ah good next package release will add the cloudron user to the dialout group, that should fix it also in the long run then.

Yes my.subdomain.com works perfectly. and yes i changed the cloudflare dns to the same local ip as the my,subdomain and it is now working. i thought guac would be running on a different ip address to the cloudron machine

Indeed on Cloudron the app needs to specify which ports are forwarded from outside to the app container. Currently HA has no ports setup there.

We can easily add port 1400 for this, but it is not clear how this is protected by HA. Is this designed to be used in a trusted home network or fine to be exposed on the public?