{"id":44710573,"url":"https://github.com/halos-org/halos-core-containers","last_synced_at":"2026-05-26T18:00:56.573Z","repository":{"id":328676716,"uuid":"1112537286","full_name":"halos-org/halos-core-containers","owner":"halos-org","description":"Core container application definitions for HaLOS","archived":false,"fork":false,"pushed_at":"2026-05-26T11:38:26.000Z","size":472,"stargazers_count":0,"open_issues_count":6,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-26T13:32:57.009Z","etag":null,"topics":["apt-package","halos"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/halos-org.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2025-12-08T19:03:46.000Z","updated_at":"2026-05-26T08:59:30.000Z","dependencies_parsed_at":"2026-02-09T16:00:58.248Z","dependency_job_id":null,"html_url":"https://github.com/halos-org/halos-core-containers","commit_stats":null,"previous_names":["hatlabs/halos-core-containers","halos-org/halos-core-containers"],"tags_count":128,"template":false,"template_full_name":null,"purl":"pkg:github/halos-org/halos-core-containers","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/halos-org%2Fhalos-core-containers","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/halos-org%2Fhalos-core-containers/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/halos-org%2Fhalos-core-containers/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/halos-org%2Fhalos-core-containers/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/halos-org","download_url":"https://codeload.github.com/halos-org/halos-core-containers/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/halos-org%2Fhalos-core-containers/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33532404,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"ssl_error","status_checked_at":"2026-05-26T15:22:15.568Z","response_time":63,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apt-package","halos"],"created_at":"2026-02-15T12:16:02.239Z","updated_at":"2026-05-26T18:00:56.560Z","avatar_url":"https://github.com/halos-org.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# HaLOS Core Containers\n\nCore container application definitions for HaLOS. These apps are pre-installed in HaLOS images, providing essential system functionality including Single Sign-On (SSO).\n\n## What's in This Repository\n\nThis repository contains core HaLOS container applications:\n\n- **Traefik** - Reverse proxy and load balancer, routes all web traffic via subdomains\n- **Authelia** - Identity provider for SSO (OIDC + ForwardAuth)\n- **Homarr** - Dashboard landing page at `https://{hostname}.local/`\n\n**Key difference from halos-marine-containers:** No store package - core apps are pre-installed in HaLOS images, not discovered via store UI.\n\n## Single Sign-On (SSO)\n\nHaLOS provides unified authentication across all web applications:\n\n- All apps accessible via subdomains: `{app}.{hostname}.local`\n- Single login for all applications\n- HTTP automatically redirects to HTTPS\n- Three auth modes: ForwardAuth (default), OIDC, or none\n\nSee [docs/SSO_SPEC.md](docs/SSO_SPEC.md) and [docs/SSO_ARCHITECTURE.md](docs/SSO_ARCHITECTURE.md) for details.\n\n## Multi-Hostname Configuration\n\nBy default, HaLOS answers to two names:\n\n- `${hostname}.local` — mDNS, works on any LAN.\n- `${fqdn}` — full DHCP/admin domain (e.g., `halosdev.example.com` when\n  DHCP option 15 is set or the admin runs `hostnamectl set-hostname`).\n\nBoth are listed in the shipped `/etc/halos/hostnames.conf`. To add VPN\naliases or other multi-label DNS names, edit the file:\n\n```\n# /etc/halos/hostnames.conf\n${hostname}.local           # canonical (first entry)\n${fqdn}                     # auto-resolved DHCP/admin FQDN\nhalosdev.example.com        # VPN/DNS alias\n```\n\nSingle-label hostnames and raw IPs are deliberately not in the example\nset — they cannot carry an Authelia session cookie (RFC 6265 §5.3 step\n5; Authelia 4.39+ rejects them outright), so SSO breaks on them in\nnon-obvious ways. See [docs/HOSTNAMES.md](docs/HOSTNAMES.md) for the\nfull token reference, resolver chain, and trust-boundary notes.\n\nAfter editing, restart the service:\n\n```\nsudo systemctl restart halos-core-containers.service\n```\n\nThis drives:\n\n- **TLS cert SANs** — the self-signed cert covers every entry (DNS and IP)\n- **Authelia session cookies** — one per-DNS-hostname entry; sessions are\n  host-sticky (logging in on hostname A does not authenticate hostname B).\n  IP entries are excluded: RFC 6265 forbids cookies scoped to IP literals,\n  so ForwardAuth cannot work over IP-addressed access.\n- **OIDC `redirect_uris`** — one entry per DNS hostname (IPs excluded)\n\nIP entries serve a single purpose: they appear as cert SANs so that direct\nHTTPS access to the device (e.g., Cockpit at `https://\u003cIP\u003e:9090/`, which\nhas its own authentication) does not trigger a self-signed-cert warning.\n\n### Canonical hostname\n\nThe first non-IP entry is **canonical**. The OIDC issuer URL (the `iss`\nclaim, the discovery endpoint, NextAuth's `NEXTAUTH_URL`) always points\nto the canonical host. OIDC login on a non-canonical hostname briefly\nvisits canonical for the Authelia UI, then returns to the originating\nhost. The canonical host must be reachable from the user's network for\nOIDC login to succeed.\n\n### Cross-paradigm SSO trade-off\n\nPer-hostname session isolation means:\n\n- Cockpit, Grafana, Signal K (ForwardAuth apps) → log in once per\n  hostname you visit.\n- Homarr (OIDC app) → SSO works across hostnames because the OIDC flow\n  always runs through canonical.\n- Mixed flow: visit Homarr on a non-canonical hostname; the auth round\n  trip seeds a canonical Authelia session. Visiting Cockpit on the same\n  non-canonical hostname will still prompt for login.\n\n### Troubleshooting\n\n- **Device unreachable on a hostname**: check `hostnames.conf` for typos,\n  verify the hostname resolves from your network, restart the service.\n- **`HALOS_HOSTNAMES_FALLBACK` in the journal**: the config failed\n  validation and the device booted in single-SAN mode. Inspect the\n  journal message for the cause:\n\n  ```\n  journalctl -u halos-core-containers.service | grep HALOS_HOSTNAMES_FALLBACK\n  ```\n\n- **Stale `${hostname}.local` after rename**: the `${hostname}` token in\n  `hostnames.conf` re-expands at every prestart, so renaming via\n  `hostnamectl set-hostname` followed by a service restart is enough.\n  If you pinned a literal hostname instead, edit the file.\n\n### Limitations\n\n- Hostnames are admin-managed. There is no Cockpit UI yet.\n- The Cockpit `:9090` cert is separate and is not regenerated by this\n  config.\n- DNS-name aliases must be admin-pruned when ownership changes\n  (stale-alias takeover risk).\n- Maximum 16 entries.\n\n## Build Output\n\nCI/CD builds Debian packages from this repository:\n- `halos-traefik-container` - Reverse proxy\n- `halos-authelia-container` - SSO identity provider\n- `halos-homarr-container` - Dashboard landing page\n\nAll packages are published to apt.hatlabs.fi.\n\n## Agentic Coding Setup (Claude Code, GitHub Copilot, etc.)\n\nFor development with AI assistants, use the halos workspace for full context:\n\n```bash\n# Clone the workspace\ngit clone https://github.com/halos-org/halos.git\ncd halos\n\n# Get all sub-repositories including halos-core-containers\n./run repos:clone\n\n# Work from workspace root for AI-assisted development\n# Claude Code gets full context across all repos\n```\n\nSee `halos/docs/` for development workflows:\n- `LIFE_WITH_CLAUDE.md` - Quick start guide\n- `IMPLEMENTATION_CHECKLIST.md` - Development checklist\n- `DEVELOPMENT_WORKFLOW.md` - Detailed workflows\n\n## Repository Structure\n\n```\nhalos-core-containers/\n├── apps/\n│   ├── traefik/            # Reverse proxy\n│   ├── authelia/           # SSO identity provider\n│   └── homarr/             # Dashboard landing page\n├── docs/\n│   ├── SSO_SPEC.md         # SSO technical specification\n│   └── SSO_ARCHITECTURE.md # SSO system architecture\n├── tools/                   # Build scripts\n├── .github/workflows/       # CI/CD\n└── README.md\n```\n\n## Adding a New App\n\n1. Create `apps/\u003capp-name\u003e/` directory\n2. Add required files: `docker-compose.yml`, `metadata.yaml`, `icon.png`\n3. Optionally add `config.yml` for user-configurable settings\n4. Test locally with `container-packaging-tools`\n5. Create PR - CI will build and validate\n\n## Building Locally\n\nRequirements:\n- `container-packaging-tools` package installed\n\n```bash\n# Build all packages\n./tools/build-all.sh\n\n# Build output in build/ directory\nls build/*.deb\n```\n\n## Related Repositories\n\n- [halos](https://github.com/halos-org/halos) - HaLOS workspace and planning\n- [halos-marine-containers](https://github.com/halos-org/halos-marine-containers) - Marine container store\n- [cockpit-apt](https://github.com/halos-org/cockpit-apt) - APT package manager with store filtering\n- [container-packaging-tools](https://github.com/halos-org/container-packaging-tools) - Package generation tooling\n- [apt.hatlabs.fi](https://github.com/hatlabs/apt.hatlabs.fi) - APT repository infrastructure\n\n## License\n\nApache License 2.0 - See [LICENSE](LICENSE) for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhalos-org%2Fhalos-core-containers","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhalos-org%2Fhalos-core-containers","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhalos-org%2Fhalos-core-containers/lists"}