What's coming in Cloudron 10

[crazybrad]

@girish Since V10 is focused on email, wondering if this feature would be possible: Spam Assassin rules by domain.

Due to AI-driven email spam, I need to manually add about 10 domains to the global block list almost on a daily basis . It's a battle I can't win and huge waste of time.

I'd like to change Spam Assassin rules to deposit all email in the spam folder, except for known contacts and vendors I allow through. But this needs to be on a per domain basis
as every domain would have a different "allow list". It is also possible that some domains would not want this "spam as default" behavior.

Does Cloudron support something like this already, or could this capability be added to the V10 email upgrade the team is working on?

[girish]

girish said:

mail: allow cloudron email to be used as a mail relay. this will allow one cloudron to relay emails via another cloudron without having to disable mail from validation.

I have made two big changes here. The domain level flag to disable mail from validation is now gone. It is now instead per mailbox. The migration logic will migrate the domain level settings into mailbox level setting.

In general, you should never need the above flag and it's only there because we had the global flag. There is a now a new feature called SMTP relay. You can create tokens which you put in external apps/services to send mail via your server.

[necrevistonnezr]

Can I / we sneak this request into Cloudron 10? https://forum.cloudron.io/topic/15546/persistent-sorting-of-apps-by-running-stopped

[girish]

Personal access tokens will be renamed to API tokens.

Currently, the tokens are per user and created in the user's profile page and is hidden from the purview of admins. On Cloudron, most (practically all) of the APIs are server level operations. There is nothing a user can do which is really just for themselves. The common situation is to create tokens for CI/CD. With this in mind, the tokens are now global in System -> Settings and all admins can see created tokens, created by whom, last accessed etc.

[imc67]

This post is deleted!

[girish]

Login sessions is now much better. It individually lists the sessions and you can also log out from those specifically (or all of them).

I think there was always some confusion about "app" oidc sessions and I looked into this. In theory, we can list the app sessions in the UI below as well. But clearing a app oidc session, will only clear the session from the Cloudron side. Practically speaking, all apps maintain their own session and this means the app will still remain logged in. So, we have decided to not list them here to avoid any confusion.

If you want to truly log out (from say some kiosk):

• Click "log out from all" in cloudron dashboard. At this point, Cloudron will ask apps which want to authenticate afresh to re-login.
• Log out from apps that were already logged in previously one by one.

[girish]

girish said:

Ubuntu 26.04 support

We will have Ubuntu 26.04 LTS Resolute Raccoon support next release. I have managed to test this across most of the providers we support. We will have a guide during release time to upgrade manually from Ubuntu 24.04.

Before someone asks, I don't know the ETA for Cloudron 10 yet, I think we will need 2-3 weeks more at least.

[humpty]

Most of my work related software upgrades take YEARS to release with hotfixes taking months after constant community reporting and uproar. Meanwhile, Cloudron staff push major updates in WEEKS and hotfixes in hours. You're spoiling us, guys. Keep up the amazing work!

[timconsidine]

@girish said:

Before someone asks ....

Well pre-empted !
You know the client base well !

[necrevistonnezr]

Just to make sure, someone will still ask at least bidaily…:

[girish]

Since we are getting swarmed by bots and crawlers (including our gitlab/forum/crm), we decided to include some features that will help in protecting apps. The first one is VPN protection. With this feature, people can access apps only via the VPN.

In the network UI, there is a setting called "VPN protection". First enable the feature and select how to route the client traffic.

There is a per-app checkbox to VPN protect the app:

If you try to access mautic now without a VPN connection, you will see (placeholder):

With OpenVPN/Wireguard connection, you will see mautic .

Of course, this feature is mostly useful for internal apps. For public facing apps (like ghost, gitlab, nodebb), we are working on a different solution.

[jdaviescoates]

@girish said:

Policy change: self updating ubuntu packages will be permitted i.e apt update and apt upgrade is allowed.

I'm intrigued as to

1. why the change, and
2. how this is being handled.

There was obviously a good reason to not do this in the past, i.e. it might break things.

But presumably you've made changes so that it now can't break things? What have you done?

[necrevistonnezr]

@girish said:

Of course, this feature is mostly useful for internal apps. For public facing apps (like ghost, gitlab, nodebb), we are working on a different solution.

I love everything about this

[girish]

@jdaviescoates said:

I'm intrigued as to

why the change, and
how this is being handled.

What has changed is a mix of many things. Some VPS providers have automated calling apt update/upgrade on server start up. They have also started flagging outdated packages as security warnings, and it shows up in the VPS dashboard or MOTD with some fearmongering message. Server admins are also running updates randomly despite what we say anyway. I think a big increase here is because of suggestions by LLMs. People are running some automated AI security checks on the server and without fail it spots "20 packages to be updated" and flags it as if it is the end of the world

I think we are just accepting that we cannot fight this, just have to live with all this. One good thing is over the years Cloudron depends very little on system ubuntu packages. So, there is not much harm in running apt update anymore.

[subven]

While I appreciate the upcoming mail related features and fixes, there is still one crucial feature left out that was talked about for years: Auto/Custom BCC for incoming/outgoing mail

We need to make them archivable to comply with german GoBD law. Setting this at client level would not pass as the law requires seamless documentation without user influence. This is not limited to german law but is generally useful for any company that needs to document business processes comprehensively. I know a lot of companys and freelancers lacking DMS systems, mostly because its complicated and can be very expensive.

Best case would be the ability to set global BCC per mailbox within Cloudron.

[robi]

@girish does this help with the suite of VPN tools?

https://github.com/jedisct1/dsvpn

[d19dotca]

I love the idea of handling bots. Currently I use a script from some sites but it’s more spam-based and unfortunately the API in Cloudron will only handle so many network addresses (or specifically a max size of PUT I believe) so I can’t keep expanding the list of IP firewall lists I want to use for blocking traffic.

Lately this has become an issue for me for a few reasons but notably I’m finding too much bot traffic showing up in website analytics when using Matomo or Umami, and even third-party app Rybbit, and I have been trying to find a way to fight this so that the analytics is more accurate. If there’s a way to better fight this at the network layer in Cloudron I think that would be fantastic. At the very least though I think increasing the size allowed for network lists would be very helpful so that we can include more IP addresses.

Also, I love that mail is finally getting the attention it much deserves. Looking forward to that.

I think apart from what one person mentioned which is domain-based SpamAssassin rules or changing scores for example depending on the type of spam they receive, it’d be really nice if we could easily configure SpamAssaasin in the UI for resetting training data and forcing a rescan of spam and ham folders, as well as the ability to note which folders should or should not be treated as ham or spam so that we can add in our own for example.

Just something else to consider.

Thank you for all the hard work! Looking forward to v10.

[IniBudi]

@girish I'd like to ask regarding this feature.

• Could we enable the VPN to protect my.cloudron.app?
• Is it possible to make custom rules? I mean if I want to protect WP-login.php and WP-admin, but I need to exclude this file /wp-admin/admin-ajax.php.

Thank you for making awesome feature!

[girish]

@IniBudi I think we will have to implement that in a future release. It's quite a bit more complex to protect specific paths. We have to build some sort of WAF for that. The VPN protection works more at a network level and not much in the http level.

[hcj-online]

@girish said:

I don't know the ETA for Cloudron 10 yet, I think we will need 2-3 weeks more at least.

Is there an updated ETA?
I want to set up a new Cloudron instance and take advantage of the Ubuntu 26.04 support.