Semaphore UI now installs on Cloudron in one click, with SSO and backups handled by the platform

[OrcVole]

Hello. We have packaged Semaphore UI for Cloudron, a self-hosting platform, and it is now available to install from its community app list.

Forum thread: https://forum.cloudron.io/topic/15849/semaphore-ui-community-package-now-available

If you help develop Semaphore we would love it if you introduced yourself on the Cloudron forum. You would receive a very warm welcome and people might have questions for you.

What this means for people running Semaphore. Cloudron takes the operational work off your users: scheduled backups with one-click restore, TLS certificates issued and renewed unattended, the platform and its base images patched centrally, single sign-on and user management provided by the platform, and package updates delivered to every installation from one published version.

The consequence for you is that those users can run Semaphore properly and keep it current without being system administrators. Fewer of them end up on a stale or misconfigured instance filing support requests that are really deployment problems.

How it is put together. We build your v2.19.8 tag from source, the Vue frontend first and then the Go binary with your own build:be flags, on the platform's base image. PostgreSQL comes from the platform. Single sign-on uses your own OIDC support rather than an authenticating proxy, specifically so that the REST API and webhook integrations keep working. Ansible and git are in the image, so a fresh install can clone a repository and run a playbook immediately.

On secret custody, since it is the decision that took the most care. The package generates its own encryption keyring at first run and never ships a fixed key.

We noticed that with no key configured, EncryptAESGCM returns the plaintext base64-encoded, and that deployment/compose/server/base.yml carries a literal key which anyone who has read your repository knows. Both are reasonable defaults for a quickstart, and neither is safe for an install somebody leaves running, so the package does neither.

Your keyring design made this straightforward. vaults check and vaults rekey --backup --rollback are exactly what a packager needs, and we use vaults check as the assertion after a restore, because row counts survive a lost key unchanged.

Two small things we ran into Offered in case they are useful rather than as complaints.

The setting for disabling password login is not consulted by the POST /api/auth/login handler, so the endpoint keeps accepting credentials while the interface hides the form. We have documented that for our users rather than presenting the package as single-sign-on-only.

web/src/assets/logo.svg appears to be a leftover from the Vue scaffold. It is the Vuetify mark, and nothing in the source references it. We reached for it first and shipped the wrong icon before noticing that web/public/favicon.svg is the one your interface actually loads.

Would you consider listing Cloudron on your installation page? You already list Docker, Kubernetes and the rest at https://semaphoreui.com/install/ and a line pointing at the community package would let people who already run a Cloudron find it. We are happy to open a pull request with whatever wording you prefer, rather than asking you to write it.

If you would rather not carry a third-party package in your own documentation, that is a completely reasonable answer, and we will not ask twice. Knowing either way is useful to us.

And if a release matters, please tell us. We watch your releases and pick them up in our own time, but we would rather not have a security fix sit unpackaged because we were looking elsewhere. We saw v2.20.0-alpha1 go out today, so we know you move quickly.

Flag anything you would want reaching Cloudron users promptly, either in this thread or on the forum thread above, and we will prioritise it. We cannot promise a fixed turnaround, only that a flagged release goes to the front of the queue.

Come and try it if you are curious. Anyone from the project is very welcome on the Cloudron forum thread at:

https://forum.cloudron.io/topic/15849/semaphore-ui-community-package-now-available

If you would like to see how it is assembled, the package is at https://github.com/OrcVole/semaphore-cloudron. Questions about the packaging are ours to answer rather than yours, and if something in it looks wrong to you, we would rather hear it.

Thank you for Semaphore. It is well-built thing to package.