After a server migration I expirienced a somehow similar behaviour. After the cloudron restored from the backup penpot OIDC didn't work. penpot package version: 1.7.0 Frontend said: "Authentifizierungsanbieter ist nicht konfiguriert." On the backend: "E app.http.errors - hint="restriction error", data={:type :restriction, :code :provider-not-configured, :provider :oidc, :hint "provider not configured“}" I did the following diagnostics: I checked OIDC login on other apps (e.g. gitlab) -> worked as expected. I checked curl -v https://my.mydomain.de/.well-known/openid-configuration -> it answered correctly cloudron-support —troubleshoot -> said all checks [OK] I freshly installed another instance on the same machine but different domain. As a regression to 1.1 was no Option -> same error I double checked DNS entries. -> same error I renewed the password of the accounts setup in penpot -> same error Now after about 24h after the restore I tried again a fresh install -> it worked Returned to the previous instance –> It all of a sudden worked. Solution: Time is a healer… This is realy very astonishing and I feel lucky, but it is not very reliable and now brings up questions how to secure the designwork of me and others when working with penpot. Unfortunatly I have no time left to further investigate, but it seems that OIDC & penpot have issue after restoring of cloudron...

Right I think for this we should rather adjust the package to enable the optionalSso flag, otherwise this can have unexpected side-effects, if the app state assumes Cloudron OIDC and thus ensures that on startup, while the user overwrites some related env vars for custom use. This will especially become an issue if env vars change in the future.

Ok! Thank you! Cloudron in any case amazing product

press play & get link -> https://penpot.example.com/#/view/…

It is currently not on our list, given the penpot installation count we see and that being quite the edge case on top which needs extra maintenance on our side. We will keep it in mind for when we have free resources to tackle that.

Ah I didn't realize this is the actual domain you had installed Penpot, so never mind my comment about external resources not loading. What makes you think your issue is related to the github issue you posted? Do you have any extra error logs which are the same as in the report? Otherwise you may have to create a separate issue in github with your error stack trace, as we are not penpot internal experts here.

The last FAIL is the root cause then, OpenID requires the app to reach the OpenID provider, which is on the dashboard domain on Cloudron. Other OpenID enabled apps will also fail then to log in. If you use Cloudflare, have you tried the suggestion? Otherwise check https://docs.cloudron.io/troubleshooting/#hairpin-nat

Thus far is working well. I was able to copy all my work from Public Instance into Cloudron. Will keep yous posted on any issues. Thanks again!

Hi @nebulon, I've tested the new package. Login is now possible for invited users, it's perfect. And editor role is now correctly applied, I don't know if it was a mistake from me at first, but it's now solved. Thanks a lot for assistance !

Not sure, I can't reproduce this issue here, neither on a fresh nor older instance. Have you found anything related in the upstream issue tracker? Given the exception about incomplete user info, is there anything missing strange in the profile? Maybe special characters which penpot potentially can't handle well?

Thanks @nebulon for the prompt fix!

OK again I asked too quickly. You must be logged out for this to work. I was testing sending an invite to myself before I sent them to the rest of the team... All good!

OK, I bumped the RAM a bit

AFAIK, there isn't one - https://github.com/penpot/penpot/discussions/2508 and https://old.reddit.com/r/selfhosted/comments/n63e71/penpot_admin_user/ I see a repo at https://github.com/penpot/penpot-admin but this is experimental

@nebulon That seemed to fix it. Thanks!

@nebulon thank you. I will upgrade cloudron.