What's coming in Cloudron 10

[adhodgson]

The ability to delegate a subdomain out to an SMTP server hosted by an app has been discussed several times before. I'd quite like to package Mailman for Cloudron, but need a way of getting mail into Mailman itself. Mailman processes incoming mail via LMTP, but we could run an MTA on the app container if the app didn't support native SMTP. If we went that route I think it would be essential for Haraka to call forward to the SMTP server running in the container to avoid backscatter. I do run Mailman on my Cloudron instance for now in a completely unsupported manor and allow incoming SMTP via the Cloudron firewall as a custom port. This is working fine with Exim installed natively on the host, and I have a script to ensure the Nginx config for Mailman is in place. I really wouldn't recommend doing this yourself though and I'm also thinking of offloading the mailing lists to a third party provider at this point for various reasons.

[girish]

girish said:

Ubuntu 26.04 support

This is now implemented in master. Required very minimal changes, mostly to the installation script and also fixing up the docker version.

Ubuntu 26.04 is slowly appearing in many VPS providers (linode, vultr, upcloud) but not in DigitalOcean yet. So, haven't tested it extensively.

[sponch]

So new mail features are coming in 10 or 9.2 - I'm a bit confused

[nebulon]

Initially we thought of 9.2 having those but since we wanted to release some things earlier, 9.2 was released with different features, so this thread shifted essentially to v10 now

[girish]

girish said:

mail: admin notes field for mailboxes and lists

This is implemented. There is a notes field for each mailbox and list.

[girish]

girish said:

mail: housekeeping task. we want to move away from usage of ldap for auth entirely. many of the node ldap modules have become unmaintained
mail: housekeeping task. the mail database is partly in box code and partly in mail server. have to move everything into mail server. this will help us implement backup/restore of mail nicely as well.

Both done now Got rid of LDAP entirely from the mail server.

[sponch]

any ETA?

[girish]

@sponch still a long way out since we are just implementing the features. I can provide a date, when we are at least done implementing them But we are moving very quickly

[crazybrad]

@girish Since V10 is focused on email, wondering if this feature would be possible: Spam Assassin rules by domain.

Due to AI-driven email spam, I need to manually add about 10 domains to the global block list almost on a daily basis . It's a battle I can't win and huge waste of time.

I'd like to change Spam Assassin rules to deposit all email in the spam folder, except for known contacts and vendors I allow through. But this needs to be on a per domain basis
as every domain would have a different "allow list". It is also possible that some domains would not want this "spam as default" behavior.

Does Cloudron support something like this already, or could this capability be added to the V10 email upgrade the team is working on?

[girish]

girish said:

mail: allow cloudron email to be used as a mail relay. this will allow one cloudron to relay emails via another cloudron without having to disable mail from validation.

I have made two big changes here. The domain level flag to disable mail from validation is now gone. It is now instead per mailbox. The migration logic will migrate the domain level settings into mailbox level setting.

In general, you should never need the above flag and it's only there because we had the global flag. There is a now a new feature called SMTP relay. You can create tokens which you put in external apps/services to send mail via your server.

[necrevistonnezr]

Can I / we sneak this request into Cloudron 10? https://forum.cloudron.io/topic/15546/persistent-sorting-of-apps-by-running-stopped

[girish]

Personal access tokens will be renamed to API tokens.

Currently, the tokens are per user and created in the user's profile page and is hidden from the purview of admins. On Cloudron, most (practically all) of the APIs are server level operations. There is nothing a user can do which is really just for themselves. The common situation is to create tokens for CI/CD. With this in mind, the tokens are now global in System -> Settings and all admins can see created tokens, created by whom, last accessed etc.

[imc67]

This post is deleted!

[girish]

Login sessions is now much better. It individually lists the sessions and you can also log out from those specifically (or all of them).

I think there was always some confusion about "app" oidc sessions and I looked into this. In theory, we can list the app sessions in the UI below as well. But clearing a app oidc session, will only clear the session from the Cloudron side. Practically speaking, all apps maintain their own session and this means the app will still remain logged in. So, we have decided to not list them here to avoid any confusion.

If you want to truly log out (from say some kiosk):

• Click "log out from all" in cloudron dashboard. At this point, Cloudron will ask apps which want to authenticate afresh to re-login.
• Log out from apps that were already logged in previously one by one.

[girish]

girish said:

Ubuntu 26.04 support

We will have Ubuntu 26.04 LTS Resolute Raccoon support next release. I have managed to test this across most of the providers we support. We will have a guide during release time to upgrade manually from Ubuntu 24.04.

Before someone asks, I don't know the ETA for Cloudron 10 yet, I think we will need 2-3 weeks more at least.

[humpty]

Most of my work related software upgrades take YEARS to release with hotfixes taking months after constant community reporting and uproar. Meanwhile, Cloudron staff push major updates in WEEKS and hotfixes in hours. You're spoiling us, guys. Keep up the amazing work!

[timconsidine]

@girish said:

Before someone asks ....

Well pre-empted !
You know the client base well !

[necrevistonnezr]

Just to make sure, someone will still ask at least bidaily…:

[girish]

Since we are getting swarmed by bots and crawlers (including our gitlab/forum/crm), we decided to include some features that will help in protecting apps. The first one is VPN protection. With this feature, people can access apps only via the VPN.

In the network UI, there is a setting called "VPN protection". First enable the feature and select how to route the client traffic.

There is a per-app checkbox to VPN protect the app:

If you try to access mautic now without a VPN connection, you will see (placeholder):

With OpenVPN/Wireguard connection, you will see mautic .

Of course, this feature is mostly useful for internal apps. For public facing apps (like ghost, gitlab, nodebb), we are working on a different solution.

[jdaviescoates]

@girish said:

Policy change: self updating ubuntu packages will be permitted i.e apt update and apt upgrade is allowed.

I'm intrigued as to

1. why the change, and
2. how this is being handled.

There was obviously a good reason to not do this in the past, i.e. it might break things.

But presumably you've made changes so that it now can't break things? What have you done?