mrcharles
06a2205949
Establishes a hard auth gate before any app is packaged: OIDC is
preferred, LDAP is acceptable (flagged risk), auth-proxy for user-less
utility apps, and local-only-auth apps are blocked from packaging
until they gain SSO.
- AGENTS.md: new "Authentication Policy" section with the verdict table
and Cloudron OIDC/LDAP/proxy-auth wiring notes.
- STATUS.md: new "Auth Status" matrix assessing all 7 completed
packages + the next candidates (draw.io proxy-eligible, Windmill
OIDC, NetBox OIDC but Redis-blocked, Gophish blocked-on-auth).
Flags tech debt: Webhook/WireViz need httpAuth proxy added; Puter
auth needs revisit.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
6.9 KiB
Project Status
Human read-only. Agents maintain this file automatically after each work session. Do not edit by hand — the next agent run will overwrite it.
Last updated: 2026-07-30 by Crush (GLM-5.2) — gardening protocol established; inventory counts reconciled to 7 packaged / 57 upstream apps.
Current State: STABLE (packaging phase, ongoing)
Cloudron packaging pipeline is operational. 7 of ~57 upstream applications are packaged, committed, and pushed. Packaging templates exist for the four core patterns. The gardening protocol (this file + AGENTS.md) was just established to keep docs in sync going forward.
Completed Packages (7)
| # | Application | Category | Pattern | Port(s) | Addons |
|---|---|---|---|---|---|
| 1 | Webhook | API-Gateway | Multi-stage (Go) | 9000 | localstorage |
| 2 | APISIX | API-Gateway | Official-image wrapper | 9080, 9180, 9443 | localstorage, etcd |
| 3 | Healthchecks | Monitoring | Django + PostgreSQL | 8000 | localstorage, postgresql |
| 4 | Review Board | Development | Django + PostgreSQL | 8080 | localstorage, postgresql |
| 5 | WireViz Web | Documentation-Tools | Python build | 3005 | localstorage |
| 6 | Puter | Development | Multi-stage (Node.js) | 4100 | localstorage, postgresql |
| 7 | Corteza | Low-Code | Pre-compiled binaries | 80 | localstorage, postgresql |
Each package lives in Package-Workspace/<Category>/<app>/ and contains a
Dockerfile, CloudronManifest.json, README.md, CHANGELOG.md, logo.png,
and (where relevant) start.sh + .env.example.
Packaging Patterns Established
- Official-image wrapper — APISIX, Healthchecks, Review Board
- Multi-stage build — Webhook (Go), Puter (Node.js)
- Python build — WireViz Web
- Django + PostgreSQL — Healthchecks, Review Board
- Pre-compiled binaries — Corteza (download + extract from upstream releases)
Templates live in Package-Templates/ (python-app, django-app, official-wrapper).
Full write-ups of each pattern + challenges are in JOURNAL.md.
Progress by Category
| Category | Apps | Packaged | Notes |
|---|---|---|---|
| API-Gateway | 2 | 2/2 (100%) ✅ | Category complete |
| Development | 4 | 2/4 | reviewboard, puter done |
| Documentation-Tools | 3 | 1/3 | wireviz-web done |
| Low-Code | 3 | 1/3 | corteza done |
| Monitoring | 6 | 1/6 | healthchecks done |
| Automation | 4 | 0/4 | |
| Business-Apps | 8 | 0/8 | |
| Collaboration | 2 | 0/2 | |
| Communication | 1 | 0/1 | |
| Data-Management | 2 | 0/2 | |
| DevOps-Tools | 1 | 0/1 | |
| Financial-Payments | 1 | 0/1 | |
| Financial-Trading | 1 | 0/1 | |
| Infrastructure | 6 | 0/6 | |
| Legal | 1 | 0/1 | |
| Project-Management | 1 | 0/1 | |
| Scientific-Computing | 2 | 0/2 | |
| Security | 5 | 0/5 | |
| System-Administration | 2 | 0/2 |
Auth Status
Auth capability is a hard gate before packaging (see AGENTS.md § Authentication Policy). ✅ = OIDC preferred, ⚠️ = LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only (unacceptable / blocked-on-auth).
Completed packages (7)
| App | OIDC | LDAP | Verdict | Note |
|---|---|---|---|---|
| Webhook | n/a | n/a | 🔄 proxy-eligible | No user concept; auth-gap: needs httpAuth proxy added |
| APISIX | plugin | plugin | ⚠️ risk | openid-connect/ldap-auth gateway plugins (edge auth, not dashboard) |
| Healthchecks | no | no | 🔄 proxy-eligible | REMOTE_USER_HEADER support; consider httpAuth proxy |
| Review Board | no | yes | ⚠️ risk (LDAP) | SAML 2.0 via plugin; built-in LDAP/AD backend |
| WireViz Web | n/a | n/a | 🔄 proxy-eligible | Stateless, no users; auth-gap: needs httpAuth proxy added |
| Puter | no | no | ❌ risk | Own user system, no SSO federation — needs revisit |
| Corteza | yes | no | ✅ preferred | Native OIDC via auth.external.providers.openid-connect.* |
Candidates researched
| App | OIDC | LDAP | Verdict | Note |
|---|---|---|---|---|
| docker-drawio | n/a | n/a | 🔄 proxy-eligible | Stateless diagramming; package with httpAuth proxy |
| Windmill | yes | no | ✅ preferred | OIDC native; configured via Admin Settings UI (no env vars) |
| NetBox | yes | yes | ✅ auth, ❌ Redis | OIDC+LDAP native, but HARD Redis dep (Cloudron has none) — Complex |
| Gophish | no | no | ❌ blocked | Local admin login only, no SSO — do not package until auth added |
Immediate queue: docker-drawio (proxy auth), Windmill (OIDC).
Deferred: NetBox (bundle Valkey+supervisor — significant), Gophish
(blocked-on-auth).
Tech debt: add httpAuth proxy to Webhook + WireViz Web; revisit Puter auth.
Known Issues
| Issue | Impact | Status |
|---|---|---|
| Inventory count drift | GitUrlList.txt has 57 apps; README inventory table lists 55; some entries differ (e.g. todogroup/policies, CraigChat/craig in GitUrlList but not README table) |
Reconcile on next packaging pass — treat GitUrlList.txt as source of truth |
| Erroneous "Warp" packaged marker | README inventory row marked Warp ✅ Packaged, but Warp is a duplicate (per RESUME) and no package dir exists | Fixed in this session (README marker removed) |
| No CI / build validation | Packages are built but not regression-tested in a pipeline | Future: cloudron build + manifest lint in CI |
| Packages not exercised on a live Cloudron | Untested end-to-end on the production Cloudron VPS | Future: install-test a sample package |
| Architecture is amd64-only | Pre-compiled-binary + multi-stage packages target linux/amd64 | Acceptable for current target host |
Pending (next session priorities)
- Reconcile the app inventory — make GitUrlList.txt ↔ README inventory table ↔ Package-Workspace agree on the exact app set + categories.
- Pick the next quick wins — prefer apps with official Docker images (e.g. Windmill, DataHub, Sentry/SigNoz, NetBox, InvenTree).
- Validate one package end-to-end on the Cloudron VPS to prove the packaging patterns in production, not just at build time.
- Stand up CI —
cloudron build+ CloudronManifest.json schema lint on every package change. - Continue category-by-category until all ~57 apps are packaged.
Repository Summary
| Component | Details |
|---|---|
| Goal | Package ~57 upstream FLOSS apps for Cloudron (TSYS PaaS of choice) |
| Upstream source list | GitUrlList.txt (57 repos) |
| Workspace | Package-Workspace/<Category>/<app>/ (cloned upstream repo/ dirs are gitignored) |
| Templates | Package-Templates/ (python-app, django-app, official-wrapper) |
| Git remote | ssh://git@git.knownelement.com:29418/KNEL/TSYSDevStack-SupportStack-Cloudron.git (origin/main) |
| Sibling project | TSYSDevStack-SupportStack-LocalWorkstation (local Docker-Compose dev stack) |