Cloudron 9.0 (beta) bug reports

[andreasdueren]

Previously, shut down applications were greyed out, this is no longer the case.

[nebulon]

Good catch, that got lost during the transition. It is back now for next release.

[andreasdueren]

There is an issue with the selector for access restrictions. Doesn't list any items on installation of app but can be restricted afterwards.

[nebulon]

Oh great catch, that regression somehow slipped through in that latest patch release. Fixed now in https://git.cloudron.io/platform/box/-/commit/27f975f3c5420dd432a2fcd92589122cc98ca633 with better type checks to avoid that in the future.

[Kubernetes]

After upgrading to Cloudron 9 I cannot send e-mails with Masquerading-Feature. It got disabled for all Domains, but even after enabling it again, my e-mail client (Apple Mail) still fails to send with another e-mailaddress.

Logfile of email service:

Nov 08 20:45:33 [NOTICE] [1BC2F871-D6E6-46D3-888B-3E7A2D3C716D] [core] connect ip=****** port=51653 local_ip=***** local_port=2587
Nov 08 20:45:34 [INFO] [1BC2F871-D6E6-46D3-888B-3E7A2D3C716D] [dns-list] pass:******.combined.mail.abusix.zone
Nov 08 20:45:34 [INFO] [1BC2F871-D6E6-46D3-888B-3E7A2D3C716D] [helo.checks] helo_host: smtpclient.apple, pass:bare_ip, dynamic, valid_hostname, host_mismatch, literal_mismatch, fail:rdns_match
Nov 08 20:45:34 [INFO] [1BC2F871-D6E6-46D3-888B-3E7A2D3C716D] [spf] identity=helo ip=***** domain="smtpclient.apple" mfrom=<postmaster@smtpclient.apple> result=None
Nov 08 20:45:34 [INFO] [1BC2F871-D6E6-46D3-888B-3E7A2D3C716D] [spf] scope: helo, result: None, domain: smtpclient.apple
Nov 08 20:45:34 [INFO] [1BC2F871-D6E6-46D3-888B-3E7A2D3C716D] [tls] secured: cipher=ECDHE-ECDSA-AES128-GCM-SHA256 version=TLSv1.2 verified=false
Nov 08 20:45:34 [INFO] [1BC2F871-D6E6-46D3-888B-3E7A2D3C716D] [core] hook=unrecognized_command plugin=tls function=upgrade_connection params=STARTTLS retval=OK msg=""
Nov 08 20:45:34 [INFO] [1BC2F871-D6E6-46D3-888B-3E7A2D3C716D] [helo.checks] helo_host: smtpclient.apple, pass:bare_ip, dynamic, valid_hostname, host_mismatch, literal_mismatch, fail:rdns_match
Nov 08 20:45:34 [INFO] [1BC2F871-D6E6-46D3-888B-3E7A2D3C716D] [cloudron] Authenticated as MYUSER@SOMEDOMAIN.COM
Nov 08 20:45:34 [INFO] [1BC2F871-D6E6-46D3-888B-3E7A2D3C716D] [core] hook=unrecognized_command plugin=cloudron function=hook_unrecognized_command params=AUTH retval=OK msg=""
Nov 08 20:45:34 [INFO] [1BC2F871-D6E6-46D3-888B-3E7A2D3C716D.1] [core] hook=mail plugin=cloudron function=authorize_mail_from params=<MASKED@SOMEDOMAIN.COM> retval=DENY msg="Authenticated user MYUSER@SOMEDOMAIN.COM cannot send mail as MASKED@SOMEDOMAIN.COM"
Nov 08 20:45:34 [NOTICE] [1BC2F871-D6E6-46D3-888B-3E7A2D3C716D.1] [core] sender <MASKED@SOMEDOMAIN.COM> code=DENY msg="Authenticated user MYUSER@SOMEDOMAIN.COM cannot send mail as MASKED@SOMEDOMAIN.COM"
Nov 08 20:45:34 [NOTICE] [1BC2F871-D6E6-46D3-888B-3E7A2D3C716D.1] [core] disconnect ip=***** rdns=****.t-ipconnect.de helo=smtpclient.apple relay=Y early=N esmtp=Y tls=Y pipe=N errors=0 txns=1 rcpts=0/0/0 msgs=0/0/0 bytes=0 lr="550 Authenticated user MYUSER@SOMEDOMAIN.COM cannot send mail as MASKED@SOMEDOMAIN.COM" time=1.764

[d19dotca]

Sorry if this was mentioned already, but it was possible before on 8.x to search by app name in the list of running apps, but this appears to no longer be the case now as of 9.0.7. Is this intentional? Before, I could search for "WordPress" for example and all the apps would filter to the WordPress installs.

[WiseMetalhead]

It looks like the multipart upload settings for S3-compatible storage aren’t working as expected.
Last night, I enabled a backup of around 150 GB of data in TGZ format. In the configuration, I set the part size to 256 MB.
This morning, when checking the logs, I found that the upload had stopped at 100 GB because the 10,000-part limit was reached. Based on simple math, that would only make sense if each part were 10 MB — which is Cloudron’s default minimum part size.

I double-checked the settings and confirmed that my 256 MB value had been saved correctly. Then I set it to the maximum (1 GB), restarted the server, and manually triggered another backup. Watching the logs again, I noticed the same behavior — a new part was created every 10 MB and uploaded to S3.

Has anyone else run into this issue?

2025-11-09T07:23:19.605Z box:taskworker Starting task 2146. Logs are at /home/yellowtent/platformdata/logs/tasks/2146.log
2025-11-09T07:23:19.624Z box:taskworker Running task of type backup
2025-11-09T07:23:19.644Z box:tasks updating task 2146 with: {"percent":5.761904761904762,"message":"Backing up ***.***.ru (1/18). Waiting for lock"}
2025-11-09T07:23:19.656Z box:locks write: current locks: {"full_backup_task_10b1282f-f0e2-400d-a074-b183f08c16f5":null,"app_backup_07fd2189-9378-4a35-b18d-5cef77461fb1":"2146"}
2025-11-09T07:23:19.656Z box:locks acquire: app_backup_07fd2189-9378-4a35-b18d-5cef77461fb1
2025-11-09T07:23:19.657Z box:tasks updating task 2146 with: {"percent":5.761904761904762,"message":"Snapshotting app ***.***.ru"}
2025-11-09T07:23:19.660Z box:services backupAddons
2025-11-09T07:23:19.660Z box:services backupAddons: backing up ["localstorage","postgresql","sendmail","oidc","redis"]
2025-11-09T07:23:19.661Z box:services Backing up postgresql
2025-11-09T07:23:19.878Z box:services pipeRequestToFile: connected with status code 200
2025-11-09T07:23:23.447Z box:services Backing up redis
2025-11-09T07:23:23.514Z box:services pipeRequestToFile: connected with status code 200
2025-11-09T07:23:23.528Z box:backuptask snapshotApp: ***.***.ru took 3.871 seconds
2025-11-09T07:23:23.564Z box:tasks updating task 2146 with: {"percent":5.761904761904762,"message":"Uploading app snapshot ***.***.ru"}
2025-11-09T07:23:23.564Z box:backuptask runBackupUpload: adjusting heap size to 3840M
2025-11-09T07:23:23.565Z box:shell backuptask: /usr/bin/sudo --non-interactive -E --close-from=4 /home/yellowtent/box/src/scripts/backupupload.js snapshot/app_07fd2189-9378-4a35-b18d-5cef77461fb1.tar.gz.enc 10b1282f-f0e2-400d-a074-b183f08c16f5 {"localRoot":"/home/yellowtent/appsdata/07fd2189-9378-4a35-b18d-5cef77461fb1","layout":[{"localDir":"/mnt/md0/IApps/photos","remoteDir":"data"}]}
2025-11-09T07:23:24.304Z box:backupupload Backing up {"localRoot":"/home/yellowtent/appsdata/07fd2189-9378-4a35-b18d-5cef77461fb1","layout":[{"localDir":"/mnt/md0/IApps/photos","remoteDir":"data"}]} to snapshot/app_07fd2189-9378-4a35-b18d-5cef77461fb1.tar.gz.enc
2025-11-09T07:23:24.306Z box:backuptask upload: path snapshot/app_07fd2189-9378-4a35-b18d-5cef77461fb1.tar.gz.enc site 10b1282f-f0e2-400d-a074-b183f08c16f5 dataLayout {"localRoot":"/home/yellowtent/appsdata/07fd2189-9378-4a35-b18d-5cef77461fb1","layout":[{"localDir":"/mnt/md0/IApps/photos","remoteDir":"data"}]}
2025-11-09T07:23:24.524Z box:backuptask checkPreconditions: mount point status is {"state":"active"}
2025-11-09T07:23:24.524Z box:backuptask checkPreconditions: getting disk usage of /home/yellowtent/appsdata/07fd2189-9378-4a35-b18d-5cef77461fb1
2025-11-09T07:23:24.524Z box:shell backuptask: du --dereference-args --summarize --block-size=1 --exclude=*.lock --exclude=dovecot.list.index.log.* /home/yellowtent/appsdata/07fd2189-9378-4a35-b18d-5cef77461fb1
2025-11-09T07:23:24.531Z box:backuptask checkPreconditions: getting disk usage of /mnt/md0/IApps/photos
2025-11-09T07:23:24.531Z box:shell backuptask: du --dereference-args --summarize --block-size=1 --exclude=*.lock --exclude=dovecot.list.index.log.* /mnt/md0/IApps/photos
2025-11-09T07:23:29.436Z box:backuptask checkPreconditions: total required=125109989376 available=Infinity
2025-11-09T07:23:29.448Z box:backupformat/tgz upload: uploading to site 10b1282f-f0e2-400d-a074-b183f08c16f5 path snapshot/app_07fd2189-9378-4a35-b18d-5cef77461fb1.tar.gz.enc (encrypted: true) dataLayout {"localRoot":"/home/yellowtent/appsdata/07fd2189-9378-4a35-b18d-5cef77461fb1","layout":[{"localDir":"/mnt/md0/IApps/photos","remoteDir":"data"}]}
2025-11-09T07:23:29.450Z box:tasks updating task 2146 with: {"percent":5.761904761904762,"message":"Uploading backup snapshot/app_07fd2189-9378-4a35-b18d-5cef77461fb1.tar.gz.enc (***.***.ru)"}
2025-11-09T07:23:29.457Z box:backupformat/tgz tarPack: processing /home/yellowtent/appsdata/07fd2189-9378-4a35-b18d-5cef77461fb1
2025-11-09T07:23:29.471Z box:backupformat/tgz addToPack: added ./config.json file
2025-11-09T07:23:29.528Z box:backupformat/tgz addToPack: added ./dump.rdb file
2025-11-09T07:23:29.540Z box:backupformat/tgz addToPack: added ./fsmetadata.json file
2025-11-09T07:23:32.318Z box:storage/s3 Upload progress: {"loaded":10485760,"part":1,"Key":"snapshot/app_07fd2189-9378-4a35-b18d-5cef77461fb1.tar.gz.enc","Bucket":"25fc748e-lvcl-backup"}
2025-11-09T07:23:34.405Z box:storage/s3 Upload progress: {"loaded":20971520,"part":2,"Key":"snapshot/app_07fd2189-9378-4a35-b18d-5cef77461fb1.tar.gz.enc","Bucket":"25fc748e-lvcl-backup"}
2025-11-09T07:23:37.143Z box:storage/s3 Upload progress: {"loaded":31457280,"part":3,"Key":"snapshot/app_07fd2189-9378-4a35-b18d-5cef77461fb1.tar.gz.enc","Bucket":"25fc748e-lvcl-backup"}
2025-11-09T07:23:39.234Z box:storage/s3 Upload progress: {"loaded":41943040,"part":4,"Key":"snapshot/app_07fd2189-9378-4a35-b18d-5cef77461fb1.tar.gz.enc","Bucket":"25fc748e-lvcl-backup"}
2025-11-09T07:23:39.425Z box:storage/s3 Upload progress: {"loaded":52428800,"part":5,"Key":"snapshot/app_07fd2189-9378-4a35-b18d-5cef77461fb1.tar.gz.enc","Bucket":"25fc748e-lvcl-backup"}

[hakunamatata]

I upgraded to 9.0.7 yesterday and everything seems to be working fine, but I woke up this morning to find the following notification:

"Domain yourdomain.tld is not configured properly

General error: defaultProxyStatus must be a boolean"

[james]

Hello @hakunamatata
I assume you are using Cloudflare, right?
Can you check your DNS configuration and check/uncheck the proxy part and save the config again?
This might already solve it.
Still, this seems like an unintended bug from the upgrade.

[firmansi]

@nebulon I’m still encountering an issue with the latest Cloudron update: when I try to reset a password for a user who actually resides on Server B (connected to—let’s say—Server A, where I’m attempting the password reset via LDAP), the reset process appears to succeed, and I get a notification stating that the password will be sent to the user. However, after waiting for a long time, the email never arrives.

[Kubernetes]

I think there is something wrong with OID and Safari on iOS since upgrade to Cloudron 9. I cannot login to gitea instance or App Proxy with login requirement. I get error message: "You do not have access" - of course I do.

Error Message in Browser:
{"status":"Bad Request","message":"missing query argument "code""}

When I login on a macos computer there are no issues.

[SansGuidon]

Hey,
I'm worried that some API calls I made in the past are no longer working with V9, and that's both with my instance and with Cloudron demo instance.
I'm trying to simply use the API Token and get system disk usage via the route documented in the API.
e.g with the demo instance of cloudron and a token:

$ curl -H 'Content-Type: application/json' -H 'Authorization: Bearer <REDACTED>' https://my.demo.cloudron.io/api/v1/system/info
{
  "info": {
    "sysVendor": "FUJITSU",
    "productName": "CELSIUS-FTS",
    "uptimeSecs": 410396,
    "rebootRequired": false,
    "activationTime": "2025-01-02T18:04:55.000Z"
  }
}

$ curl -H 'Content-Type: application/json' -H 'Authorization: Bearer <REDACTED>' https://my.demo.cloudron.io/api/v1/system/disk_usage
{
  "status": "Not Found",
  "message": "No such route"
}

Did some routes change compared to the API Docs?
https://docs.cloudron.io/api.html#tag/System/operation/getDiskUsage

Thanks!

[jdaviescoates]

Have these setting be separated out in Cloudron 9?

I wanted to turn of Automatic Platform updates, but leave App updates on:

[d19dotca]

A small observation on the Event Log page (sorry again if this has been reported already, I didn't notice it yet):

There seems to be no gap between the Time & Source columns, at least not using the date format and such that I see. Notice the bleed-in between PM and the Source info like "mail" and "oidc", etc.

Screenshot below. I am using the Safari web browser on macOS.

[nebulon]

@Kubernetes said in Cloudron 9.0 (beta) bug reports:

I think there is something wrong with OID and Safari on iOS since upgrade to Cloudron 9. I cannot login to gitea instance or App Proxy with login requirement. I get error message: "You do not have access" - of course I do.

Is there some way to get console errors in this case? I don't have an iOS device to test this on unfortunately. Or can others reproduce this also?

[Kubernetes]

@nebulon are these the logs you are looking for?

[no timestamp]  [REDACTED] - - [10/Nov/2025:09:09:27 +0000] "GET /login?redirect=/ HTTP/2.0" 200 292170 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Mobile/15E148 Safari/604.1"
[no timestamp]  [REDACTED] - - [10/Nov/2025:09:09:27 +0000] "GET /api/v1/apps/[REDACTED]/icon?1762765767843 HTTP/2.0" 200 14575 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Mobile/15E148 Safari/604.1"
[no timestamp]  [REDACTED] - - [10/Nov/2025:09:09:27 +0000] "GET /api/v1/apps/[REDACTED]/icon HTTP/2.0" 304 0 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Mobile/15E148 Safari/604.1"
[no timestamp]  [REDACTED] - - [10/Nov/2025:09:09:29 +0000] "GET /openid/auth?client_id=[REDACTED]-proxyauth&scope=openid%20profile%20email&response_type=code&redirect_uri=https://[REDACTED]/callback HTTP/2.0" 303 79 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Mobile/15E148 Safari/604.1"
[no timestamp]  [REDACTED] - - [10/Nov/2025:09:09:29 +0000] "GET /openid/interaction/36heYBCBJOx4nnREDACTED3Cde1Ylinxnsxk HTTP/2.0" 200 2325 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Mobile/15E148 Safari/604.1"
[no timestamp]  [REDACTED] - - [10/Nov/2025:09:09:29 +0000] "GET /api/v1/cloudron/avatar HTTP/2.0" 304 0 "https://my.[REDACTED].de/openid/interaction/36heYBCBJOx4nnREDACTED3Cde1Ylinxnsxk" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Mobile/15E148 Safari/604.1"
[no timestamp]  [REDACTED] - - [10/Nov/2025:09:09:29 +0000] "GET /api/v1/apps/[REDACTED]/icon?1762765769473 HTTP/2.0" 200 14575 "https://my.[REDACTED].de/openid/interaction/36heYBCBJOx4nnREDACTED3Cde1Ylinxnsxk" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Mobile/15E148 Safari/604.1"
[no timestamp]  [REDACTED] - - [10/Nov/2025:09:09:31 +0000] "GET /openid/interaction/36heYBCBJOx4nnREDACTED3Cde1Ylinxnsxk/abort HTTP/2.0" 303 0 "https://my.[REDACTED].de/openid/interaction/36heYBCBJOx4nnREDACTED3Cde1Ylinxnsxk" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Mobile/15E148 Safari/604.1"
[no timestamp]  [REDACTED] - - [10/Nov/2025:09:09:31 +0000] "GET /openid/auth/36heYBCBJOx4nnREDACTED3Cde1Ylinxnsxk HTTP/2.0" 303 169 "https://my.[REDACTED].de/openid/interaction/36heYBCBJOx4nnREDACTED3Cde1Ylinxnsxk" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Mobile/15E148 Safari/604.1"
[no timestamp]  [REDACTED] - - [10/Nov/2025:09:09:31 +0000] "GET /callback?error=access_denied&error_description=End-User+aborted+interaction&iss=https%3A%2F%2Fmy.[REDACTED].de%2Fopenid HTTP/2.0" 400 68 "https://my.[REDACTED].de/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Mobile/15E148 Safari/604.1"
[no timestamp]  [REDACTED] - - [10/Nov/2025:09:09:33 +0000] "GET /callback?error=access_denied&error_description=End-User+aborted+interaction&iss=https%3A%2F%2Fmy.[REDACTED].de%2Fopenid HTTP/2.0" 400 68 "https://my.[REDACTED].de/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Mobile/15E148 Safari/604.1"

[nebulon]

hm so looks like safari on iOS aborts the user interaction from that error. Not sure why, I guess we have to find some device to properly debug this then.

[girish]

@hakunamatata thanks, this is fixed in https://git.cloudron.io/platform/box/-/commit/d894de0784ffcb147226c38967311360293e704a .

You can temporarily ignore the notification but if it bothers you:

• Domains -> Edit that Cloudflare domain.
• Change the provider to something else. Then, change it back to Cloudflare. You have to re-enter the API key. Then, Save.

[girish]

@SansGuidon yeah, some routes have changed to adapt to the UI. We haven't updated the API and docs with Cloudron 9 API and screenshots yet (sorry, release and everything all going on in parallel) !

Currently, it's roughly this:

• /api/v1/system/block_devices - this lists block devices . currently, this does not return used space. this was an oversight, i have added this now.
• /api/v1/system/filesystems - this gives filesystems and size/used information . probably, what you want?
• /api/v1/system/filesystem_usage?filesystem=/dev/sda1 - this does a further "du" on one of the filesystems listed in the above call. Since this takes some time, the output is an event stream. You have to pass -H 'Accept: text/event-stream' .

[girish]

@d19dotca said in Cloudron 9.0 (beta) bug reports:

Before, I could search for "WordPress" for example and all the apps would filter to the WordPress installs.

Fixed in https://git.cloudron.io/platform/box/-/commit/a8513cc0fa8e8014da6d8aaa7a963c0ae168b4e5