TAPPaaS/makerfloss
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
makerfloss/README.md

48 lines
1.9 KiB
Markdown
Raw Normal View History

Seed the MakerFLOSS devops repo with the podman module README, a module-catalog.json validated against TAPPaaS's module-catalog-fields.json, and the podman module copied verbatim from Community/src/larsrossen/containers/podman into a flat src/containers/ layout (the catalog carries the explicit moduleJson path, so layout is free).
2026-08-22 18:46:24 +02:00
# makerfloss
The MakerFLOSS **DevOps repository** for experimental TAPPaaS modules.
Modules are developed and tried out here, on the TAPPaaS system at
[makerfloss.eu](https://makerfloss.eu), before they are proposed upstream to
[TAPPaaS](https://codeberg.org/TAPPaaS/TAPPaaS) or
[Community](https://codeberg.org/TAPPaaS/Community). Expect things to be
half-built, renamed, or removed.
## Layout
```text
src/module-catalog.json # the registry a TAPPaaS instance reads
src/containers/podman/ # one directory per module
```
## Using it from a TAPPaaS instance
Register the repository on the `tappaas-cicd` mothership, then install a module
from it:
```bash
README: correct the repository add invocation repository.sh takes the URL positionally (name is derived from it), clones over https, and defaults to the stable branch — which this repo does not have.
2026-08-22 18:57:01 +02:00
site-manager repository add forgejo.makerfloss.eu/TAPPaaS/makerfloss --branch main
Seed the MakerFLOSS devops repo with the podman module README, a module-catalog.json validated against TAPPaaS's module-catalog-fields.json, and the podman module copied verbatim from Community/src/larsrossen/containers/podman into a flat src/containers/ layout (the catalog carries the explicit moduleJson path, so layout is free).
2026-08-22 18:46:24 +02:00
module-manager module add podman --environment <env>
```
README: correct the repository add invocation repository.sh takes the URL positionally (name is derived from it), clones over https, and defaults to the stable branch — which this repo does not have.
2026-08-22 18:57:01 +02:00
`--branch main` is not optional: `repository add` defaults to `stable`, and this
repo has no such branch. The repository name (`makerfloss`) is derived from the
URL, and the clone is made over HTTPS.
Seed the MakerFLOSS devops repo with the podman module README, a module-catalog.json validated against TAPPaaS's module-catalog-fields.json, and the podman module copied verbatim from Community/src/larsrossen/containers/podman into a flat src/containers/ layout (the catalog carries the explicit moduleJson path, so layout is free).
2026-08-22 18:46:24 +02:00
## Modules
Merge portainer into podman: engine plus GUI in one module Podman is the container foundation, Portainer CE is the web interface onto it, running as a container on the very engine it manages. This is what the separate portainer module already did, so it is retired rather than duplicated. Two sockets on purpose: the rootful one is the Docker-compatible API Portainer drives (it does not support rootless), the rootless user socket is for people who ssh in and run containers by hand — which was the original podman module's point and is worth keeping. An explicit proxyDomain lets the module publish at the environment's own domain instead of <module>.<environment-domain>, making it that environment's gateway. DESIGN.md keeps the Cockpit identity analysis: it is the reason for the change, and anyone proposing 'just put Cockpit behind forward-auth' should read it.
2026-08-25 09:30:11 +02:00
Two takes on the same job — run containers on a lab host, let registered people manage them,
reach the other hosts in the zone.
Add portainer and komodo as parallel container-management modules portainer: Portainer CE on rootful podman (Portainer drives the Docker-compatible API, and rootless is not supported upstream), published via network:proxy with proxyAllowedZones left unset so members reach it from a client zone but the internet does not. Login is OIDC: identity:identity writes the client credentials, update.sh resolves the endpoints from the discovery document and PUTs them into /api/settings. A break-glass local admin stays for when Authentik is down. Multi-host is the agent on :9001 per host. komodo: scaffold only — komodo.json plus a README that specifies what install.sh and update.sh must do. GPL, no edition split, but it needs a database and models builds and stacks, so it is the alternative rather than the teaching example. Neither has been run on a live TAPPaaS yet; both are catalogued as incomplete.
2026-08-23 09:45:01 +02:00
Seed the MakerFLOSS devops repo with the podman module README, a module-catalog.json validated against TAPPaaS's module-catalog-fields.json, and the podman module copied verbatim from Community/src/larsrossen/containers/podman into a flat src/containers/ layout (the catalog carries the explicit moduleJson path, so layout is free).
2026-08-22 18:46:24 +02:00
| Module | What it is | Status |
| --- | --- | --- |
Merge portainer into podman: engine plus GUI in one module Podman is the container foundation, Portainer CE is the web interface onto it, running as a container on the very engine it manages. This is what the separate portainer module already did, so it is retired rather than duplicated. Two sockets on purpose: the rootful one is the Docker-compatible API Portainer drives (it does not support rootless), the rootless user socket is for people who ssh in and run containers by hand — which was the original podman module's point and is worth keeping. An explicit proxyDomain lets the module publish at the environment's own domain instead of <module>.<environment-domain>, making it that environment's gateway. DESIGN.md keeps the Cockpit identity analysis: it is the reason for the change, and anyone proposing 'just put Cockpit behind forward-auth' should read it.
2026-08-25 09:30:11 +02:00
| [podman](src/containers/podman) | Podman engine + Portainer CE console; OIDC login, agents on other hosts | incomplete — **the one the session uses** |
Add portainer and komodo as parallel container-management modules portainer: Portainer CE on rootful podman (Portainer drives the Docker-compatible API, and rootless is not supported upstream), published via network:proxy with proxyAllowedZones left unset so members reach it from a client zone but the internet does not. Login is OIDC: identity:identity writes the client credentials, update.sh resolves the endpoints from the discovery document and PUTs them into /api/settings. A break-glass local admin stays for when Authentik is down. Multi-host is the agent on :9001 per host. komodo: scaffold only — komodo.json plus a README that specifies what install.sh and update.sh must do. GPL, no edition split, but it needs a database and models builds and stacks, so it is the alternative rather than the teaching example. Neither has been run on a live TAPPaaS yet; both are catalogued as incomplete.
2026-08-23 09:45:01 +02:00
| [komodo](src/containers/komodo) | GPL Core + Periphery alternative; scaffold, scripts specified but not written | scaffold |
Merge portainer into podman: engine plus GUI in one module Podman is the container foundation, Portainer CE is the web interface onto it, running as a container on the very engine it manages. This is what the separate portainer module already did, so it is retired rather than duplicated. Two sockets on purpose: the rootful one is the Docker-compatible API Portainer drives (it does not support rootless), the rootless user socket is for people who ssh in and run containers by hand — which was the original podman module's point and is worth keeping. An explicit proxyDomain lets the module publish at the environment's own domain instead of <module>.<environment-domain>, making it that environment's gateway. DESIGN.md keeps the Cockpit identity analysis: it is the reason for the change, and anyone proposing 'just put Cockpit behind forward-auth' should read it.
2026-08-25 09:30:11 +02:00
`podman` absorbed the former standalone `portainer` module: Podman is the container
foundation, Portainer is the GUI onto it, one VM. Cockpit was dropped because it fits neither
requirement — it is not an OIDC client and cannot be made one, and its multi-host switcher is
deprecated and disabled by default because it "cannot be secure". The reasoning is in
Add portainer and komodo as parallel container-management modules portainer: Portainer CE on rootful podman (Portainer drives the Docker-compatible API, and rootless is not supported upstream), published via network:proxy with proxyAllowedZones left unset so members reach it from a client zone but the internet does not. Login is OIDC: identity:identity writes the client credentials, update.sh resolves the endpoints from the discovery document and PUTs them into /api/settings. A break-glass local admin stays for when Authentik is down. Multi-host is the agent on :9001 per host. komodo: scaffold only — komodo.json plus a README that specifies what install.sh and update.sh must do. GPL, no edition split, but it needs a database and models builds and stacks, so it is the alternative rather than the teaching example. Neither has been run on a live TAPPaaS yet; both are catalogued as incomplete.
2026-08-23 09:45:01 +02:00
[podman/DESIGN.md](src/containers/podman/DESIGN.md#identity-integration--the-analysis).
Reference in a new issue Copy permalink