makerfloss/README.md

# makerfloss

The MakerFLOSS **DevOps repository** for experimental TAPPaaS modules.

Modules are developed and tried out here, on the TAPPaaS system at
[makerfloss.eu](https://makerfloss.eu), before they are proposed upstream to
[TAPPaaS](https://codeberg.org/TAPPaaS/TAPPaaS) or
[Community](https://codeberg.org/TAPPaaS/Community). Expect things to be
half-built, renamed, or removed.

## Layout

```text
src/module-catalog.json      # the registry a TAPPaaS instance reads
src/containers/podman/       # one directory per module
```

## Using it from a TAPPaaS instance

Register the repository on the `tappaas-cicd` mothership, then install a module
from it:

```bash
site-manager repository add forgejo.makerfloss.eu/TAPPaaS/makerfloss --branch main

module-manager module add podman --environment <env>
```

`--branch main` is not optional: `repository add` defaults to `stable`, and this
repo has no such branch. The repository name (`makerfloss`) is derived from the
URL, and the clone is made over HTTPS.

## Modules

Three parallel takes on the same job — run containers on a lab host, let registered people
manage them, reach the other hosts in the zone. They exist side by side on purpose.

| Module | What it is | Status |
| --- | --- | --- |
| [portainer](src/containers/portainer) | Portainer CE on rootful Podman; OIDC login, agents on other hosts | incomplete — **the one the session uses** |
| [komodo](src/containers/komodo) | GPL Core + Periphery alternative; scaffold, scripts specified but not written | scaffold |
| [podman](src/containers/podman) | Plain Podman host with the Cockpit console; single host, local login | incomplete |

Why three: Cockpit turned out to fit neither requirement — it is not an OIDC client and
cannot be made one, and its multi-host switcher is deprecated and disabled by default because
it "cannot be secure". The reasoning is written up in
[podman/DESIGN.md](src/containers/podman/DESIGN.md#identity-integration--the-analysis).