CCAI : Cloudron Custom App Installer

nostrdev

Agreed that we should not use cloudflare, not just from the single-point-of-failure perspective, but also to protect user privacy

timconsidine

I’m not a fan of Cloudflare - just put it in as fastest way to address a possible vulnerability.
But proof of work is often a pain for users.
I feel there are only 2 good solutions :
Cloudron re-write as an official utility (resolves authentication much more neatly)
CCAI adds user registration
I’m thinking what direction to take it in if not adopted/rewritten

robi

Found 2 bugs with latest CCAI

After install of one app, still being logged in, it's impossible to click on another app to proceed with installation. Starting over of course requires re-logging in.
I was upgrading to 9.0.12 while attempting this so got this:
[9:05:52 PM] [2025-11-26 03:05:51] Failed to install app: 400 message: Box version exceeds Apps maxBoxVersion

timconsidine

@robi thank you for the report.
I will investigate.
I'm hoping that Cloudron will bring out their own version of this - the app would be so much easier for everyone if logging in was not needed (it was in the dashboard somewhere)

I've not updated to 9.0.x yet - waiting for a later release

robi

@timconsidine you are welcome.

You can always test on the demo server.

And at least the second issue is easily solved via an expected version bump or just take out the check. Not sure why it's needed. Is it?

humptydumpty

revive! and...

Thanks @timconsidine for this. I kept coming across CCAI but never looked into it until now. Brilliant approach. I have a few questions.

Is there a doc/faq page on how to use this in case I want to add an app that isn't listed in the catalog?
I noticed zoneminder (alpha) in the list - Is it safe enough to install on a production server? (just want to take a peek at it)
If I install CCAI on my own server - is it pass protected or can anyone access/use it then?
Q more for @staff what's your opinion on CCAI - will you deploy something similar to it?

timconsidine

@humptydumpty thank you.
I am travelling today but will improve documentation when I get back.

In the interim :

there is a button on front screen to add an app by yourself into the catalogue. It’s just filling in some basic details, so quite easy. But I will document it.
if you don’t want it to go into the catalogue, you can scroll down, login and then populate the form manually with details for a one-off deployment
if you deploy CCAI, it will currently be open front page just like CCAI.appx.uk is now (and you can import the master catalogue to your instance). I wasn’t sure that CCAI would have an ongoing usefulness so I didn’t add a login screen and wanted to leave it open for users. But with Cloudron team being always busy, I think there is a case for a private version, and will make a parallel app with login.
a chunk of the app is handling the authentication needed to install an app (login to the Cloudron instance). If Cloudron were to implement something similar, most/all of this could go because the user’s instance would be already authenticated. So easier and more secure. I will have a go at building such an approach, behind a login screen. It could produce some efficiencies and also be more suited to a login protected and “private” installation.

Reminder for anyone looking at CCAI.
Cloudron authentication details are NEVER stored in this open version. They persist in memory for 15 minutes, then expire. And the user can logout before then if they wish.
It was critical for me that CCAI is secure to use, but I understand people won’t be 100% convinced without checking the source. But it’s there for people to do so if they want.

I paused work on CCAI pending a direction, so some polishing is needed for longer term usefulness, and I will look at doing this.

timconsidine

@humptydumpty oh, about zoneminder ….

Yes it is safe to install in a production server.
The app installs and loads and some essential configuration can be done, like adding a camera.
But it’s not currently loading a stream from the camera.

The reason it is ALPHA with warnings is that Zoneminder has some complex runtime internal links for streaming feed which does not fall easily into Cloudron’s separation of /app/code and /app/data. I have been trying to find a solution to this but paused to consider how.

I might need to do some code tweaks during deployment to handle the runtime link generation.
It’s not ideal but might be possible to do in a way which can produce a stable maintainable app.

I want Zoneminder for my own use, so not giving up yet.
You can install to take a peek, just don’t expect the camera feed to show … or let me know if it does !!

timconsidine

I have no doubt that Cloudron team would do a much better job of implementing a custom app installer. Technically not difficult and they have the benefit of working it into and inside the platform.

But I acknowledge that a decision to do so is not technically driven, but strategic. Making it easier to install custom apps to Cloudron will, in my opinion, support strong Cloudron growth.

But it comes with the risk of low-quality custom apps harming Cloudron reputation and increasing support loads.
If it’s an official platform-based installer, it could be difficult to push back against support tickets, even if the app is marked UNSTABLE or CUSTOM.

Maybe some community based app ranking or scoring could help, but I acknowledge these are not robust answers to the issue.

girish

Yes, I want to able to support this natively in Cloudron itself. I think we will put this in 9.1 roadmap. But before we implement, we will make a proposal here just to make sure it is what everyone is expecting . Probably only after new years though since most of the team is off and on given holidays.

timconsidine

Announcing ...

CCAI-P : Cloudron CustomApp Installer Personal Edition

Recognising that many users are reluctant to enter their cloudron credentials on an open url, I have adapted the current "open" CCAI custom app installer, into a "closed" app using cloudron ProxyAuth for authentication, and a token for installations.

While a one-time install of the Personal CustomApp Installer is needed, manually or using the hosted CCAI, after that, the user is secure with their own app deployment, and credentials do not need to be entered on a 3rd party site.

The Personal Edition has a button to import the master app catalogue when needed.

The Personal Edition feels a lot faster as no login code / 2FA is needed.

My Git Repo : https://git.cloudron.io/timconsidine/cloudron-customapp-installer-personal

Built Docker Image : tcmbp132021/cloudron-customapp-installer-personal:v1.0.0

Available on the open CCAI site https://ccai.appx.uk

timconsidine

Update 20/01/2026 :

I am deprecating installation of the open version of CCAI, as I don't really see that anyone would want to host their own open version.
It's still available, but you will have to hunt for it or ask me.
Basically I've removed it from the catalogue.
I've updated CCAI-P which is the preferred self-host app.
Runs on your own instance, credentials are stored in the app on your server
timeouts removed from CCAI-P : you're logged in or you're not : logout button for security, but you can leave it running if it's only you have access to it
added 3 new descriptors :
- packageAuthor : previously implied, now explicit
- appNote : extended explanation of the catalogue entry
- appHomepage : clickable link to the app's Homepage so you can read about it
it will take a little while for me to populate the new fields for all apps, but will get on with it.

@staff : can I modify the AppWishlist to the effect :

please DO NOT add CCAI to the AppStore
please DO add CCAI-P to the AppStore
or please make your own version (which I am sure will be more lovely)

There are clear pain points in installing custom apps.
This is eminently resolvable.
The problem is without an official way to get CCAI-P, users still have to go through those pain points. Maybe only once, but that's enough to deter them.

The growing catalogue of custom apps (and there are many more that I am not aware of) shows that relying on the App Store only, and relying on approval of items into the App Store, is a clear bottle neck to maximum use and efficiency of a user's Cloudron instance.

EDIT : at the risk of over-selling the point, can Cloudron staff imagine this ? A daily workload where they never ever have to think about adding apps to the Cloudron AppStore, unless they really want to. No more user pressure.

humptydumpty · Update 20/01/2026 :

@timconsidine said in CCAI : Cloudron Custom App Installer:

The problem is without an official way to get CCAI-P, users still have to go through those pain points. Maybe only once, but that's enough to deter them.

Not in a million years would I have been able to install a custom app on my own. CCAI-P makes it stupidly easy. Thank you Tim!

timconsidine

@humptydumpty and I am working on another non-Cloudron way to get over the blockage of getting CCAI-P into the AppStore. One simple download.

But ssssh, don’t tell anyone yet

timconsidine

The Problem :

The Solution :

NEW : CustomAppGateway

no more technical or knowledge blocks
no more excuses
a whole new world of opportunity opened up
available in your preferred approach
- hosted service : zero setup
- self-hosted deployment : private setup
- binary tool : tiny run-once local setup

security : single-use token (optionally also IP address limited to only you )

Release : 21st January 2026

Standby ....

robi

Nothing like a new interposer to solve all your problems.

Long live CAG!

timconsidine

[Announce] CustomAppGateway (CAG) – Solving the "Chicken & Egg" for Custom Apps

Hi everyone,

I'm excited to share a new project that I hope will be a valuable addition to our ecosystem: CustomAppGateway (CAG).

Available now at CAG Website

The "Chicken & Egg" Problem

For a while now, I've been working on CCAI and then CCAI-P (Cloudron Custom App Installer - Personal), a tool designed to be the primary "Install UI" for custom apps. It empowers you to easily install packaged custom apps that aren't yet in the official store.

However, there is a catch-22: How do you install the installer (CCAI-P) without using the CLI ?

Enter CustomAppGateway (CAG)

CustomAppGateway is the solution to that problem. It is a specialized, lightweight run-once tool designed solely to deploy CCAI-P to your Cloudron instance securely and easily.

It provides three simple methods:

CAG Online (Hosted): A web-based installer that runs securely in your browser (using a proxy to handle CORS, with tokens processed in memory only).
CAG Web (self-hosted) : same as above but made easy to deploy to your own server.
CAG App (Downloaded): A standalone terminal executable for Mac, Windows, and Linux for those who prefer a local utility.

AppStore Independence

CAG and CCAI-P are about AppStore Independence. You are not reliant on waiting for an app to be officially adopted or packaged by the Cloudron team to use it, if you need it NOW.

That said, the Cloudron App Store remains vital. It provides the seamless, tested update mechanism we all rely on. While custom apps give us freedom and immediacy, the App Store is still the gold standard for long-term maintenance and stability.

Updates & Housekeeping

CCAI-P is now the primary interface for installing custom apps and will receive further updates and improvements.
The old CCAI open hosted version is effectively deprecated and will be archived/deleted. I encourage everyone to switch to using CCAI-P.

Security

A hot topic which I’ve taken seriously.
CAG leverages the excellent security baked into the Cloudron platform.
We focus on :

using a dedicated one-time token which you create and subsequently delete
restricting the token to use only on your IP address
The footprint for attack is tiny.

A Note to the Cloudron Team

I want to extend a huge and ongoing thank you to the Cloudron team for their continued, tireless efforts. Cloudron remains the #1 self-hosting platform because of your hard work.

We know you face time and effort constraints with a small team. My hope is that CustomAppGateway and CCAI-P can ease your burden a little by empowering the community to self-service their custom app needs, allowing you to focus on the core platform and official apps.

Where to get it

CAG Website

Status

hosted installer : zero setup : tested
web installer : private setup : tested
desktop installer : minimal setup : tested on MacOS
TODO :
- test desktop installer on Windows
- test desktop installer on Linux

Feedback is always welcome!
And in doing so, please cut me some slack - it's a ground-breaking project, and as such may have some gremlins for a short (hopefully) while.

timconsidine

House-keeping :

Cloudron have announced they will introduce support "in-platform" for custom app deployments
consequently CCAI (the open hosted-as-a-service version) can no longer be installed from CCAI. (It can be installed manually if really needed but I don't really see why anyone would want to).
CCAI-P (the personal edition which stores auth creds locally in app) can no longer be installed from CCAI : if you want CCAI-P, use the new https://customappgateway.appx.uk distribution point
CCAI-P has been cleaned of legacy auth timeouts (inherited from original CCAI) so runtime gremlins should not occur. There is still a manual logout and connect option, in case the user wants to do so manually. Otherwise it should remain 'ready to go' without timeouts.

Improvements :

both CCAI and CCAI-P still focus on new installations, and there is no support for updating an existing custom app. I am working on introducing support for updates.

The Future :

with Cloudron's announcement that their v9.1 release will include some support for in-platform deployment of custom apps, "the writing is clearly on the wall" and CCAI / CCAI-P / CustomAppGateway will die and git repos / docker images will be removed at some point.
I doubt anyone is more pleased than me !
however we do not know the timescales for Cloudron 9.1 (other big stuff in it too), so I will continue to make available CCAI / CCAI-P until some point after Cloudron 9.1 is stable.

girish

@timconsidine I left a note at https://forum.cloudron.io/topic/14976/what-s-coming-in-9.1/11 about how we plan to implement this. I don't have a timeline for 9.1 but given the build up all your apps, we are trying to get this out asap!

timconsidine

@girish thank you - very helpful - still digesting it.

Hoping to get my final "end of life" changes done today, which can allow CCAI-P to limp on until Cloudron in-platform functionality is tested, then turn the CCAI and CAG websites into digital tombstones.

No need for any rush - always happy for you to take your time to do a proper job (unlike my hashed together PoC).

Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.

Cloudron Forum