According to folks on their forum, there's another step to lock down: https://community.libretranslate.com/t/locking-down-api-key-on-self-hosted-through-cloudron/1767/2 We may need to update the docs here on cloudron: To configure requirement for api key to use, set --req-limit to 0 and add the --api-keys flag. Requests made without a proper api key will be rejected.

Ah thanks for the hint, the latest package uses virtual env now, so we had to update the docs to initialize the python venv with source /app/code/.venv/bin/activate. The docs are now fixed https://docs.cloudron.io/apps/libretranslate/

Interesting comparison

Sounds good, let's close it. Thank you.

Yep, warning disappears with setting this environment variable.

Oh indeed, my entire answer is wrong (thanks @necrevistonnezr ). You have to set LT_REQUIRE_API_KEY_ORIGIN=true in the configs - https://docs.cloudron.io/apps/libretranslate/#api .

@nebulon I think Mastodon's translate button only appears if the poster has set a language for his / hear toot that's different from your language settings. It could be that the LT API relies on the source and destination language settings that are submitted by Mastodon. That could be an explanation for the errors I received, b/c not everyone sets the language correct. Maybe the DeepL API is more flexible here.

@LoudLemur that is indeed strange, Cloudron only reports a running state if the healthcheck succeeds which for libretranslate means that the api and frontend server is up and running.