Portainer stops accepting POST /api/users/admin/init a few minutes after start and answers 303 with Redirect-Reason: AdminInitTimeout. Any transient failure during that window therefore made the module permanently un-bootstrappable. update.sh now restarts the container to reset the timer, waits for the API and retries once, re-reading the setup token because a fresh one is minted at every start. Also splits the OIDC precondition: the single condition reported the secrets env as missing whenever the admin session was absent, which is what sent the first debugging pass down the wrong path. |
||
|---|---|---|
| src | ||
| .gitignore | ||
| README.md | ||
makerfloss
The MakerFLOSS DevOps repository for experimental TAPPaaS modules.
Modules are developed and tried out here, on the TAPPaaS system at makerfloss.eu, before they are proposed upstream to TAPPaaS or Community. Expect things to be half-built, renamed, or removed.
Layout
src/module-catalog.json # the registry a TAPPaaS instance reads
src/containers/podman/ # one directory per module
Using it from a TAPPaaS instance
Register the repository on the tappaas-cicd mothership, then install a module
from it:
site-manager repository add forgejo.makerfloss.eu/TAPPaaS/makerfloss --branch main
module-manager module add podman --environment <env>
--branch main is not optional: repository add defaults to stable, and this
repo has no such branch. The repository name (makerfloss) is derived from the
URL, and the clone is made over HTTPS.
Modules
Three parallel takes on the same job — run containers on a lab host, let registered people manage them, reach the other hosts in the zone. They exist side by side on purpose.
| Module | What it is | Status |
|---|---|---|
| portainer | Portainer CE on rootful Podman; OIDC login, agents on other hosts | incomplete — the one the session uses |
| komodo | GPL Core + Periphery alternative; scaffold, scripts specified but not written | scaffold |
| podman | Plain Podman host with the Cockpit console; single host, local login | incomplete |
Why three: Cockpit turned out to fit neither requirement — it is not an OIDC client and cannot be made one, and its multi-host switcher is deprecated and disabled by default because it "cannot be secure". The reasoning is written up in podman/DESIGN.md.