What's coming in Cloudron 10

[jdaviescoates]

@girish said:

Policy change: self updating ubuntu packages will be permitted i.e apt update and apt upgrade is allowed.

I'm intrigued as to

1. why the change, and
2. how this is being handled.

There was obviously a good reason to not do this in the past, i.e. it might break things.

But presumably you've made changes so that it now can't break things? What have you done?

[necrevistonnezr]

@girish said:

Of course, this feature is mostly useful for internal apps. For public facing apps (like ghost, gitlab, nodebb), we are working on a different solution.

I love everything about this

[girish]

@jdaviescoates said:

I'm intrigued as to

why the change, and
how this is being handled.

What has changed is a mix of many things. Some VPS providers have automated calling apt update/upgrade on server start up. They have also started flagging outdated packages as security warnings, and it shows up in the VPS dashboard or MOTD with some fearmongering message. Server admins are also running updates randomly despite what we say anyway. I think a big increase here is because of suggestions by LLMs. People are running some automated AI security checks on the server and without fail it spots "20 packages to be updated" and flags it as if it is the end of the world

I think we are just accepting that we cannot fight this, just have to live with all this. One good thing is over the years Cloudron depends very little on system ubuntu packages. So, there is not much harm in running apt update anymore.

[subven]

While I appreciate the upcoming mail related features and fixes, there is still one crucial feature left out that was talked about for years: Auto/Custom BCC for incoming/outgoing mail

We need to make them archivable to comply with german GoBD law. Setting this at client level would not pass as the law requires seamless documentation without user influence. This is not limited to german law but is generally useful for any company that needs to document business processes comprehensively. I know a lot of companys and freelancers lacking DMS systems, mostly because its complicated and can be very expensive.

Best case would be the ability to set global BCC per mailbox within Cloudron.

[robi]

@girish does this help with the suite of VPN tools?

https://github.com/jedisct1/dsvpn

[d19dotca]

I love the idea of handling bots. Currently I use a script from some sites but it’s more spam-based and unfortunately the API in Cloudron will only handle so many network addresses (or specifically a max size of PUT I believe) so I can’t keep expanding the list of IP firewall lists I want to use for blocking traffic.

Lately this has become an issue for me for a few reasons but notably I’m finding too much bot traffic showing up in website analytics when using Matomo or Umami, and even third-party app Rybbit, and I have been trying to find a way to fight this so that the analytics is more accurate. If there’s a way to better fight this at the network layer in Cloudron I think that would be fantastic. At the very least though I think increasing the size allowed for network lists would be very helpful so that we can include more IP addresses.

Also, I love that mail is finally getting the attention it much deserves. Looking forward to that.

I think apart from what one person mentioned which is domain-based SpamAssassin rules or changing scores for example depending on the type of spam they receive, it’d be really nice if we could easily configure SpamAssaasin in the UI for resetting training data and forcing a rescan of spam and ham folders, as well as the ability to note which folders should or should not be treated as ham or spam so that we can add in our own for example.

Just something else to consider.

Thank you for all the hard work! Looking forward to v10.

[IniBudi]

@girish I'd like to ask regarding this feature.

• Could we enable the VPN to protect my.cloudron.app?
• Is it possible to make custom rules? I mean if I want to protect WP-login.php and WP-admin, but I need to exclude this file /wp-admin/admin-ajax.php.

Thank you for making awesome feature!

[girish]

@IniBudi I think we will have to implement that in a future release. It's quite a bit more complex to protect specific paths. We have to build some sort of WAF for that. The VPN protection works more at a network level and not much in the http level.

[hcj-online]

@girish said:

I don't know the ETA for Cloudron 10 yet, I think we will need 2-3 weeks more at least.

Is there an updated ETA?
I want to set up a new Cloudron instance and take advantage of the Ubuntu 26.04 support.

[umnz]

Since networking/vpn/security is currently being worked on is there any opportunity here to provide native Tailscale support as an option? Specifically we offload heavy compute to external boxes (think AI compute hosted elsewhere) and I'd like to add Cloudron to my Tailnet so that Open WebUI running on Cloudron for example, can have access to some private compute and resources without having to worry about persisting through updates/backups/breaking Cloudron DNS etc.

[girish]

@umnz it's in the roadmap to be able to join a network i.e where the server becomes a client/node - openvpn/wireguard/tailscale. Right now, it's mostly a "server". In the interest of getting Cloudron 10 out, it won't be in this release atleast.

[dsp76]

@girish you selected mautic for this example in the screenshot. Is it possible to differentiate already between different paths? As link redirects, assets etc. would still need to be served publicly - but the admin interface not.

Thanks for clarification!

[girish]

@dsp76 Good point about the matuc example. But I think URL based protection is more complicated because we will need help from the apps. For example, it will require all of mautic admin and it's assets to be designed to be served from under a specific subpath. I haven't really investigated how friendly apps are in this regard but most likely we will have to handle this package by package (in a future release).