database),
+not via environment variables.
+
+### Post-install OIDC setup (recommended)
+
+1. Open the Windmill app and sign in as the bootstrap superadmin (the first run
+   prints a `SUPERADMIN_SECRET` / creates an admin — see Windmill docs).
+2. Go to **Admin Settings → Auth → OIDC**.
+3. Enter your identity provider details (Cloudron's OIDC provider issuer,
+   client ID, and client secret). The platform OIDC issuer / client creds come
+   from your Cloudron instance's app SSO configuration.
+4. Save; users can then log in via OIDC.
+
+> OIDC is the preferred auth path for this app. Until OIDC is configured,
+   access is limited to the local superadmin account.
+
+## Features
+
+- **Scripts to endpoints**: any script becomes a typed HTTP API + background job
+- **Flows**: visually chain scripts with branching, loops, retries, error handling
+- **Schedules**: cron-based job scheduling
+- **Apps**: generate internal UIs from flows
+- **Multi-language**: Python, JS/TS, Go, Bash, SQL, PHP, Rust, PowerShell, Deno
+- **Secrets**: encrypted secret management with inheritance
+- **Queuing**: Postgres `LISTEN/NOTIFY` (no external broker)
+
+## Configuration
+
+### Ports
+- **8000**: Windmill web UI + REST API
+
+### Addons
+- **postgresql** (v14): all persistent state, jobs, flows, users, queue
+- **localstorage** (`/app/data`): ephemeral job working files
+
+### Environment Variables
+The `start.sh` entrypoint derives `DATABASE_URL` automatically from the
+Cloudron PostgreSQL addon. The only fixed knob is:
+
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `MODE` | `server` | Run mode (server embeds a default worker) |
+
+`DATABASE_URL` is composed at runtime as
+`postgres://$USER:$PASS@$HOST:$PORT/$DB?sslmode=disable`.
+
+## Usage
+
+1. Install the package on Cloudron (provisions a PostgreSQL database).
+2. On first boot, Windmill runs migrations and bootstraps a superadmin.
+3. Sign in, then immediately configure OIDC under Admin Settings (above).
+4. Create a script, expose it as a flow/app, schedule it, or call its HTTP endpoint.
+
+## Upstream
+
+- **Repository**: https://github.com/windmill-labs/windmill
+- **Image**: `ghcr.io/windmill-labs/windmill:1.514.1`
+- **Docs**: https://www.windmill.dev/docs

Package-Workspace/Automation/windmill/start.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+set -euo pipefail
+
+# Build the PostgreSQL connection URL from the Cloudron postgresql addon.
+export DATABASE_URL="postgres://${CLOUDRON_POSTGRESQL_USERNAME}:${CLOUDRON_POSTGRESQL_PASSWORD}@${CLOUDRON_POSTGRESQL_HOST}:${CLOUDRON_POSTGRESQL_PORT}/${CLOUDRON_POSTGRESQL_DATABASE}?sslmode=disable"
+
+# Single-container server mode (server embeds a default worker).
+export MODE="${MODE:-server}"
+
+# Wait for PostgreSQL to accept connections before starting. Windmill runs SQL
+# migrations on startup, so the DB must be reachable. Uses bash /dev/tcp (no
+# pg_isready dependency).
+echo "Waiting for PostgreSQL at ${CLOUDRON_POSTGRESQL_HOST}:${CLOUDRON_POSTGRESQL_PORT} ..."
+for i in $(seq 1 60); do
+  if (exec 3<>"/dev/tcp/${CLOUDRON_POSTGRESQL_HOST}/${CLOUDRON_POSTGRESQL_PORT}") 2>/dev/null; then
+    exec 3>&- 3<&- || true
+    echo "PostgreSQL is reachable."
+    break
+  fi
+  echo "  not ready yet, retrying in 2s ($i/60)"
+  sleep 2
+done
+
+cd /usr/src/app
+exec windmill

Package-Workspace/Documentation-Tools/docker-drawio/.env.example

@@ -0,0 +1,14 @@
+# draw.io optional environment variables.
+# The app runs with none of these set; they are tuning knobs only.
+
+# Base URL of the deployment (leave unset to auto-detect).
+# DRAWIO_BASE_URL=
+
+# Run fully self-contained without loading assets from external CDNs.
+# DRAWIO_SELF_CONTAINED=1
+
+# PlantUML server URL for inline UML diagram rendering.
+# PLANTUML_URL=https://www.plantuml.com/plantuml
+
+# draw.io export server URL for server-side PDF/PNG/PDF export.
+# EXPORT_URL=

Package-Workspace/Documentation-Tools/docker-drawio/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## 24.7.17 — Initial Cloudron package
+
+- First Cloudron package for draw.io (diagrams.net)
+- Wraps the official `jgraph/drawio:24.7.17` Tomcat image
+- Fronted by the Cloudron authentication proxy (no app-level users; stateless
+  client-side diagramming tool)
+- No database / no persistent storage required
+- HTTP port 8080, health check on `/`

Package-Workspace/Documentation-Tools/docker-drawio/CloudronManifest.json

@@ -0,0 +1,23 @@
+{
+  "version": 1,
+  "manifestVersion": 2,
+  "type": "app",
+  "id": "io.cloudron.drawio",
+  "title": "draw.io",
+  "description": "draw.io (diagrams.net) is a client-side diagramming application for making flowcharts, process diagrams, org charts, UML, ER diagrams, network diagrams and more. Diagrams are stored in the browser or synced to cloud storage. No server-side database.",
+  "author": "JGraph",
+  "website": "https://www.drawio.com",
+  "contactEmail": "cloudron@tsys.dev",
+  "tagline": "Free online diagram drawing tool",
+  "version": "24.7.17",
+  "healthCheckPath": "/",
+  "httpPort": 8080,
+  "httpAuth": {
+    "type": "proxy"
+  },
+  "memoryLimit": 512,
+  "addons": {},
+  "mediaLinks": [],
+  "changelog": "Initial Cloudron package for draw.io. Stateless diagramming app fronted by the Cloudron authentication proxy (no app-level users).",
+  "icon": "file://logo.png"
+}

Package-Workspace/Documentation-Tools/docker-drawio/Dockerfile

@@ -0,0 +1,26 @@
+# draw.io Cloudron Package
+#
+# draw.io (diagrams.net) is a client-side JavaScript diagramming application
+# served by Tomcat. It is stateless: diagrams are stored in the browser
+# (localStorage) or exported / synced to cloud storage (Google Drive, OneDrive,
+# GitHub, etc.). There is no database and no server-side persistence.
+#
+# Authentication: draw.io has no user model, so this package uses Cloudron's
+# authentication proxy (httpAuth.type=proxy in CloudronManifest.json). The
+# Cloudron admin restricts which platform users may reach the app; the browser
+# then challenges for Cloudron credentials before access is granted.
+FROM jgraph/drawio:24.7.17
+
+# The upstream Tomcat image may not ship curl; install it for the health check.
+USER root
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
+
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+    CMD curl -f http://localhost:8080/ || exit 1
+
+# Upstream CMD (ENTRYPOINT /docker-entrypoint.sh + "catalina.sh run") is
+# inherited unchanged; Tomcat serves draw.war as the root webapp on 8080.

Package-Workspace/Documentation-Tools/docker-drawio/README.md

@@ -0,0 +1,68 @@
+# draw.io Cloudron Package
+
+## Description
+
+draw.io (diagrams.net) is a free, open-source, client-side diagramming
+application for creating flowcharts, process diagrams, organizational charts,
+UML, entity-relationship, network diagrams, and more. It runs entirely in the
+browser; diagrams are stored in browser `localStorage` or exported / synced to
+cloud storage providers (Google Drive, OneDrive, GitHub, GitLab, Dropbox).
+
+This package wraps the official `jgraph/drawio` Docker image (Tomcat serving
+`draw.war`).
+
+## Authentication
+
+draw.io has **no built-in user model** — it is a stateless client-side tool.
+This package therefore uses **Cloudron's authentication proxy**
+(`httpAuth.type = proxy` in `CloudronManifest.json`). The Cloudron admin
+restricts which platform users/groups may reach the app; authorized users are
+challenged for their Cloudron credentials before the diagram editor loads.
+
+This is the recommended pattern for utility apps without their own user
+directory.
+
+## Features
+
+- **Diagram Types**: Flowcharts, BPMN, UML, ERD, network, AWS/Azure/GCP
+  architecture, mind maps, org charts, floor plans, Venn, and more
+- **Shape Libraries**: Hundreds of built-in stencils + custom shape import
+- **Export**: PNG, JPEG, SVG, PDF, HTML, VSDX
+- **Cloud Sync**: Google Drive, OneDrive, GitHub, GitLab, Dropbox, Trello
+- **Offline**: Works fully offline; diagrams persist in the browser
+- **Collaboration**: Real-time co-editing via Google Drive / Microsoft Teams
+- **Embed**: Embed diagrams in Confluence, Jira, Notion, web pages
+
+## Configuration
+
+### Ports
+- **8080**: Tomcat HTTP (the only exposed port)
+
+### Environment Variables (optional)
+draw.io runs out-of-the-box with no configuration. These are optional knobs:
+
+| Variable | Purpose |
+|----------|---------|
+| `DRAWIO_BASE_URL` | Base URL for the deployment |
+| `DRAWIO_SELF_CONTAINED` | `1` to run fully self-contained (no external CDNs) |
+| `PLANTUML_URL` | URL of a PlantUML server for UML rendering |
+| `EXPORT_URL` | URL of a draw.io export server (for server-side PDF/PNG) |
+| `DRAWIO_CSP_URL` | Content Security Policy allowlist |
+
+### Storage
+- **None required.** draw.io is stateless. Diagrams live in the browser or in
+  cloud storage. No Cloudron addons are used.
+
+## Usage
+
+1. Install the package on Cloudron.
+2. In the Cloudron access control, grant the desired users/groups access.
+3. Open the app location — you'll be prompted for Cloudron credentials.
+4. Start drawing. Save diagrams to browser, export to file, or connect a cloud
+   storage provider for persistence.
+
+## Upstream
+
+- **Repository**: https://github.com/jgraph/docker-drawio
+- **Image**: `jgraph/drawio:24.7.17`
+- **Website**: https://www.drawio.com

README.md

@@ -9,7 +9,7 @@ The Cloudron component focuses on packaging upstream free/libre/open application
 ### 📊 Current Progress
 
 - **Total Applications**: ~57 (see [GitUrlList.txt](GitUrlList.txt))
-- **Completed Packages**: 7/~57 (~12%)
+- **Completed Packages**: 9/~57 (~16%)
 - **Packaging Templates**: Created ✅
 - **Packages Committed & Pushed**: 7 ✅
 
@@ -26,6 +26,8 @@ The Cloudron component focuses on packaging upstream free/libre/open application
 | 5 | WireViz Web | Documentation-Tools | 378MB | 3005 | localstorage | ✅ Committed |
 | 6 | Puter | Development | 361MB | 4100 | localstorage, postgresql | ✅ Committed |
 | 7 | Corteza | Low-Code | 436MB | 80 | localstorage, postgresql | ✅ Committed |
+| 8 | draw.io | Documentation-Tools | — | 8080 | none (auth proxy) | ✅ Committed |
+| 9 | Windmill | Automation | ~2GB | 8000 | localstorage, postgresql | ✅ Committed |
 
 ### 📦 Packages in Development
 
@@ -59,7 +61,7 @@ None currently in development.
 
 ### ⚡ Productivity Metrics
 
-- **Packages Completed**: 7/~57 (~12%)
+- **Packages Completed**: 9/~57 (~16%)
 - **Average Package Time**: ~30 minutes
 - **Success Rate**: 100% (all packages built successfully)
 - **Commits Pushed**: 100% (all packages pushed to remote)
@@ -74,7 +76,7 @@ Applications are organized by function rather than programming language:
 | Functional Category | Description | App Count | Packages Completed |
 |---|---|---|---|
 | **API-Gateway** | API management and gateway solutions | 2 | 2/2 (100%) ✅ |
-| **Automation** | Workflow automation and scripting tools | 4 | 0/4 (0%) |
+| **Automation** | Workflow automation and scripting tools | 4 | 1/4 (25%) |
 | **Business-Apps** | Enterprise business applications | 9 | 0/9 (0%) |
 | **Collaboration** | Team collaboration and communication | 2 | 0/2 (0%) |
 | **Communication** | Messaging and communication platforms | 2 | 0/2 (0%) |
@@ -138,7 +140,7 @@ Applications are organized by function rather than programming language:
 | [AutoBOM](https://github.com/opulo-inc/autobom) | [GitHub](https://github.com/opulo-inc/autobom) | Automatic bill of materials generation | Development |
 | [Midday](https://github.com/midday-ai/midday) | [GitHub](https://github.com/midday-ai/midday) | AI-powered business intelligence platform | Business-Apps |
 | [OpenBlocks](https://github.com/openblocks-dev/openblocks) | [GitHub](https://github.com/openblocks-dev/openblocks) | Low-code application development platform | Low-Code |
-| [Docker DrawIO](https://github.com/jgraph/docker-drawio) | [GitHub](https://github.com/jgraph/docker-drawio) | Dockerized version of Draw.io diagramming tool | Documentation-Tools |
+| [Docker DrawIO](https://github.com/jgraph/docker-drawio) | [GitHub](https://github.com/jgraph/docker-drawio) | Dockerized version of Draw.io diagramming tool | Documentation-Tools | ✅ Packaged |
 | [SigNoz](https://github.com/SigNoz/signoz) | [GitHub](https://github.com/SigNoz/signoz) | Open-source observability platform | Monitoring |
 | [Sentry](https://github.com/getsentry/sentry) | [GitHub](https://github.com/getsentry/sentry) | Error tracking and performance monitoring | Monitoring |
 | [ChirpStack](https://github.com/chirpstack/chirpstack) | [GitHub](https://github.com/chirpstack/chirpstack) | Open-source LoRaWAN network server | Infrastructure |
@@ -150,7 +152,7 @@ Applications are organized by function rather than programming language:
 | [SDRangel](https://github.com/f4exb/sdrangel) | [GitHub](https://github.com/f4exb/sdrangel) | Software defined radio application | Infrastructure |
 | [No-Code Architects Toolkit](https://github.com/stephengpope/no-code-architects-toolkit) | [GitHub](https://github.com/stephengpope/no-code-architects-toolkit) | No-code development toolkit | Low-Code |
 | [Warp](https://github.com/sebo-b/warp) | [GitHub](https://github.com/sebo-b/warp) | Terminal and shell enhancement tool | Development | |
-| [Windmill](https://github.com/windmill-labs/windmill) | [GitHub](https://github.com/windmill-labs/windmill) | Open-source workflow automation platform | Automation |
+| [Windmill](https://github.com/windmill-labs/windmill) | [GitHub](https://github.com/windmill-labs/windmill) | Open-source workflow automation platform | Automation | ✅ Packaged |
 | [Corteza](https://github.com/cortezaproject/corteza) | [GitHub](https://github.com/cortezaproject/corteza) | Open-source low-code platform | Low-Code |
 | [Security Awareness Training](https://github.com/security-companion/security-awareness-training) | [GitHub](https://github.com/security-companion/security-awareness-training) | Security awareness training platform | Security |
 | [Comply](https://github.com/strongdm/comply) | [GitHub](https://github.com/strongdm/comply) | Compliance and audit management | Security |

STATUS.md

@@ -3,17 +3,16 @@
 > **Human read-only. Agents maintain this file automatically after each work
 > session.** Do not edit by hand — the next agent run will overwrite it.
 >
-> **Last updated:** 2026-07-30 by Crush (GLM-5.2) — gardening protocol established;
-> inventory counts reconciled to 7 packaged / 57 upstream apps.
+> **Last updated:** 2026-07-30 by Crush (GLM-5.2) — Windmill packaged (OIDC,
+> PostgreSQL, no Redis); draw.io + Windmill validated end-to-end with docker.
 
 ## Current State: STABLE (packaging phase, ongoing)
 
-Cloudron packaging pipeline is operational. 7 of ~57 upstream applications are
-packaged, committed, and pushed. Packaging templates exist for the four core
-patterns. The gardening protocol (this file + AGENTS.md) was just established
-to keep docs in sync going forward.
+Cloudron packaging pipeline is operational. 9 of ~57 upstream applications are
+packaged, committed, and pushed. Packaging templates exist for the core
+patterns. The gardening protocol (this file + AGENTS.md) keeps docs in sync.
 
-## Completed Packages (7)
+## Completed Packages (9)
 
 | # | Application | Category | Pattern | Port(s) | Addons |
 |---|-------------|----------|---------|---------|--------|
@@ -24,6 +23,8 @@ to keep docs in sync going forward.
 | 5 | WireViz Web | Documentation-Tools | Python build | 3005 | localstorage |
 | 6 | Puter | Development | Multi-stage (Node.js) | 4100 | localstorage, postgresql |
 | 7 | Corteza | Low-Code | Pre-compiled binaries | 80 | localstorage, postgresql |
+| 8 | draw.io | Documentation-Tools | Official-image wrapper + auth proxy | 8080 | none (stateless) |
+| 9 | Windmill | Automation | Official-image wrapper + start.sh | 8000 | localstorage, postgresql |
 
 Each package lives in `Package-Workspace/<Category>/<app>/` and contains a
 `Dockerfile`, `CloudronManifest.json`, `README.md`, `CHANGELOG.md`, `logo.png`,
@@ -46,10 +47,10 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
 |----------|------|----------|-------|
 | **API-Gateway** | 2 | 2/2 (100%) ✅ | Category complete |
 | Development | 4 | 2/4 | reviewboard, puter done |
-| Documentation-Tools | 3 | 1/3 | wireviz-web done |
+| Documentation-Tools | 3 | 2/3 | wireviz-web, draw.io done |
 | Low-Code | 3 | 1/3 | corteza done |
 | Monitoring | 6 | 1/6 | healthchecks done |
-| Automation | 4 | 0/4 | |
+| Automation | 4 | 1/4 | windmill done |
 | Business-Apps | 8 | 0/8 | |
 | Collaboration | 2 | 0/2 | |
 | Communication | 1 | 0/1 | |
@@ -64,6 +65,41 @@ Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
 | Security | 5 | 0/5 | |
 | System-Administration | 2 | 0/2 | |
 
+## Auth Status
+
+Auth capability is a hard gate before packaging (see
+[AGENTS.md § Authentication Policy](AGENTS.md)). ✅ = OIDC preferred, ⚠️ =
+LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
+(unacceptable / blocked-on-auth).
+
+### Completed packages (9)
+
+| App | OIDC | LDAP | Verdict | Note |
+|-----|------|------|---------|------|
+| Webhook | n/a | n/a | 🔄 proxy-eligible | No user concept; **auth-gap: needs `httpAuth` proxy added** |
+| APISIX | plugin | plugin | ⚠️ risk | openid-connect/ldap-auth gateway plugins (edge auth, not dashboard) |
+| Healthchecks | no | no | 🔄 proxy-eligible | REMOTE_USER_HEADER support; consider httpAuth proxy |
+| Review Board | no | yes | ⚠️ risk (LDAP) | SAML 2.0 via plugin; built-in LDAP/AD backend |
+| WireViz Web | n/a | n/a | 🔄 proxy-eligible | Stateless, no users; **auth-gap: needs `httpAuth` proxy added** |
+| Puter | no | no | ❌ risk | Own user system, no SSO federation — needs revisit |
+| Corteza | yes | no | ✅ preferred | Native OIDC via `auth.external.providers.openid-connect.*` |
+| draw.io | n/a | n/a | 🔄 proxy | **Packaged** with `httpAuth.type=proxy` (no users, stateless) |
+| Windmill | yes | no | ✅ preferred | **Packaged**; OIDC configured via Admin Settings UI (no env vars) |
+
+### Candidates researched
+
+| App | OIDC | LDAP | Verdict | Note |
+|-----|------|------|---------|------|
+| NetBox | yes | yes | ✅ auth, ❌ Redis | OIDC+LDAP native, but HARD Redis dep (Cloudron has none) — Complex |
+| Gophish | no | no | ❌ blocked | Local admin login only, no SSO — do not package until auth added |
+
+**Immediate queue:** research next OIDC/auth-proxy candidates (Sentry, SigNoz,
+Langfuse, Fleet, InvenTree, GoAlert) and pick the cleanest wins.
+**Deferred:** NetBox (bundle Valkey+supervisor — significant), Gophish
+(blocked-on-auth).
+**Tech debt:** add `httpAuth` proxy to Webhook + WireViz Web (stateless apps);
+revise Puter auth.
+
 ## Known Issues
 
 | Issue | Impact | Status |