Cloudron Forum

Thanks. I did find a "race", though I am not 100% sure if that is the issue. If @necrevistonnezr checked for updates when I was releasing 9.0.5, it will indeed show up that 9.0.4 update is available ... The release process is not entirely atomic...

Hi everyone, I'm trying to set up authentication for a simple web application and I'm running into some confusion around OAuth/OIDC best practices with Cloudron. My Setup: Frontend: Static website served by Surfer (Cloudron app) Backend: n8n workflows for API endpoints Authentication: Want to use Cloudron's built-in OIDC My Intended Flow: User clicks login on frontend (JavaScript SPA) Redirect to Cloudron OIDC authorization endpoint User authenticates with Cloudron Frontend receives authorization code/token Frontend passes token to n8n backend for verification n8n validates token with Cloudron and proceeds with authorized operations The Problem: I understand that exposing a client_secret in JavaScript is a security anti-pattern. For single-page applications, the recommended approach is to use a "public client" with PKCE (Proof Key for Code Exchange) instead of client secrets. However, when I look at Cloudron's OIDC app configuration, I don't see any option to: Configure a client as "public" (no secret required) Enable PKCE support Set the client type appropriately for SPAs My Questions: Does Cloudron's OIDC implementation support public clients with PKCE? If not, what's the recommended pattern for SPA authentication with Cloudron? Should I be using a different flow entirely (like having n8n handle the OAuth dance server-side)? Is installing a separate Keycloak instance the only way to get proper SPA OIDC support? I'm hoping there's a standard way to handle this that I'm missing. The alternative of putting authentication logic entirely in n8n (server-side) seems to complicate the frontend significantly. Any guidance on the proper architecture pattern here would be greatly appreciated! Additional Context: All components are running on the same Cloudron instance I'd prefer to stick with Cloudron's built-in capabilities if possible Thanks in advance!

@jdaviescoates cheers! Well yes, basically people get a managed Cloudron with proper onboarding, the difference is the selection of preinstalled apps (or none for the Cloudron package), the distinction is mostly for marketing purposes.

Hello @zack13532 Glad to read that this solution suits you well. Oh, and since that was your first post. Welcome to the Cloudron forum.

Hello @manners No problem! Always happy to help.

This is why we can't have nice things: https://github.com/alam00000/bentopdf/releases/tag/v1.1.4 It recently came to my attention from a user of ours that a company was taking advantage of our open Apache 2.0 license. They repackaged BentoPDF, sold it as a proprietary product at a high price, and offered zero credit or contributions back to the community. To be blunt, that’s not okay. It undermines the work of every single contributor and the entire spirit of the project. That’s why we are switching BentoPDF to the AGPLv3 license. [...] Here’s what you need to know: Commercial use is still allowed. You can continue to use BentoPDF in your products and for your company. If you modify BentoPDF and run it as a public-facing service (like a SaaS product), you must now share your source code under the same AGPLv3 license. [...] Most importantly BentoPDF is still free and open source and always will be.

@tronical personally I do this process : fork the repo make changes docker build etc. docker push etc cloudron install etc. Maybe I should learn cloudron build but I am an old dog with limited brain space My build script (usually in folder above the app dev folder) : #!/bin/bash if [ "$#" -lt 1 ]; then echo "Usage: $0 <image-name> [cache|nocache] <appname.yourdomain.tld>" exit 1 fi # Get the directory from which the script was called BUILD_DIR="$(pwd)" if [ "$2" = "cache" ]; then echo "Building with cache ..." docker build --platform linux/amd64 -t $1 "$BUILD_DIR" else echo "Building with no cache ..." docker build --no-cache --platform linux/amd64 -t $1 "$BUILD_DIR" fi docker push $1 cloudron install --image $1 --location $3 e.g. ../cld.sh dockerregistry.yourdomain.tld/appname:version cache appname.yourdomain.tld

Oh sorry, I totally missed this. Thanks and noted!