What's coming in 9.1

[joseph]

FIDO2 is the broad name of the standard. passkeys is the (marketing) name of the FIDO2 "key" . WebAuthn is the standard for server to browser/client communication and is part of FIDO2. That is my understanding.

[nostrdev]

so long as we can use an external signing device (like Trezor), and not trust some foreign spyware company like Google or Microsoft or Apple, that would be great.

[james]

Hello @nostrdev
We have tested the passkey support with the Bitwarden browser extension, YubiKey 5, Nitrokey and native support from some browsers and operating systems like Windows, Apple and Linux.
Please note, we implemented passkey support and not the full WebAuthn/FIDO2 specification available options.

[nebulon]

To support passkey login via the cloudron cli, we will move to oidc login for the cli in 9.1

Basically the cli will open a browser window to login and obtain an access token. For everyone using the cli in some automated pipeline, one can still use it with a pre-obtained api key from the dashboard.

[girish]

said in What's coming in 9.1:

Improved progress reporting - show percentage complete and elapsed/estimated time for backups and app installations.
Convert backup site creation dialog to a view

Save these two, other features are implemented. Work has started on getting 9.1 release out.

[nostrdev]

@james

Using Bitwarden means keeping your secret on a potentially compromised device. Better to use a hardware key.

The problem with both Yubikey and Nitrokey is that if you lose the device, you lose the key. Big problem.

The fact you cannot recover a passkey, make those devices a pass, from us. Or at least, they must be used in a far more careful and limited fashion - ie, fallback to email recovery - than what would otherwise be the case (sovereign recovery).

With Trezor - and other hardware wallets that use deterministic webAuthN - you can recover from a seed. This means that the loss of a device is not catastrophic.

EDIT: Am reading the Trezor forums and apparently they do support Passkeys, it's just that the Resident Key is encrypted with the seed, and not deterministically generated. So for recovery, you just back up the file using regular cloud storage.

Looking forward to testing it on cloudron, and letting you all know the results.

https://trezor.io/guides/bonus-tools/what-is-fido2

[murgero]

I'm so excited for this build. The ability to install 3rd party apps easily via the admin panel is a game changer for us devs - also passkey support will be amazing for those of us using bitwarden / other passkey apps

[ruihildt]

@girish said in What's coming in 9.1:

Custom app build and deploy - You can git-clone any package repository and run cloudron install directly. This builds the app locally on the Cloudron instance and installs it. This simplifies building and maintaining custom packages. The workflow is primarily CLI-driven and targets developers building custom apps as well as users who want to apply patches on top of existing packages

Is there any improvement for integrating this in a CI/CD pipeline? If I understand correctly it would mean we can do without using a container registry by default?

[james]

Hello @ruihildt

Yes. You will be able to simply run cloudron install --location $LOCATION from a CI/CD and the app will be installed on the target Cloudron.

[necrevistonnezr]

@girish said in What's coming in 9.1:

Community packages - can be installed from a URL via the dashboard. Cloudron will track the upstream URL and automatically check for and apply updates. Will allow people to publish outside Cloudron App store and users can easily install these packages and keep them automatically updated. For discovery, we will maintain a list either on the forum or in the documentation (TBD).

Just my 2 cents: It's great that several people, mostly @timconsidine are packaging so many interesting apps. Bear in mind though, maintaining and supporting such apps after the initial packaging is a whole different ballgame.
The Cloudron team currently provides excellent support for their apps, in fact so good, that you see people looking for support in this forum that don't use Cloudron.
If one or two persons, who don't get paid package apps, you can't expect the same kind of support. And it's already happening: The Funkwhale app doesn't seem to work (see https://forum.cloudron.io/topic/1597/funkwhale-a-modern-convivial-and-free-music-server?page=3) and asking for support did not lead to anything (and I don't expect volunteers to react or even monitor such requests, don't get me wrong).
Just bear in mind, if you need support (e.g. for business critical apps), community packages are not the way to go, I think.

[Gengar]

I can't wait for community packages ! It will be sooo great, like Unraid ! And Unraid is so populair because of community apps.

Thx for the work team !

[girish]

@necrevistonnezr right, we will have to see how well it all works Specifically for Funkwhale, @vladimir.d has the package cleaned up https://git.cloudron.io/packages/funkwhale-app/ . I will try to get it out.

[girish]

9.1 is in unstable now. I have updated the docs around packaging - https://docs.cloudron.io/packaging/ is a good starting point. https://docs.cloudron.io/packaging/publishing is the community packages docs.

We are working on AI skills around packaging, publishing and CI use:

All skills

npx skills add https://git.cloudron.io/docs/skills.git

Individual skills

npx skills add https://git.cloudron.io/docs/skills.git --skill cloudron-app-packaging
npx skills add https://git.cloudron.io/docs/skills.git --skill cloudron-app-publishing
npx skills add https://git.cloudron.io/docs/skills.git --skill cloudron-server-ops

[jdaviescoates]

@girish it sounds like these were built to work with https://cursor.com/ (which is new to me - tbh I've barely explore this space at all), but presumably Claude Code, Replit etc etc would benefit from them too?

[marcusquinn]

@jdaviescoates can recommend opencode.ai, even includes some good free models to get you started.

[msbt]

@girish said:

9.1 is in unstable now

Uhh what? One of my production Cloudrons already got updated automatically 3 days ago?!

[james]

Hello @jdaviescoates

@jdaviescoates said:

but presumably Claude Code, Replit etc etc would benefit from them too?

These AI skills can be used with other AIs as well.
They are not exclusive for Cursor.

[girish]

@msbt said:

Uhh what? One of my production Cloudrons already got updated automatically 3 days ago?!

that seems quite unlikely Can you check who was the initiator of the update in the eventlog? The 'source' field will be 'cron' or some real user .

[msbt]

@girish maybe I'm just the lucky one, that happened before on other machines with other versions:

It's a bit tricky, because that specific Cloudron has a bunch of custom apps which are best stopped before updating/rebooting. I remember a thread about release channels or separate app updates from Cloudron updates, is that somewhere on the roadmap?

Edit: it says "unstable": false in the tasks json

[girish]

App updates are already separate from Cloudron updates. But maybe you mean the separation of the automatic update flag , will get to that in the coming releases .