Excalidraw - Virtual whiteboard for sketching hand-drawn like diagrams

[samuk]

I'd use this

[josephcosta]

The library is also usable in nextcloud:
https://github.com/nextcloud/whiteboard/blob/main/README.md

I use it (not in cloudron) with a simple docker-compose:

services:
  whiteboard:
    image: ghcr.io/nextcloud-releases/whiteboard
    restart: always
#    ports:
#      - 3002:3002
    environment:
      - NEXTCLOUD_URL=https://your.nextcloud.url
      - JWT_SECRET_KEY=KEYsome-strong-one

[Grienauer]

I used the SAAS Version. And it is quite good and a nice tool!
lg Nico

[timconsidine]

I have packaged Excalidraw for Cloudron as a custom app.

My git : https://git.cloudron.io/timconsidine/cloudron-excalidraw
Built cloudron docker image : tcmbp132021/cloudron-excalidraw:v2

Available for convenience on CCAI (custom app installer) https://ccai.appx.uk

The GitHub release is v0.18.0 (2025-03-11) but this version number does not reflect the wide and stable deployment of Excalidraw, so I feel it can be considered for official adoption, even though it has not reached the normal criterion of a v1.0 release.

I have been running Excalidraw on a plain VPS via docker-compose.yml, but can now remove it from there and deploy on my primary preferred production server (Cloudron).

[robi]

Nice Christmas present

Thank you

[girish]

@timconsidine We were just looking into this and your package works out of the box, good stuff! To say upfront, none of this is your or the package's fault. The app is closely tied to the SaaS/cloud service and as such has some dangerous "pitfalls" . Like Sign up goes to the SaaS service. Sharing won't work because it also requires the SaaS . Apart from this, there is also calling to DO CDN, firestone google APIs, some analytics service. Is my understanding correct?

IMO, one can just bookmark https://excalidraw.com/ and use it (saves your cloudron CPU some cycles )? But I don't want to make a decision by myself about this, privacy is a very big area and different people have different tolerance - Are people OK with above? Just a general question for everyone.

[timconsidine]

@girish that's good analysis.
That's good example of why we need review before adopting it into AppStore.

Honestly ... I didn't encounter the issues you raised, simply because I never work in the way that I sign up to the SaaS aspect. I just use the UI, save a PNG or screenshot and throw away the design. Only use it for quick sketches and explainer diagrams.

My package was purely to get it off my Traefik/docker-compose VPS onto Cloudron, because might shut down the Traefik VPS.

Yes, entirely viable to just use the main website and did that for a while.

Should it go in the AppStore ?
I don't have a strong view.
Others might, because, as you say, privacy issues.
But they don't crop up for me in this app.

[chmod777]

is there maybe a way to block a cloudron app from accessing the internet/making calls to external servers? this way it would block any saas connection to google or similar?

I would very much prefer an installation of excalidraw without any third party connections.

[james]

Hello @chmod777
This is something you have to raise upstream since this is a software development decision that can not be done by us.

[timconsidine]

In https://forum.cloudron.io/post/118908 @girish rightly questioned how private bundling stock Excalidraw is, and as a result whether it is not just easier to use the hosted version.

But I like Excalidraw ! And I want it on my Cloudron ! And I want it to be as private as possible (completely private maybe not possible).

And I liked @chmod777 suggestion in https://forum.cloudron.io/post/120436.

So I have made package changes and pushed 1.1.2.
There is now a file /app/data/user/json where you can set 2 options.
{"privacyBundle":true,"useCSP":true}

• the first removes some stuff from the image (actually technically, builds a stock repo bundle, and a bundle with stuff removed)
• the second injects headers in your browser to stop the browser calling certain remote sites.

Restart container after editing, of course.

There is then also a new script in container /app/code/verify-runtime.sh which outputs diagnosis, with a summary at the end :

== summary ==
settings: privacyBundle=true, useCSP=true
servedIndex: /app/data/www/index.html
bundleMatch: privacy
cspMeta: YES
cspConnectSrc: 'self' blob:
privacyEndpoints: YES
externalStringsInBundle: firebasestorage.googleapis.com, libraries.excalidraw.com, scripts.simpleanalyticscdn.com, excalidraw.nyc3.cdn.digitaloceanspaces.com
externalStringsMeaning: present in static files, not proof of requests

Is it private? I think so, as much as it can be. The glaring violations have been dealt with. If you're in paranoia mode, use browser Dev Tools to check network activity.

So, now, it's def worth having this modified Excalidraw on Cloudron

---

EDIT : surprisingly having 2 app versions in the same app does not increase dockermimage size much. I guess because of sharing of layers. But nonetheless