mrcharles
06a2205949
Establishes a hard auth gate before any app is packaged: OIDC is
preferred, LDAP is acceptable (flagged risk), auth-proxy for user-less
utility apps, and local-only-auth apps are blocked from packaging
until they gain SSO.
- AGENTS.md: new "Authentication Policy" section with the verdict table
and Cloudron OIDC/LDAP/proxy-auth wiring notes.
- STATUS.md: new "Auth Status" matrix assessing all 7 completed
packages + the next candidates (draw.io proxy-eligible, Windmill
OIDC, NetBox OIDC but Redis-blocked, Gophish blocked-on-auth).
Flags tech debt: Webhook/WireViz need httpAuth proxy added; Puter
auth needs revisit.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
132 lines
6.9 KiB
Markdown
132 lines
6.9 KiB
Markdown
# Project Status
|
|
|
|
> **Human read-only. Agents maintain this file automatically after each work
|
|
> session.** Do not edit by hand — the next agent run will overwrite it.
|
|
>
|
|
> **Last updated:** 2026-07-30 by Crush (GLM-5.2) — gardening protocol established;
|
|
> inventory counts reconciled to 7 packaged / 57 upstream apps.
|
|
|
|
## Current State: STABLE (packaging phase, ongoing)
|
|
|
|
Cloudron packaging pipeline is operational. 7 of ~57 upstream applications are
|
|
packaged, committed, and pushed. Packaging templates exist for the four core
|
|
patterns. The gardening protocol (this file + AGENTS.md) was just established
|
|
to keep docs in sync going forward.
|
|
|
|
## Completed Packages (7)
|
|
|
|
| # | Application | Category | Pattern | Port(s) | Addons |
|
|
|---|-------------|----------|---------|---------|--------|
|
|
| 1 | Webhook | API-Gateway | Multi-stage (Go) | 9000 | localstorage |
|
|
| 2 | APISIX | API-Gateway | Official-image wrapper | 9080, 9180, 9443 | localstorage, etcd |
|
|
| 3 | Healthchecks | Monitoring | Django + PostgreSQL | 8000 | localstorage, postgresql |
|
|
| 4 | Review Board | Development | Django + PostgreSQL | 8080 | localstorage, postgresql |
|
|
| 5 | WireViz Web | Documentation-Tools | Python build | 3005 | localstorage |
|
|
| 6 | Puter | Development | Multi-stage (Node.js) | 4100 | localstorage, postgresql |
|
|
| 7 | Corteza | Low-Code | Pre-compiled binaries | 80 | localstorage, postgresql |
|
|
|
|
Each package lives in `Package-Workspace/<Category>/<app>/` and contains a
|
|
`Dockerfile`, `CloudronManifest.json`, `README.md`, `CHANGELOG.md`, `logo.png`,
|
|
and (where relevant) `start.sh` + `.env.example`.
|
|
|
|
## Packaging Patterns Established
|
|
|
|
1. **Official-image wrapper** — APISIX, Healthchecks, Review Board
|
|
2. **Multi-stage build** — Webhook (Go), Puter (Node.js)
|
|
3. **Python build** — WireViz Web
|
|
4. **Django + PostgreSQL** — Healthchecks, Review Board
|
|
5. **Pre-compiled binaries** — Corteza (download + extract from upstream releases)
|
|
|
|
Templates live in `Package-Templates/` (python-app, django-app, official-wrapper).
|
|
Full write-ups of each pattern + challenges are in [`JOURNAL.md`](JOURNAL.md).
|
|
|
|
## Progress by Category
|
|
|
|
| Category | Apps | Packaged | Notes |
|
|
|----------|------|----------|-------|
|
|
| **API-Gateway** | 2 | 2/2 (100%) ✅ | Category complete |
|
|
| Development | 4 | 2/4 | reviewboard, puter done |
|
|
| Documentation-Tools | 3 | 1/3 | wireviz-web done |
|
|
| Low-Code | 3 | 1/3 | corteza done |
|
|
| Monitoring | 6 | 1/6 | healthchecks done |
|
|
| Automation | 4 | 0/4 | |
|
|
| Business-Apps | 8 | 0/8 | |
|
|
| Collaboration | 2 | 0/2 | |
|
|
| Communication | 1 | 0/1 | |
|
|
| Data-Management | 2 | 0/2 | |
|
|
| DevOps-Tools | 1 | 0/1 | |
|
|
| Financial-Payments | 1 | 0/1 | |
|
|
| Financial-Trading | 1 | 0/1 | |
|
|
| Infrastructure | 6 | 0/6 | |
|
|
| Legal | 1 | 0/1 | |
|
|
| Project-Management | 1 | 0/1 | |
|
|
| Scientific-Computing | 2 | 0/2 | |
|
|
| Security | 5 | 0/5 | |
|
|
| System-Administration | 2 | 0/2 | |
|
|
|
|
## Auth Status
|
|
|
|
Auth capability is a hard gate before packaging (see
|
|
[AGENTS.md § Authentication Policy](AGENTS.md)). ✅ = OIDC preferred, ⚠️ =
|
|
LDAP acceptable (risk flag), 🔄 = auth-proxy (no users), ❌ = local-only
|
|
(unacceptable / blocked-on-auth).
|
|
|
|
### Completed packages (7)
|
|
|
|
| App | OIDC | LDAP | Verdict | Note |
|
|
|-----|------|------|---------|------|
|
|
| Webhook | n/a | n/a | 🔄 proxy-eligible | No user concept; **auth-gap: needs `httpAuth` proxy added** |
|
|
| APISIX | plugin | plugin | ⚠️ risk | openid-connect/ldap-auth gateway plugins (edge auth, not dashboard) |
|
|
| Healthchecks | no | no | 🔄 proxy-eligible | REMOTE_USER_HEADER support; consider httpAuth proxy |
|
|
| Review Board | no | yes | ⚠️ risk (LDAP) | SAML 2.0 via plugin; built-in LDAP/AD backend |
|
|
| WireViz Web | n/a | n/a | 🔄 proxy-eligible | Stateless, no users; **auth-gap: needs `httpAuth` proxy added** |
|
|
| Puter | no | no | ❌ risk | Own user system, no SSO federation — needs revisit |
|
|
| Corteza | yes | no | ✅ preferred | Native OIDC via `auth.external.providers.openid-connect.*` |
|
|
|
|
### Candidates researched
|
|
|
|
| App | OIDC | LDAP | Verdict | Note |
|
|
|-----|------|------|---------|------|
|
|
| docker-drawio | n/a | n/a | 🔄 proxy-eligible | Stateless diagramming; package with `httpAuth` proxy |
|
|
| Windmill | yes | no | ✅ preferred | OIDC native; configured via Admin Settings UI (no env vars) |
|
|
| NetBox | yes | yes | ✅ auth, ❌ Redis | OIDC+LDAP native, but HARD Redis dep (Cloudron has none) — Complex |
|
|
| Gophish | no | no | ❌ blocked | Local admin login only, no SSO — do not package until auth added |
|
|
|
|
**Immediate queue:** docker-drawio (proxy auth), Windmill (OIDC).
|
|
**Deferred:** NetBox (bundle Valkey+supervisor — significant), Gophish
|
|
(blocked-on-auth).
|
|
**Tech debt:** add `httpAuth` proxy to Webhook + WireViz Web; revisit Puter auth.
|
|
|
|
## Known Issues
|
|
|
|
| Issue | Impact | Status |
|
|
|-------|--------|--------|
|
|
| **Inventory count drift** | GitUrlList.txt has 57 apps; README inventory table lists 55; some entries differ (e.g. `todogroup/policies`, `CraigChat/craig` in GitUrlList but not README table) | Reconcile on next packaging pass — treat GitUrlList.txt as source of truth |
|
|
| **Erroneous "Warp" packaged marker** | README inventory row marked Warp ✅ Packaged, but Warp is a duplicate (per RESUME) and no package dir exists | Fixed in this session (README marker removed) |
|
|
| **No CI / build validation** | Packages are built but not regression-tested in a pipeline | Future: `cloudron build` + manifest lint in CI |
|
|
| **Packages not exercised on a live Cloudron** | Untested end-to-end on the production Cloudron VPS | Future: install-test a sample package |
|
|
| **Architecture is amd64-only** | Pre-compiled-binary + multi-stage packages target linux/amd64 | Acceptable for current target host |
|
|
|
|
## Pending (next session priorities)
|
|
|
|
1. **Reconcile the app inventory** — make GitUrlList.txt ↔ README inventory
|
|
table ↔ Package-Workspace agree on the exact app set + categories.
|
|
2. **Pick the next quick wins** — prefer apps with official Docker images
|
|
(e.g. Windmill, DataHub, Sentry/SigNoz, NetBox, InvenTree).
|
|
3. **Validate one package end-to-end** on the Cloudron VPS to prove the
|
|
packaging patterns in production, not just at build time.
|
|
4. **Stand up CI** — `cloudron build` + CloudronManifest.json schema lint on
|
|
every package change.
|
|
5. Continue category-by-category until all ~57 apps are packaged.
|
|
|
|
## Repository Summary
|
|
|
|
| Component | Details |
|
|
|-----------|---------|
|
|
| Goal | Package ~57 upstream FLOSS apps for Cloudron (TSYS PaaS of choice) |
|
|
| Upstream source list | [`GitUrlList.txt`](GitUrlList.txt) (57 repos) |
|
|
| Workspace | `Package-Workspace/<Category>/<app>/` (cloned upstream `repo/` dirs are gitignored) |
|
|
| Templates | `Package-Templates/` (python-app, django-app, official-wrapper) |
|
|
| Git remote | `ssh://git@git.knownelement.com:29418/KNEL/TSYSDevStack-SupportStack-Cloudron.git` (`origin/main`) |
|
|
| Sibling project | [`TSYSDevStack-SupportStack-LocalWorkstation`](../TSYSDevStack-SupportStack-LocalWorkstation) (local Docker-Compose dev stack) |
|