jpmschweitzer/portainer-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
db3260dd12df9e4453c016f28a1e2cfa12545241
portainer-core/STATUS.md
T

7.3 KiB
Raw Blame History

Project Status

Last Updated: 2025-11-23 Version: 0.8.2-authentik-api-protection

Current Phase

Active Work: Security & SSO Implementation (Authentik Deployment) Status: 🔄 IN PROGRESS - 2 Services Protected (Organizr + Core API)

See PLANS.md for complete implementation roadmap and CHANGELOG.md for version history.

In Progress

Priority 1: Security & SSO Implementation (Authentik)

  • Milestone 1: Authentik Deployment

    • Deploy Authentik server and worker containers
    • Configure shared PostgreSQL database (authentik_user, authentik database)
    • Configure shared Redis (DB 0)
    • Fix health checks (Python urllib instead of wget/curl)
    • Create NPM proxy host for auth.schweitz.net
    • Generate admin recovery key and set password
    • Memory optimization: 563MB total (80-90% reduction vs previous attempt)

  • Milestone 2: Google OAuth Integration

    • Create Google OAuth credentials (Client ID/Secret)
    • Configure Authentik Google source via API
    • Configure identification stage to show social login
    • Test Google OAuth login (successful)
    • Verify user creation (jpmschweitzer@gmail.com - external type)

  • Milestone 3: Forward Auth for Organizr ✅ COMPLETE (2025-11-21)

    • Create Authentik Proxy Provider (Organizr Proxy) via API
    • Create Authentik Application (Organizr) via API
    • Assign provider to embedded outpost (embedded outpost failed)
    • Deploy standalone outpost container (authentik-proxy on port 9443)
    • Configure Redis connection for standalone outpost
    • Verify outpost endpoints operational
    • Configure NPM forward auth for home.schweitz.net
    • Test SSO access to Organizr (Google OAuth login working)
    • Verify no redirect loops
    • Fix Organizr auto-login (moved headers to location / block)

Resolution: Embedded outpost has version-specific issues in 2024.8.4. Deployed standalone authentik-proxy container successfully. Forward auth fully operational with Organizr auto-login working.

Standalone Outpost Details:

  • Container: authentik-proxy (port 9445:9443)
  • Status: ✅ Healthy (websocket connected, ping endpoint responding)
  • Memory: ~150MB
  • Provider: Organizr Proxy (forward_single mode)
  • Token: 9blMGz71CFMJszs7AedQefgydpTnwvybjmMn0AlYilIKBV5LIq7snqnCodwX

NPM Configuration:

  • Applied to: home.schweitz.net (Organizr) ONLY
  • Forward auth: https://localhost:9445/outpost.goauthentik.io (NPM on host network)
  • WebSocket support: Enabled
  • Headers: X-authentik-username, X-authentik-email, X-authentik-groups, X-authentik-name, X-authentik-uid
  • Status: ✅ Fully operational, tested in incognito

Critical Fix: Authentication headers must be set inside location / block, not at server level, for proper forwarding to backend applications.

Priority 2: Core-API Refactoring & Infrastructure Management ✅ COMPLETE

  • Code Cleanup: Restructure Core API into function-specific controller files

    • Create /controllers directory structure
    • Create /clients directory structure
    • Create base.py controller base class
    • Add infrastructure settings to config.py
    • Create credentials management system
    • Update main.py routing to include infrastructure controller
    • Separate AI Orchestrator logic into ai_controller.py
    • Extract webscraper to tools_controller.py
    • Create health_controller.py for monitoring endpoints

  • Infrastructure Management Controller: Build automation API for service management

    • Portainer Integration (HTTP client with access token)
    • NPM Integration (HTTP client with JWT bearer token + auto-refresh)
    • Read/List Endpoints (all implemented & tested)
    • Write Endpoints (POST/PUT/DELETE all implemented & tested)
    • Portainer API Token generated programmatically
    • Uptime Kuma Integration (deferred - complex Socket.IO)
    • Replace ad-hoc shell scripts in /stacks with API endpoints
    • Add CLI wrapper for common operations

Priority 3: AI Orchestrator Phase 2 (Memory Systems) - DEFERRED

  • Implement Tier 1: ConversationBufferMemory (in-memory, last 10 turns)
  • Implement Tier 2: ConversationSummaryMemory (SQLite summaries)
  • Integrate Tier 3: VectorStoreRetrieverMemory (Qdrant semantic search)
  • Create Qdrant collections (conversation_memory, documents, user_facts)
  • Implement memory consolidation service
  • Add conversation history API endpoints
  • Test memory persistence across container restarts

Current Blockers

None - SSO implementation complete for critical services. Remaining service rollout deferred in favor of other priorities.

Key Metrics

Metric Target Current Status
Containers Running 15+ 22 🟢 All Services Operational
GPU Accessible Yes Yes 🟢 Working (RTX 2080 Ti)
Storage Used <80% 58% HDD (3.6TB/3.7TB) 🟢 Healthy
Services Accessible All 21/21 🟢 Complete
Remote Access Working Ready 🟢 Headscale + NPM
Firewall Active Yes Yes 🟢 UFW Configured
Backups Configured Yes Yes 🟢 Daily @ 3 AM
AI Orchestrator Phase 6 Phase 1 ✅ 🟡 Phase 2 Deferred
SSO (Authentik) Phase 5 Core Complete ✅ 🟢 Organizr + Core API Protected

Quick Reference

Documentation

Key Paths

  • SSD configs: /home/jpmschweitzer/docker-data/
  • HDD content: /mnt/media/
  • Stacks: Managed in Portainer web UI
  • Scripts: /mnt/media/Projects/portainer-core/scripts/

Active Services & URLs

Infrastructure:

Networking:

Monitoring:

Applications:

Background Services:

  • Watchtower: Automatic updates daily @ 4 AM
  • Maintenance: Automated backups daily @ 3 AM

For detailed implementation history and completed work, see CHANGELOG.md

Reference in New Issue View Git Blame Copy Permalink