Cloudron Release Notes

We are happy to announce the release of Cloudron 9.2!

For those unaware, Cloudron is a platform that makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server and keep them up-to-date and secure.

Cloudron 9.2 adds a new SCIM addon, MySQL 8.4 and notification emails improvements.

SCIM addon

System for Cross-domain Identity Management API provides user listing access to apps. With this change, apps are immediately aware of all users without requiring users to log in first.

We have implemented SCIM v2. See the documentation for more information.

MySQL 8.4

MySQL 8.0 has reached end of life, and Cloudron now upgrades installations automatically to MySQL 8.4. We have tested all app packages with MySQL 8.4 to ensure compatibility, so the transition is seamless and requires no manual intervention from users.

HTML notification emails

Notification emails now include HTML variants in addition to the existing plain text format, resulting in a more polished and readable experience across mail clients. Email templates can also be tested directly from the “Send test email” button.

Other Notable Changes

• postgresql: remove old vecto.rs extension
• Move configure/admin page link if any into the info view
• dyndns: randomize the cron job that syncs the dns

What's coming next

Head over to our forum to learn more about What's coming in our next release - 10.

Install Cloudron

New to Cloudron? Get started for free by running with 3 simple commands on your server.

wget https://cloudron.io/cloudron-setup
chmod +x ./cloudron-setup
./cloudron-setup

Comments?

Comments/Suggestions/Feedback? Use our Forum or Email us.

Original source

We are happy to announce the release of Cloudron 9.1!

For those unaware, Cloudron is a platform that makes it easy to run web apps like n8n, WordPress, Nextcloud, GitLab on your server and keep them up-to-date and secure.

Notifications view

The notifications panel has been redesigned with read/unread state management.

Two new notifications help you stay on top of updates:

• Automatic app update failure - when an app fails to auto-update e.g., due to an add-on incompatibility or resource constraint)
• Manual platform and app update required - when Cloudron platform or an installed app has a pending update that requires manual intervention

Let's Encrypt ARI support

Certificates are renewed automatically based on suggested renewal times provided via ACME Renewal Information (ARI). Benefits of ARI include reducing load spikes at the CA, faster revocation response, and smarter scheduling. Renewals typically occur 1 month before expiry.

Community apps

Third-party developers can now publish app packages independently using a CloudronVersions.json file. Community apps receive automatic updates when the developer publishes new versions. Around 25 community apps are already available.

Packaging: Backup Hooks & Persistent Dirs

Three new manifest fields (backupCommand, restoreCommand, and persistentDirs) have been added to make it possible to package database apps properly. Directories like /var/lib/postgresql can now persist across container updates, while backup and restore hooks can export and import logical database dumps so that snapshots are always consistent and portable across versions.

Source builds

Apps can now be built directly on the server using cloudron install and cloudron update. The CLI uploads the source directory to the server, which builds the Docker image and starts the app, eliminating the need for a local Docker setup or external build service. For those who prefer building locally or offloading to a dedicated server, alternative build methods are still available.

Backup Integrity Check UI

The "Check integrity" action in the backup menu downloads the backup metadata from remote storage, verifies its signature, and validates all backup files against recorded checksums and sizes.

Filemanager Treeview

The file manager has a tree view in the left panel, making it easy to navigate deeply nested directory structures. Drag and drop across different folders is much simpler since both the source and destination can be visible at the same time.

Passkeys

Passkeys enable passwordless login using a hardware security key, platform authenticator (fingerprint, Face ID), or password manager. A passkey can also serve as a second factor alongside a password.

Click Set up next to Passkey in the profile view to begin the registration process.

Enable passkey

The login screen provides a "Log in with a passkey" option that authenticates without requiring a username or password.

Login with passkey

Event Log: Contextual Search

Searching the email and system event logs now highlights matching entries in place instead of filtering out non-matching ones. This preserves the surrounding context, making it easier to understand what happened before and after each hit. Next and previous buttons allow quick navigation between matches.

Event Log Contextual search

Lazy Service Start

Services like MongoDB, MySQL, PostgreSQL, and TURN are now started lazily, only spinning up when an installed app requires them. This significantly conserves memory and CPU on servers where not all services are in use.

Automatic Update Policy

Updates can now be configured with three policies: Disabled, Apps only, or Platform & Apps. When enabled, a schedule controls which days and hours updates are applied.

Automatic update policy

Other Notable Changes

• App passwords now support expiry dates
• DigitalOcean Spaces: added missing ATL1, BLR1, and SYD1 regions
• File manager: the terminal button automatically changes to the current directory
• Support for CardDAV/CalDAV well-known endpoints
• CLI: switched to a web-based browser login flow, leveraging existing 2FA and passkey authentication without caching passwords locally
• i18n: added Czech translations. Thank to archos
• Backup logs are now more terse and concise
• App operator: fixed display of backup progress and logs
• Location: the UI now shows which DNS records are being overwritten
• Backup storage: removed the local disk provider

What's coming next

Head over to our forum to learn more about What's coming in our next release - 9.2.

Install Cloudron

New to Cloudron? Get started for free by running with 3 simple commands on your server.

wget https://cloudron.io/cloudron-setup
chmod +x ./cloudron-setup
./cloudron-setup

If you made it till here, here's a bonus - starting from Cloudron 9, you don't need to sign up anymore for a Cloudron.io account 🤗.

Comments?

Comments/Suggestions/Feedback? Use our Forum or Email us.

Original source

We are happy to announce the release of Cloudron 9!

For those unaware, Cloudron is a platform that makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server and keep them up-to-date and secure.

New UI

Cloudron 9 introduces a completely redesigned interface. The new UI is mobile-first by design, working seamlessly across phones, tablets, and desktops.

After a year of development, we've rebuilt the dashboard from the ground up using Vue.js 3.5, replacing 10 years of Angular 1.x code. To power the new interface, we developed Pankow—our open-source component library.

Some screenshots:

Dashboard Appstore view Login view Users view

Multiple backup sites

Cloudron can now back up to multiple destinations. Each destination, also known as Backup site, can use a different storage provider and schedule. You can also choose what to store on each site - everything, only selected apps or everything except some apps. For example, back up everything to your primary Digital Ocean Spaces bucket daily, while sending some critical apps to a secondary attached disk storage for extra redundancy.

Live graphs

The Server view now displays real-time and historical graphs for CPU, memory, disk I/O, and network I/O with selectable timeframes.

Backup stats & integrity

Cloudron 9 now tracks backup statistics for every backup. You can see the backup size, backup contents (file count & app count), and the time it took to create the backup in the backup info dialog.

Backup info

A hidden feature is that integrity information is now stored alongside the backups. Each backup includes a SHA256 checksum and file size for verification. This allows detection of corrupted backups before restoration, ensuring only valid backups are used. The verification UI is coming in Cloudron 9.1, which will allow you to manually verify backup integrity at any time.

Multiple docker registries

Multiple private Docker registries can now be configured (previously limited to one), with credentials automatically selected based on the image's registry hostname.

Hetzner Cloud DNS

Hetzner is migrating its DNS Console into Hetzner Cloud. We have added support for the new Hetzner Cloud DNS API. Migrate your domain first and then choose the new provider in the Domains view.

Synology C2

Synology C2 is now a supported backup destination. Create a backup site with C2 credentials to store your backups.

Vanity nameservers

Domains can now use custom (vanity) nameservers like ns1.yourdomain.com instead of provider defaults. Enable the option in advanced settings to bypass nameserver verification checks.

SSHFS optimizations

Hetzner Storage Box is a widely used SSHFS backup destination. Performance optimizations have been made to the SSHFS storage backend to skip FUSE calls and use SSH directly. Users can expect 10-100x speed improvements when using the rsync backup format.

New docs

Documentation has been migrated from MkDocs to Docusaurus. The API is now fully documented with complete endpoint references and examples

Notifications

New email notifications: server reboot required, update failures, and low disk space alerts (triggered at 90% capacity).

We are also working on a new Notifications view for 9.1 .

Other Notable Changes

Software updates: Haraka (3.1.2), Docker (28.1.1), Redis (8.2.2), MongoDB (7.0.28 - this fixes mongobleed)

Support for Ubuntu 20.04 is deprecated

API keys of domains is periodically validated

Optional addons are disabled by default for new installations

mail: Brevo mail relay

App backup runs separately in a background and does not block app operations

Security: API tokens can now be restricted to specific IP addresses or subnets

Gravatar support for profile pictures is dropped

Admins can manage profile pictures of users

OCSP support has been removed. Let's Encrypt has now uses CRLs.

OpenID: Workaround bug in Cloudflare Access

CSP/Robots has common patterns

mail: add rbl6 check

What's coming next

Head over to our forum to learn more about What's coming in our next release - 9.1.

Install Cloudron

New to Cloudron? Get started for free by running with 3 simple commands on your server.

wget https://cloudron.io/cloudron-setup
chmod +x ./cloudron-setup
./cloudron-setup

If you made it till here, here's a bonus - starting from Cloudron 9, you don't need to sign up anymore for a Cloudron.io account 🤗.

Comments?

Comments/Suggestions/Feedback? Use our Forum or Email us.

Original source

We are happy to announce the release of Cloudron 8.3!

For those unaware, Cloudron is a platform that makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server and keep them up-to-date and secure.

Cloudron 8.3 upgrades the base docker image and provides seamless upgrade of the databases.

New base image

Cloudron apps and addons use an Ubuntu 24.04 LTS based image. The new docker image ID is cloudron/base:5.0.0@sha256:04fd70dbd8ad6149c19de39e35718e024417c3e01dc9c6637eaf4a41ec4e596c. Please update the Dockerfile of your custom apps to use this as the base .

Database upgrades

A core part of Cloudron's self-hosting approach is that users shouldn't have to worry about database choices or database versions that are used by apps. The app packaging mechanism makes the appropriate choices based on the app's preferences.

This release contains many upgrades to the underlying databases and frameworks. The upgrade procedure is entirely transparent and hands-off.

• PostgreSQL is upgraded from v14 to v16
• MySQL is upgraded to v8.0.41
• MongoDB upgraded from v6 to v7
• Redis is upgraded to v7.4
• PHP 8.3 is now the minimum in all apps
• Default node version is 22.14.0 TLS
• Solr, used by mail server for FTS, is upgraded to v9
• Default python is 3.12

Database connection commands

You can now use cloudron_<db> to connect to the database from the Web Terminal. So, you can cloudron exec and then cloudron_mysql to connect to mysql without having to type out those pesky env vars.

What's coming next

Head over to our forum to learn more about What's coming in our next release - 9.

Install or update Cloudron

New to Cloudron? Get started for free by running with 3 simple commands on your server.

To update an existing installation, simply click on the 'Update now' button on your dashboard.

Comments?

Comments/Suggestions/Feedback? Use our Forum or Email us.

Original source

We are happy to announce the release of Cloudron 8.2!

For those unaware, Cloudron is a platform that makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server and keep them up-to-date and secure.

Cloudron 8.2 includes support for Sqlite addon, Mail attachment search, OIDC Provider Name Customization, Device Mounts, App Archive, Parallel Tasks, Email notifications, Quay fallback & many bug fixes.

Sqlite Addon

We are seeing more self-hosted applications support Sqlite. Sqlite databases have to be backed up carefully since a simple cp might copy a corrupt database when it's not in WAL mode.

We have added support for Sqlite addon. Like with other databases, Cloudron now takes portable backups of Sqlite databases listed in CloudronManifest.json.

OIDC Provider Name Customization

The Cloudron Name set in the Branding view is now automatically set as the OIDC Provider Name.

App packages can use the new CLOUDRON_OIDC_PROVIDER_NAME environment variable to customize the text of their login buttons. Here's Immich and Grafana making use of the OIDC Provider Name in their login buttons.

Device Mounts

Apps like OpenHAB, Home Assistant, Emby, Jellyfin have device integrations and require access to devices on the host. A list of host devices to be made available to the app can now be specified in the Devices section.

Parallel Tasks

Cloudron had a global lock (in code) preventing operations like backups, updates and app operations from proceeding in parallel. We have removed this global lock and replaced it with a more granular app level lock. A full backup or a Cloudron update can now run in parallel with app operations.

App Archive

The App Archive feature provides a way to uninstall an app and have the safety mechanism of easily restoring it later. When an app is archived, it is uninstalled from the server, but its latest backup is stored in the App Archive.

The App Archive is located in the Backups view.

Mail Attachment Search

Cloudron Mail will index mail attachments using Apache Tika when Full Text Search is enabled.

Email Notifications

In older Cloudron versions, we used to send email notifications by default to all admins. This was considered too spammy and was removed. We have brought email notifications back with the ability for each user to control what emails they want to receive.

Personal email notification preferences can be configured in the Notifications view:

Quay Fallback

DockerHub seems to use first 64 bits of IPv6 address for rate limiting. Unfortunately, this results in many Cloudrons hitting rate limits incorrectly. As a workaround, we have started pushing our app images to Quay.io under the username cloudron . When a pull from DockerHub fails, the code fallsback to pulling from Quay.io .

Other Notable Changes

• mail: Update Haraka to 3.0.5
• Update docker to 27.3.1
• Security: Samy Mahi reported a critical vulnerability which allows Cloudron admins to get SSH access. We thank Samy for making a responsible disclosure to us (README and REPORT).
• Slow disks can be excluded from periodic disk usage collection.
• postgres: add support for vector extension.
• groups: add events to eventlog
• Hetzner: add Helsinki location for backups
• scheduler: create jobs with Cloudron Time Zone setting
• Gandi: add support for Personal Access Tokens

What's coming next

Head over to our forum to learn more about What's coming in our next release - 9.

Install or update Cloudron

New to Cloudron? Get started for free by running with 3 simple commands on your server.

To update an existing installation, simply click on the 'Update now' button on your dashboard.

Comments?

Comments/Suggestions/Feedback? Use our Forum or Email us.

Original source

We are happy to announce the release of Cloudron 8.1!

For those unaware, Cloudron is a platform that makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server and keep them up-to-date and secure.

Cloudron 8.1 includes support for Hetzner Object Storage, Gandi PAT and OpenID Groups. It also fixes regressions in Cloudron 8.

Hetzner Object Storage

Hetzner recently released their S3-Compatible Object Storage . In the Cloudron dashboard, you can choose Hetzner Object Storage as the destination for your backups.

Gandi PAT

Gandi has obsoleted the old API Keys and introduced Personal Access Tokens. Users hosting their domains in Gandi.net are encouraged to move to this new scheme at the earliest. Simple choose the token type as Personal Access Token (PAT) in the Domains view.

OpenID Groups

We have added groups claim in OIDC to convey group membership information for a user. In addition, refresh token support has also been enabled.

Other Notable Changes

node.js was updated to 20.18.0

dashboard: various mobile and dark mode fixes

private registry: add cloudron as a provider

porkbun: API endpoint changed to https://api.porkbun.com

filemanager: fixed many regressions including broken file upload

log viewer: handle multi-line messages

What's coming next

Head over to our forum to learn more about What's coming in our next release - 8.2.

Install or update Cloudron

New to Cloudron? Get started for free by running with 3 simple commands on your server.

To update an existing installation, simply click on the 'Update now' button on your dashboard.

Comments?

Comments/Suggestions/Feedback? Use our Forum or Email us.

Original source

We are happy to announce the release of Cloudron 8!

For those unaware, Cloudron is a platform that makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server and keep them up-to-date and secure.

Cloudron 8.0 has many new features including support for Ubuntu 24.04 LTS (Noble Numbat), IPv6 only servers, Dashboard List view, Login Page background, deSEC integration, File manager dark mode, Admin Notes, Admin Checklists & lots of bug fixes.

Ubuntu 24.04 LTS

Canonical recently released it's new Ubuntu LTS 24.04 LTS Noble Numbat . Cloudron 8 supports Ubuntu 24.04 and it is also the recommended Ubuntu version for new installations. Note that we will continue to support Ubuntu 20.04 and Ubuntu 22.04 for the foreseeable future.

Users on older Ubuntu versions can upgrade to Ubuntu 24.04 by following our guide.

IPv6 Only Servers

Recently, there has been a change that Cloud Providers like AWS, Hetzner have started to charge for IPv4 addresses. Cloudron 7.1 added IPv6 support but still required an IPv4. Now with Cloudron 8, we support servers which do not have any IPv4.

We have tested IPv6 only server setups on AWS, Hetzner, Upcloud & Vultr and they work great! As a heads up, IPv6 is a totally separate network protocol from IPv4. As such, if you want to host public facing websites and apps, you should still use servers with IPv4.

Dashboard Enhancements

Apps can be viewed as a List in the Cloudron Dashboard .

API Docs

Cloudron API is now stable and fully documented .

Reworked Filter UI

The filter UI has been reworked.

Use / as shortcut to quickly start searching for a specific app.

The filter options are now shown inline and sticky instead of the transient popup in previous releases. You can also filter by tag(s).

Login Page Background

The background image for the login pages can be set in the Branding view.

File Manager Dark Mode

File Manager now has a dark mode!

deSEC Integration

deSEC is a free DNS hosting service, designed with security in mind. Running on open-source software and supported by SSE, deSEC is free for everyone to use.

To use the deSEC integration, move your domain over to deSEC and then choose deSEC provider in the dropdown in the Domains view.

App Notes

App specific notes can be saved in markdown format. Notes are shared by admins. All Admins and App Operators can view and edit them.

Admin Checklist

Cloudron's manifest has been extended to have a checklist property. The checklist is a list of items to be completed post installation. The items can be individually tracked - completed or not, by whom and when. Examples include changing the default admin credentials, reviewing registration settings, etc.

Checklist appears in the Info section of the app.

When a Checklist item is marked as done, the username and date of completion is tracked for audit purposes.

OpenID everywhere

We have adjusted the app packages of over 60 apps to use Cloudron OpenID Connect. Because the authentication flow goes via the Cloudron Auth Endpoint, we can enforce 2FA, enforce rate limits and various security measures which were impossible with the previous LDAP integration.

Apps that use the proxyAuth addon will also now use OIDC automatically.

Troubleshooting tool

Dashboard down? Instead of reaching out to support as the first step, we have implemented all our troubleshooting techniques in the cloudron-support tool. Simply run cloudron-support --troubleshoot on the server, and you will get a good idea of what has gone wrong. See the troubleshooting docs for more information.

App Resources

We have reworked the memory and CPU allocation mechanism for apps.

The memory limit that you set in the Resources view translates the Max RAM the app can use. Apps get unlimited swap.

The previous CPU shares functionality is now CPU limit. With this, you can restrict how much max CPU an app can use.

System Resolver

Prior to Cloudron 8, we use unbound as the system wide DNS resolver. Unfortunately, bugs in unbound and various network restrictions has generated much networking related issues.

To remedy this, we have drastically cut down the role of unbound . Cloudron 8 uses whatever was the server's default system resolver at installation time (usually systemd-resolved). unbound is still used for various recursive DNS queries like propagation and RBL checks.

Non-AVX Servers

We removed support for servers without AVX support in Cloudron 7.5. Turns out low-power systems like the ZimaBoard, but also Netcup servers and various other providers still have servers without AVX.

With Cloudron 8, support for servers without AVX is back! Unfortunately, MongoDB 5 and above still requires AVX. To handle this, when Cloudron is installed on servers without AVX, MongoDB is disabled. As a result, you won't be able to install various apps like Rocket.Chat, Meemo, NodeBB & Wekan.

Hetzner Storage Box

Many users use Hetzner Storage Box for storing very large backups. We looked into optimizing backup speed for this specific case.

For SSHFS mounted Storage Box, we have implemented server side copying. Server side copying allows us to implement hard links correctly and remote copying is 1000x faster. For this reason, we recommend configuring your Storage Box to use SSHFS.

Other Notable Changes

Backups: a long standing issue that backups used to get stuck at zero Mbps is now fixed.

Dashboard: font and color improvements

notfound page: better message when navigating by IP address

CIFS: enable seal encryption by default

NFS: disable rpcbind service. we only support nfsv4 mounting

OVH Storage: Fix location URLs and add RBX region

AMI: IMDv2 support

Mailer: add html version of test mail

Backups: fix issue with s3 backend where files missing in remote was not detected correctly

Backup cleaner: do not remove the backup in progress

What's coming next

Head over to our forum to learn more about What's coming in our next release - 8.1.

Install or update Cloudron

New to Cloudron? Get started for free by running with 3 simple commands on your server.

To update an existing installation, simply click on the 'Update now' button on your dashboard.

Comments?

Comments/Suggestions/Feedback? Use our Forum or Email us.

Original source

We are happy to announce the release of Cloudron 7.7!

For those unaware, Cloudron is a platform that makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server and keep them up-to-date and secure.

Cloudron 7.7 has many new features including Port Range support, Docker improvements, OIDC Avatar Support, MongoDB 6, User Language Persistence, Cancelable uploads & lots of bug fixes.

Port Range

Cloudron already provides a way for apps to expose TCP and UDP ports. From 7.7, an app can expose a port range using the optional portCount field in the manifest. This feature is required for various apps like AzuraCast and MiroTalk.

We have published MiroTalk SFU, a Fast Real-Time Video Conference platform that uses an SFU, that uses this feature.

Docker Improvements

The docker daemon starts a userland proxy service for port forwarding whenever a port is exposed. This proxy consumes a lot of CPU resources since it is created per exposed port. In 7.7, we have disabled the userland proxy in docker.

Apps can now also specify an array of log files instead of stdout/stderr using the logPaths field in the manifest.

Container logging now uses Unix Domain Sockets instead of UDP. This frees up UDP ports for apps.

OIDC Avatar Support

For apps that support it, Cloudron OIDC now exposes user avatars via the picture claim.

MongoDB 6

MongoDB has been upgraded to 6.0. Apps can now use several new features of MongoDB including improved support for Time Series Data, more operators and enriched queries.

Cancelable Uploads

File uploads can be canceled midway in the File manager.

User Language

Users can select their Language preference in the profile view. This setting is now persisted across browsers and devices. Note that the login screen still follows the global language setting chosen by the admin.

Other Notable Changes

• backupcleaner: fix bug where preserved backups were removed incorrectly
• oidc/ldap: fix display name parsing to send anything after first name as the last name
• email: use secp256r1 curve certificates to improve deliverability
• dashboard: use native slider element for app memory and CPU
• dashboard: preserve app link paths
• backups: deleted apps must also be displayed in contents
• Postgres: add vecto.rs extension support for immich

What's coming next

Head over to our forum to learn more about What's coming in our next release - 8.0.

Install or update Cloudron

New to Cloudron? Get started for free by running with 3 simple commands on your server.

To update an existing installation, simply click on the 'Update now' button on your dashboard.

Comments?

Comments/Suggestions/Feedback? Use our Forum or email us.

Original source

We are happy to announce the release of Cloudron 7.6!

For those unaware, Cloudron is a platform that makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server and keep them up-to-date and secure.

Cloudron 7.6 has many new features including MongoDB 5, New base image, OVH DNS backend, DNSimple DNS backend, System Info, Editable Volumes, Color-keyed notifications, External Directory Connector improvements & lots of bug fixes.

Important Deprecation Notice

Cloudron 7.6 upgraded MongoDB to 5.0 which requires AVX. For this reason, Cloudron 7.6 will not install on CPUs without AVX. See https://forum.cloudron.io/topic/8785/avx-support-in-your-vps-server for more information.

New Base Image 4.2.0

The docker base image is now based on Ubuntu Jammy 22.04 LTS. The digest is:

cloudron/base:4.2.0@sha256:46da2fffb36353ef714f97ae8e962bd2c212ca091108d768ba473078319a47f4.

OVH DNS

OVHCloud is the largest hosting provider in Europe. If your domain is hosted on OVH, choose OVH in the drop-down when configuring a domain.

DNSimple

DNSimple is a secure & simple DNS hosting provider . If your domain is hosted on DNSimple, you can choose DNSimple in the provider drop-down in the Domains view.

System Info

SMBIOS information like Vendor and Product is displayed in the System view.

Color-keyed Notifications

Notifications are colored based on their type. Important notifications requiring action including reboot required, certificate renewal failures, backup failures are marked in red. Updates are highlighted with blue.

Editable Volumes

Mount configuration of Volumes like host name, username, password and remote location can be changed at any time.

External Directory

The External Directory connector allows users from an existing LDAP or Active Directory to authenticate with Cloudron. Logs and sync progress can be viewed using the Logs dropdown on the top right.

We have also made many improvements in this release:

• 2FA Behavior: When using another Cloudron as an authentication provider, 2FA of the external directory is used. When using other providers, users can setup 2FA locally.
• User Attributes: The user's role and active state are local and not synced from LDAP.
• Groups Behavior: When Sync Groups is enabled, groups will be automatically created and users will be associated. External Groups are readonly and cannot be edited.
• Sync Behavior: The local directory is synced with the external directory every 4 hours.
• Keep/Make Local: This feature has been removed. It never worked properly because local users were overwritten with the next sync.

Other Notable Changes

• turn: add DDoS mitigation settings
• mail: add option to enable/disable Virtual All mailbox
• app proxy: Host header is set to match the proxy domain instead of the target domain
• oidc: add oidc logo as login indicator for apps
• dyndns: update DNS every 10 mins
• Cleanup backup validation mount point
• dashboard: remove nginx config of old domain when domain changed
• roles: admin role can access branding and networking
• dockerproxy: allow child containers to access volumes
• postgres: enable cube, vector and earthdistance extensions
• support: replace ticket section with help section
• firewall: increase blocklist size to 262144
• profile: changing email now requires password

What's coming next

Head over to our forum to learn more about What's coming in our next release - 8.0.

Install or update Cloudron

New to Cloudron? Get started for free by running with 3 simple commands on your server.

To update an existing installation, simply click on the 'Update now' button on your dashboard.

Comments?

Comments/Suggestions/Feedback? Use our Forum or email us.

Original source

We are happy to announce the release of Cloudron 7.5!

For those unaware, Cloudron is a platform that makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server and keep them up-to-date and secure.

Cloudron 7.5 has many new features including Contabo Object Storage, Trusted IPs, New File Manager UI, Task Logs, Optional App Services, Virtual All Mails Mailbox & lots of bug fixes.

Important Deprecation Notices

Support for Ubuntu 18.04 ended with Cloudron 7.4. This release does not support Ubuntu 18.04 and attempts to update will fail.

This is the last release of Cloudron to support CPUs without AVX support. AVX support is required for MongoDB 5.0. See https://forum.cloudron.io/topic/8785/avx-support-in-your-vps-server for more information.

Contabo Object Storage

Contabo Object Storage is S3 compatible Object Storage from Contabo. To configure Cloudron to use Contabo Object Storage, choose the Contabo Object Storage in the Backups Configure UI.

Trusted IPs

When Cloudron is behind an HTTP(S) proxy like Cloudflare or Nginx Proxy Manager, you can set the IP address(es) of the proxy as trusted. Doing so will make sure Cloudron trusts the values of various proxy related HTTP headers like X-Forwarded-For in the request.

New File Manager UI

The new File Manager UI supports very large folders and lazy loading. Internally, we are slowly porting our frontend to Vue.js and PrimeVue . The File Manager, Web Terminal & Log Viewer are already ported. The code is structured as a shared component library named Pankow. This allows us to reuse the file listing in various apps like Surfer and Cubby.

Task Logs

Cloudron has many background tasks - Certificate renewal, Dynamic DNS, Sync DNS, Mail Server Location Change, Backup Cleaner etc. The history and logs of all the background tasks is now exposed in the UI.

Optional App Services

Redis and TURN configuration of an app can be turned on/off dynamically in the Services section.

Virtual All Mails Mailbox

Cloudron mail server is now configured to expose a virtual All Mails folder (thanks to Dovecot). Some mail clients (like SnappyMail) do not support recursive folder search. Using this folder, you can easily search all your emails in such clients. You can read more about the status of search in various email clients in our blog.

Other Notable Changes

Update Redis to 7.0.11, Docker to 23.0.6 and Haraka to 3.0.2

Ionos Profitbricks: add new regions Berlin and Logrono

mail: fix issue where client IP was leaked in headers

Dashboard now uses OIDC for login

Redirections: Use 301 (permanent) instead of 302 (temporary) for redirections. This is better for SEO.

Major overhaul of the REST API. Please note that the docs are still being updated as of this writing to reflect the new API routes.

Fix import via SSHFS and CIFS.

What's coming next

Head over to our forum to learn more about What's coming in our next release - 7.6.

Install or update Cloudron

New to Cloudron? Get started for free by running with 3 simple commands on your server.

To update an existing installation, simply click on the 'Update now' button on your dashboard.

Comments?

Comments/Suggestions/Feedback? Use our Forum or email us.

Original source

Ubuntu 22.04 Base image

Cloudron apps use a shared base image across all apps and internal services. This is done not just to conserve space but also to have a consistent deployment and debugging environment.

We have upgraded the base image to Ubuntu 22.04 (Jammy). All services and apps have been updated to use this base image. If you deploy custom apps, please use the base image cloudron/base:4.0.0@sha256:31b195ed0662bdb06a6e8a5ddbedb6f191ce92e8bee04c03fb02dd4e9d0286df

Database upgrades

Database services have been upgraded. This was no easy feat - in fact this took us 3 months! We had to test hundreds of apps in the App Store for compatibility before upgrading. On top of this, we had to implement automatic database migrations from their previous version. Unfortunately, one app (Taiga) has to be left behind since it does not support PostgreSQL 14.

Mongodb 4.4 (unchanged)

PostgreSQL 14.5 (upgraded from 12.12)

MySQL 8.0.31 (upgraded from 8.0.27)

Redis 6.0 (upgraded from 5.0.7)

Going forward, please note that MongoDB 5.0 requires AVX support . For this reason, we will stop supporting servers without AVX support from Cloudron 7.6.

OpenID Connect

OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. Starting 7.4, in addition to being a LDAP server, Cloudron is an OIDC provider.

The main advantages of OIDC support are:

True single sign-on across apps

Manage app sessions from the Dashboard

2FA support across apps

More secure since apps never see the user's password

Apps integrate automatically with the OIDC server using the oidc addon. Over the coming months, we will gradually migrate apps using the LDAP addon to use the OIDC addon.

You can also integrate external apps by adding OIDC clients:

Bunny DNS

bunny.net is a powerfully simple CDN that delivers content at lightning speeds across the globe. Cloudron now supports Bunny DNS automation using the new Bunny provider.

Porkbun DNS

Porkbun is an ICANN-accredited domain registrar based out of Portland, Oregon. Cloudron now supports Porkbun DNS automation using the new Porkbun provider.

IDrive e2

IDrive e2 Hot Storage provides S3 compatible object storage with no egress fees and has 15 locations across the US, Canada, Europe and Asia.

You can setup Cloudron to backup there using the IDrive e2 provider.

HSTS Preloading

HSTS Preload is a list of sites that are hardcoded into Chrome as being HTTPS only. Most major browsers (Chrome, Firefox, Opera, Safari, IE 11 and Edge) also have HSTS preload lists based on the Chrome list.

To enable HSTS Preload, enable it in the Security section of the app:

Cloudflare proxying

In previous releases, Cloudron added a new subdomain to Cloudflare with the proxying flag disabled. This could potentially be a security issue because the IP of the server could be exposed during the time you logon to the Cloudflare dashboard and turn the flag on.

In 7.4, you can set the value of proxying flag for newly added subdomains in the Domains view. New DNS records are configured for proxying HTTP requests based on the Enable proxying for new DNS records checkbox.

Danish translation

Dansk 🇩🇰 oversættelse er tilføjet. Mange tak til @jayonrails!

DoT ClientID

ClientIDs are identifiers that can be used with the following DNS protocols: DNS-over-HTTPS, DNS-over-TLS, and DNS-over-QUIC. Each client can be configured and monitored individually.

Cloudron now supports ClientID in apps like AdGuard Home using wildcard aliases.

See the docs for more information.

Disk speed

Disk speed is now shown for each disk in the Graphs.

Internal databases

Cloudron users an internal private network for the databases used by apps. Often, one needs to connect to the internal databases from the outside for migration/analysis/configuration. We have assigned static internal IPs to database services to make it easier to connect to them via SSH tunnel. See the Connect to MySQL and Connect to PostgreSQL guides for more information.

Misc

• Vultr object storage: add bangalore and silicon valley regions
• Exoscale object storage: add sofia and munich regions
• AWS S3: add Asia Pacific and Africa regions
• DigitalOcean spaces: add sydney and singapore regions
• Scaleway: add warsaw region
• Eventlog: now preserved for 3 months
• Log viewer: order existing logs by date across all services
• Dynamic DNS: update IP of secondary, redirect & alias domains
• Domains: add pagination and search filter
• Add authentication for Proxy Apps

What's coming next

Head over to our forum to learn more about what's coming in our next release - 7.5.

Install or update Cloudron

New to Cloudron? Get started for free by running with 3 simple commands on your server.

To update an existing installation, simply click on the 'Update now' button on your dashboard.

Comments?

Comments/Suggestions/Feedback? Use our Forum or email us.

Original source

We are happy to announce the release of Cloudron 7.3!

For those unaware, Cloudron is a platform that makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server and keep them up-to-date and secure.

Cloudron 7.3 has many new features including support for Ubuntu 22.04 Jammy, App Proxy, App links, Cloudflare R2, File manager Split View, Any domain catch-all addresses, Mailbox storage quota, Wildcard email aliases, Optional backup filename encryption, Disk usage graphs, Read only API tokens, LDAP Groups, Mail Queue management, Office 365 mail relay & more!

Ubuntu 22.04

Cloudron 7.2 added support for Ubuntu 22.04. Starting Cloudron 7.3, Ubuntu 22.04 Jammy is the recommended Ubuntu distribution version. All our 1-click images (DigitalOcean, Linode, Vultr, AWS) have been updated to reflect this.

App Proxy

App Proxy lets you proxy internal services through Cloudron. Benefits of using the App Proxy include DNS management, Certificate management, Configurable domain aliases and redirections, setting a custom CSP, setting custom robots.txt and up/down notifications.

App Links

An App Link is a shortcut to an external web site. Clicking on a App Link simply opens up the website in a new tab on the user's browser.

Cloudflare R2

Cloudflare R2 allows developers to store large amounts of unstructured data without the costly egress bandwidth fees associated with typical cloud storage services. You can add Cloudflare R2 as the backup storage for Cloudron from the Backupsview.

File Manager Split View

Many apps do not have a way to manage assets inside the application (Emby, Jellyfin, Paperless NGX, for example). For such situations, we have implemeneted Split View in the File Manager. The split view can be used to drag and drop and move around files easily across directories.

Mail Catch-all address

The Catch-all address of a domain can now be set to a mailbox on another domain hosted on Cloudron.

Mailbox Storage Quota

Storage limit can be set per mailbox by enabling Storage Quota. When storage limit is hit, the email sender will get a bounce message indicating that the receiving mail box is full. In addition, an email notification is placed in the mailbox when it nears 80% and 95% of it's storage quota. Entries are created in the event log as well.

Wildcard email aliases

Email aliases can now contain the * wildcard to match zero or more characters.

Optional Backup Filename Encryption

When using encryption with the rsync format, file names can be optionally encrypted. This is useful when backing up to S3 compliant services which have a max object path size of 4096.

App Graphs

The Graphs view shows an overview of the CPU, disk, network and memory usage of the app.

Disk Usage Graphs

Disk usage can now be computed on demand and displayed in the graphs (System view).

Readonly API Tokens

API Tokens can be created with a readonly scope.

Mail Queue

Mail queue be monitored and managed using the Mail Queue UI.

Misc

Eventlog: add event for impersonated user login

LDAP & user directory: Remove virtual user and admin groups

Directory server: Cloudron Groups are exposed under ou=groups,dc=cloudron

Randomize certificate generation cronjob to lighten load on Let's Encrypt servers

mail: fix issue where signature was appended to text attachments

mail: fix issue where certificate renewal did not restart the mail container properly

mail: Office 365 Relay provider

mail: Email can be sent with a subaddress (just add subaddress as an alias in your mail client).

User directory: Cloudron connector uses 2FA auth

backups: Fix precondition check which was not erroring if mount is missing

nginx: fix zero length certs when out of disk space

logrotate: only keep 14 days of logs

security: do not password reset mail to cloudron owned mail domain

What's coming next

Head over to our forum to learn more about what's coming in our next release - 7.4.

Install or update Cloudron

New to Cloudron? Get started for free by running with 3 simple commands on your server.

To update an existing installation, simply click on the 'Update now' button on your dashboard.

Comments?

Comments/Suggestions/Feedback? Use our Forum or email us.

Original source

Ubuntu 22.04

We are happy to announce the release of Cloudron 7.2!

For those unaware, Cloudron is a platform that makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server and keep them up-to-date and secure.

Cloudron 7.2 has many new features including support for Ubuntu 22.04, Backup Labels, Hetzner DNS, Cron extensions, Dashboard Backgrounds, XFS, Mail FROM Display name, Volumes, New App store filters, additional Wasabi regions & more!

Cloudron 7.2 supports Ubuntu 22.04. We recommend using Ubuntu 22.04 for new Cloudron installations. For existing installations, we have a guide on how to update from Ubuntu 20.04 to Ubuntu 22.04.

Please note that there is no rush to update, since the feature set across Ubuntu versions is one and the same. Canonical will support Ubuntu 20.04 till 2025.

Backup Labels

App Backups can be tagged with a label for readability. In addition, specific backups can be preserved regardless of the clean up policy. This is useful to ensure that backups of template apps are never deleted.

Hetzner DNS

Hetzner's DNS Console is an intuitive DNS management platform. To use the Hetzner DNS provider, generate an API key and choose Hetzner DNS from the domain provider drop down.

Cron extensions

Custom cron commands can be added in an app's cron section. In 7.2, the cron schedule can be a cron extension like @service, @hourly, @yearly. The @service pattern is especially useful because it allows you to run a sidecar service along side the app. The service gets automatically started when the app starts.

Dashboard backgrounds

Users can set a background image for their dashboard in the Profile section.

XFS

Cloudron can now be installed on XFS in addition to EXT4. Volumes also have XFS support.

Mail FROM Display name

Cloudron automatically configures the email address using which apps send email. From 7.2, we have enhanced the packaging format to also specify the email FROM address display name. Note that not all apps support setting the Mail FROM display name. We are actively working on updating each app to use this feature.

Volumes

The Volumes concept has been reworked and enhanced to be a destination for an application's data directory. They can now be used as an app's main data storage or as a shared storage location between apps.

After adding a volume, you can set it as the storage directory of an app:

Cloudron will set things up to ensure that the volume is ready before starting the app.

App store filters

The new User Management filter in the App Store view can be used to filter apps that integrate with Cloudron User Management.

Wasabi regions

New Wasabi Backup Storage endpoints have been added - London, Frankfurt, Paris, Toronto.

Misc

mail: hide log button for non-superadmins

cifs: use credentials file for better password support

backup cleaner: do not clean if not mounted

remote access: add a separate system user named cloudron-support

docker: update to 20.10.14

Add a way to make LDAP users local

exec: rework API to get exit code

Refactor backup code to use async/await

mongodb: fix bug where a small timeout prevented import of large backups

graphite: fix issue where disk names with '.' do not render

What's coming next

Head over to our forum to learn more about what's coming in our next release - 7.3.

Install or update Cloudron

New to Cloudron? Get started for free by running with 3 simple commands on your server.

To update an existing installation, simply click on the 'Update now' button on your dashboard.

Comments?

Comments/Suggestions/Feedback? Use our Forum or email us.

Original source

The moment you understand that one Cloudron instance is not enough for your relevant services (aka apps), you have to deal with your users on different Cloudron instances. Cloudron has a built-in LDAP server for user management, but it was only available for the instance itself. There are some workarounds to connect the Cloudron instance to other LDAP/Directory solutions like Univention UCS, Jumpcloud, Active Directory. But all workarounds feel a bit wrong due to their complexity.

The wait is over and with version 7.1 of the Cloudron platform code you will find native Cloudron 2 Cloudron LDAP support.

This is the first time, that you are able to build more detailed infrastructure for your needs.

In my case, we have decided to use some dedicated Cloudron instances for different purposes. One instance is intended as a mail server. We chose a hosting provider with a good reputation in the IP address space. A second Cloudron instance hosts our internal tools. A third instance we refer to internally as Marketing Cloudron, because of our public websites and analytics. Since we are already using Cloudron in development, we have included our staging Cloudron instance in the LDAP strategy. And the newest Cloudron instance is what we call our infra instance for monitoring, Prometheus and some metrics via Grafana.

All instances are connected to the central directory server and all our users have a seamless Cloudron experience. Top!

Explained step by step

Firstly, decide which of your instances should be the central directory server with all users in your organization. If you cannot find a relevant reason for choosing an instance, take the instance with the nicest domain name :)

Log in to my-dashboard with an administrator role and go to Users. Scroll down and find the Directory Server section. The Directory Server is secured by the built-in firewall. Therefore, you need to know the IP addresses of all your Cloudron instances that are allowed to connect to the Directory Server. Add the IPs line by line. Generate a long secret and enter it in the secret field. Activate the server by clicking the checkbox and do not forget to save.

The forms area of Directory Server

Secondly, log in to my-dashboard with an administrator role on the other Cloudron instance and go to Users. Scroll down and find the Connect to External Directory section. Click Configure and select Cloudron as the provider. Enter the server URL and the secret you have chosen. Do not forget to save. You can click Synchronize to test your connection. If the test was successful, you will see some new users with the From external LDAP directory icon. If something goes wrong, take a look at the logs.

Repeat these steps for every other Cloudron instance you control.

Once these administrative steps are complete, your users will be able to log into any Cloudron instance with their credentials, which they can change in your central Directory Server Cloudron instance. That's nice, isn't it? Or is it?

The forms area of Configure LDAP

Next relevant step

If your Cloudron instance has not been automatically updated to version 7.1 yet, click Check for updates under Settings -> Updates on your Cloudron instance.

Updates available? Click Check for Updates.

And while you wait for your Cloudron to be updated, you can watch Fred Astaire sing and dance in the film "The Sky's the Limit".

Fred Astaire dancing and singing to "One for My Baby (and One More for the Road)". Song written for him to perform in the movie "The Sky's the Limit" (1943). Link goes to Youtube.com

Cloudron

https://www.cloudron.io/get.html

https://forum.cloudron.io/category/4/support

Original source