jpmschweitzer/portainer-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
db3260dd12df9e4453c016f28a1e2cfa12545241
portainer-core/STATUS.md
T

157 lines
7.3 KiB
Markdown
Raw Blame History

# Project Status
> **Last Updated:** 2025-11-23
> **Version:** 0.8.2-authentik-api-protection
## Current Phase
**Active Work:** Security & SSO Implementation (Authentik Deployment)
**Status:** 🔄 **IN PROGRESS** - 2 Services Protected (Organizr + Core API)
See [PLANS.md](PLANS.md) for complete implementation roadmap and [CHANGELOG.md](CHANGELOG.md) for version history.
## In Progress
### Priority 1: Security & SSO Implementation (Authentik)
- [x] **Milestone 1: Authentik Deployment**
- [x] Deploy Authentik server and worker containers
- [x] Configure shared PostgreSQL database (authentik_user, authentik database)
- [x] Configure shared Redis (DB 0)
- [x] Fix health checks (Python urllib instead of wget/curl)
- [x] Create NPM proxy host for auth.schweitz.net
- [x] Generate admin recovery key and set password
- [x] Memory optimization: 563MB total (80-90% reduction vs previous attempt)
- [x] **Milestone 2: Google OAuth Integration**
- [x] Create Google OAuth credentials (Client ID/Secret)
- [x] Configure Authentik Google source via API
- [x] Configure identification stage to show social login
- [x] Test Google OAuth login (successful)
- [x] Verify user creation (jpmschweitzer@gmail.com - external type)
- [x] **Milestone 3: Forward Auth for Organizr** ✅ COMPLETE (2025-11-21)
- [x] Create Authentik Proxy Provider (Organizr Proxy) via API
- [x] Create Authentik Application (Organizr) via API
- [x] ~~Assign provider to embedded outpost~~ (embedded outpost failed)
- [x] **Deploy standalone outpost container** (authentik-proxy on port 9443)
- [x] Configure Redis connection for standalone outpost
- [x] Verify outpost endpoints operational
- [x] **Configure NPM forward auth for home.schweitz.net**
- [x] Test SSO access to Organizr (Google OAuth login working)
- [x] Verify no redirect loops
- [x] Fix Organizr auto-login (moved headers to location / block)
**Resolution:** Embedded outpost has version-specific issues in 2024.8.4. Deployed standalone `authentik-proxy` container successfully. Forward auth fully operational with Organizr auto-login working.
**Standalone Outpost Details:**
- Container: `authentik-proxy` (port 9445:9443)
- Status: ✅ Healthy (websocket connected, ping endpoint responding)
- Memory: ~150MB
- Provider: Organizr Proxy (forward_single mode)
- Token: `9blMGz71CFMJszs7AedQefgydpTnwvybjmMn0AlYilIKBV5LIq7snqnCodwX`
**NPM Configuration:**
- Applied to: home.schweitz.net (Organizr) ONLY
- Forward auth: https://localhost:9445/outpost.goauthentik.io (NPM on host network)
- WebSocket support: Enabled
- Headers: X-authentik-username, X-authentik-email, X-authentik-groups, X-authentik-name, X-authentik-uid
- Status: ✅ Fully operational, tested in incognito
**Critical Fix:** Authentication headers must be set inside `location /` block, not at server level, for proper forwarding to backend applications.
### Priority 2: Core-API Refactoring & Infrastructure Management ✅ COMPLETE
- [x] **Code Cleanup:** Restructure Core API into function-specific controller files
- [x] Create `/controllers` directory structure
- [x] Create `/clients` directory structure
- [x] Create `base.py` controller base class
- [x] Add infrastructure settings to `config.py`
- [x] Create credentials management system
- [x] Update `main.py` routing to include infrastructure controller
- [x] Separate AI Orchestrator logic into `ai_controller.py`
- [x] Extract webscraper to `tools_controller.py`
- [x] Create `health_controller.py` for monitoring endpoints
- [x] **Infrastructure Management Controller:** Build automation API for service management
- [x] Portainer Integration (HTTP client with access token)
- [x] NPM Integration (HTTP client with JWT bearer token + auto-refresh)
- [x] Read/List Endpoints (all implemented & tested)
- [x] Write Endpoints (POST/PUT/DELETE all implemented & tested)
- [x] Portainer API Token generated programmatically
- [ ] Uptime Kuma Integration (deferred - complex Socket.IO)
- [ ] Replace ad-hoc shell scripts in `/stacks` with API endpoints
- [ ] Add CLI wrapper for common operations
### Priority 3: AI Orchestrator Phase 2 (Memory Systems) - DEFERRED
- [ ] Implement Tier 1: ConversationBufferMemory (in-memory, last 10 turns)
- [ ] Implement Tier 2: ConversationSummaryMemory (SQLite summaries)
- [ ] Integrate Tier 3: VectorStoreRetrieverMemory (Qdrant semantic search)
- [ ] Create Qdrant collections (conversation_memory, documents, user_facts)
- [ ] Implement memory consolidation service
- [ ] Add conversation history API endpoints
- [ ] Test memory persistence across container restarts
## Current Blockers
**None** - SSO implementation complete for critical services. Remaining service rollout deferred in favor of other priorities.
## Key Metrics
| Metric | Target | Current | Status |
|--------|--------|---------|--------|
| **Containers Running** | 15+ | 22 | 🟢 All Services Operational |
| **GPU Accessible** | Yes | Yes | 🟢 Working (RTX 2080 Ti) |
| **Storage Used** | <80% | 58% HDD (3.6TB/3.7TB) | 🟢 Healthy |
| **Services Accessible** | All | 21/21 | 🟢 Complete |
| **Remote Access** | Working | Ready | 🟢 Headscale + NPM |
| **Firewall Active** | Yes | Yes | 🟢 UFW Configured |
| **Backups Configured** | Yes | Yes | 🟢 Daily @ 3 AM |
| **AI Orchestrator** | Phase 6 | Phase 1 ✅ | 🟡 Phase 2 Deferred |
| **SSO (Authentik)** | Phase 5 | Core Complete ✅ | 🟢 Organizr + Core API Protected |
## Quick Reference
### Documentation
- [Implementation Plans](PLANS.md) - Master plan tracker and roadmap
- [Changelog](CHANGELOG.md) - Version history
- [Container Reference](docs/reference/CONTAINERS.md) - All deployed services
- [System Specifications](docs/reference/SYSTEM.md) - Hardware and software details
- [Agent Guidelines](AGENTS.md) - Development conventions
### Key Paths
- **SSD configs:** `/home/jpmschweitzer/docker-data/`
- **HDD content:** `/mnt/media/`
- **Stacks:** Managed in Portainer web UI
- **Scripts:** `/mnt/media/Projects/portainer-core/scripts/`
### Active Services & URLs
**Infrastructure:**
- **Portainer:** http://192.168.86.149:8080 (container management)
- **Nginx Proxy Manager:** http://192.168.86.149:8000 (reverse proxy admin)
- **Authentik:** https://auth.schweitz.net (SSO identity provider - Google OAuth enabled)
- **Ollama:** http://192.168.86.149:11434 (ML models API)
**Networking:**
- **Headscale:** http://192.168.86.149:8085 (mesh VPN control)
**Monitoring:**
- **Uptime Kuma:** http://192.168.86.149:3001 (service monitoring)
- **Netdata:** http://192.168.86.149:19999 (system metrics)
- **Organizr:** http://192.168.86.149:8084 OR https://home.schweitz.net (unified dashboard)
**Applications:**
- **Open WebUI:** http://192.168.86.149:8081 (LLM chat interface)
- **Core API:** http://192.168.86.149:8083 (infrastructure management & AI orchestration)
- **Jellyfin:** http://192.168.86.149:8096 OR https://media.schweitz.net (GPU media server)
- **Nextcloud:** http://192.168.86.149:8082 OR https://cloud.schweitz.net (cloud storage)
- **Gitea:** http://192.168.86.149:3002 OR https://git.schweitz.net (Git hosting, SSH: 2222)
- **Samba:** \\\\192.168.86.149 or \\\\tower-of-joy (file shares: Media, Downloads, Backups)
**Background Services:**
- **Watchtower:** Automatic updates daily @ 4 AM
- **Maintenance:** Automated backups daily @ 3 AM
---
*For detailed implementation history and completed work, see [CHANGELOG.md](CHANGELOG.md)*
Reference in New Issue View Git Blame Copy Permalink