Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content
  • DocuSeal - Package Updates

    Pinned Locked DocuSeal
    141
    4 Votes
    141 Posts
    70k Views
    Package UpdatesP
    [1.16.2] Update docuseal to 3.0.2 Full Changelog Bug fixes, performance improvements and security hardening
  • 1 Votes
    2 Posts
    38 Views
    jamesJ
    Hello @crush33 @Crush33 said: but the folder generated are root-owned What folder exactly? Can you give more details so we can reproduce this faster?
  • Ctfreak - Package Updates

    Pinned Locked Ctfreak
    53
    0 Votes
    53 Posts
    16k Views
    Package UpdatesP
    [1.29.0] Update ctfreak to 1.39.0 Full Changelog
  • Chatwoot - Package Updates

    Pinned Locked Chatwoot
    99
    2 Votes
    99 Posts
    56k Views
    Package UpdatesP
    [1.52.1] Update chatwoot to 4.14.1 Full Changelog New documentation-style Help Center layout and layout switcher. Conversation unread counts, sidebar ordering, and badge updates. WhatsApp/Twilio Cloud Calling and voice-call UX fixes. Introduced support for BSUID in Whatsapp message payloads. Onboarding improvements for Help Center generation and email detection. Bulk label removal and bulk article category changes. XML/PFX attachment support, TikTok plan enablement, and new inbox webhook events. Reliability fixes for IMAP, auto-assignment, WhatsApp, CSAT, editor shortcuts, meta-polling and widgets. Security/API polish for SafeFetch, dependencies, OpenAPI docs and allowlist for private inbox webhooks.
  • Mealie - Package Updates

    Pinned Locked Mealie
    75
    0 Votes
    75 Posts
    26k Views
    Package UpdatesP
    [1.42.2] Update mealie to 3.19.2 Full Changelog fix: Ensure secret key is not empty @michael-genson (#7701) fix(deps): update dependency fastapi to v0.136.3 @renovate[bot] (#7692) fix(deps): update dependency uvicorn to v0.48.0 @renovate[bot] (#7696) fix(deps): update dependency sqlalchemy to v2.0.50 @renovate[bot] (#7693) fix(deps): update dependency ingredient-parser-nlp to v2.7.0 @renovate[bot] (#7695)
  • VPN - Package Updates

    Pinned Locked VPN
    44
    0 Votes
    44 Posts
    18k Views
    Package UpdatesP
    [2.15.0] Update vpn to 2.15.0 Add last device connect and disconnect information
  • 1 Votes
    2 Posts
    28 Views
    jamesJ
    Hello @archos The key web_videos exists in multiple places in the production.yaml. In the Cloudron app the start.sh sets this at two places at every start: yq eval ".storage.web_videos = \"/app/data/storage/web-videos/\"" -i /app/data/production.yaml ... yq eval ".transcoding.web_videos.enabled = true" -i /app/data/production.yaml So I would assume that you are writing about the .transcoding.web_videos.enabled key which is getting enabled by default on every app restart.
  • 1 Votes
    2 Posts
    17 Views
    jamesJ
    Hello @ext-owl Since you have deleted your post content, I am marking this topic as solved. I can also delete this topic completely if you intended to do that anyway.
  • iOS playback misbehaving - Timeout increase possible?

    Koel
    5
    1 Votes
    5 Posts
    106 Views
    jamesJ
    Hello @teiluj Since you are using the Koel iOS app, can you maybe check if the issue is the same when using Keol from e.g.: a Chrome or Firefox browser on your iOS device? This could narrow it down to a general iOS or iOS app issue.
  • mysql -> "too many connections"

    Unsolved Support mysql
    7
    1 Votes
    7 Posts
    113 Views
    jamesJ
    Hello @philkunz I can't tell what is accessing your MySQL Service, but if you use Cloudron in the default and not something out of the ordinary, it should be some app. To get details about the hosts and connection errors, ssh into your Cloudron server, then run: docker exec -it mysql bash -c 'mysql --user=root --password=$CLOUDRON_MYSQL_ROOT_PASSWORD --execute="SELECT * FROM performance_schema.host_cache"' This will show all. If you want to filter for the connection error specifically, run: docker exec -it mysql bash -c 'mysql --user=root --password=$CLOUDRON_MYSQL_ROOT_PASSWORD --execute="SELECT HOST, SUM_CONNECT_ERRORS FROM performance_schema.host_cache WHERE SUM_CONNECT_ERRORS > 0;"' it will create an output like: mysql: [Warning] Using a password on the command line interface can be insecure. +-----------------+--------------------+ | HOST | SUM_CONNECT_ERRORS | +-----------------+--------------------+ | my-cloudron-dev | 1 | +-----------------+--------------------+ You can also filter for the amount of auth errors with something like this: docker exec mysql bash -c 'mysql --user=root --password=$CLOUDRON_MYSQL_ROOT_PASSWORD --execute="SELECT HOST, IP, SUM_CONNECT_ERRORS, COUNT_AUTHENTICATION_ERRORS FROM performance_schema.host_cache \G;"' Which will return something like this: *************************** 1. row *************************** HOST: my-cloudron-dev IP: fd00:c107:d509::1 SUM_CONNECT_ERRORS: 0 COUNT_AUTHENTICATION_ERRORS: 40 *************************** 2. row *************************** HOST: mysql IP: fd00:c107:d509::5 SUM_CONNECT_ERRORS: 0 COUNT_AUTHENTICATION_ERRORS: 17 *************************** 3. row *************************** HOST: mysql IP: 172.18.30.1 SUM_CONNECT_ERRORS: 0 COUNT_AUTHENTICATION_ERRORS: 1 *************************** 4. row *************************** HOST: my-cloudron-dev IP: 172.18.0.1 SUM_CONNECT_ERRORS: 1 COUNT_AUTHENTICATION_ERRORS: 2 There you can see I intentionally failed to connect many times from inside a Cloudron app by running: for i in {1..20}; do mysql --user=${CLOUDRON_MYSQL_USERNAME} --password=WRONGPASSWORD --host=${CLOUDRON_MYSQL_HOST} ${CLOUDRON_MYSQL_DATABASE}; done When running this again from inside a Cloudron app, I can run the above MySQL query again and can see: *************************** 1. row *************************** HOST: my-cloudron-dev IP: fd00:c107:d509::1 SUM_CONNECT_ERRORS: 0 COUNT_AUTHENTICATION_ERRORS: 60 Is now 60 and was before 40. If this value keeps rising, without you doing anything manually. There is some app that is failing to connect to the MySQL service for some reason. My first suspect would be some WordPress developer app or a restored app that has old credentials from before the restore.
  • Koel - Package Updates

    Pinned Locked Koel
    117
    0 Votes
    117 Posts
    57k Views
    Package UpdatesP
    [1.41.0] Update koel to 9.6.0 Full Changelog feat: add Subsonic podcast endpoints by @phanan in #2533 feat: encrypt Subsonic API keys at rest by @phanan in #2534 feat: add Subsonic play-queue endpoints by @phanan in #2535
  • LanguageTool - Package Updates

    Pinned Locked LanguageTool
    52
    1 Votes
    52 Posts
    9k Views
    Package UpdatesP
    [1.47.0] Update languagetool to 887aa30
  • Searx - Package Updates

    Pinned Locked SearXNG
    115
    0 Votes
    115 Posts
    45k Views
    Package UpdatesP
    [2.96.0] Update searxng to 7159b8a
  • Dawarich - Package Updates

    Pinned Locked Dawarich
    38
    0 Votes
    38 Posts
    4k Views
    Package UpdatesP
    [1.12.9] Update dawarich to 1.7.11 Full Changelog Onboarding "Load demo data" now seeds a fully populated /map/v2 instantly: 30 days of Berlin + a Prague-weekend trip, ~80 visits with tags and places, and stats anchored to the current calendar month. "Remove demo data" wipes everything in one click while preserving anything you've confirmed, edited, or built on top of (visits, trips, places, tags adopted by user action stay). Visits can now be manually assigned to one of your saved areas. When you do, the visit takes the area's name automatically unless you've already given it a custom name, or you've also picked a place (a place name wins over an area name). Available via API now; UI to follow. #2577 Two unused indexes on the points table are dropped on upgrade; on large self-hosted instances this frees several GB of disk. Areas now validate their geometry: radius must be greater than 0, latitude must be within -9090, and longitude within -180180. Invalid values are rejected instead of silently saved. Bumped bundled gems (aws-sdk, devise, jwt, httparty, and others) to close 9 known CVEs. Self-hosters get the security fixes by upgrading. Map v2 Timeline calendar now lights up days that have raw points even before Track or Visit generation has caught up, matching the Insights Activity Overview calendar. #2579 Reverse-geocoding flood: duplicate per-point enqueues are now coalesced for 24 h via a Redis dedup key, retries are capped at 3, and the nightly sweep bypasses (and clears) the dedup so points whose retries were exhausted or whose key still lingers are picked up on the next run. Map v2 visits layer now honours the selected date range. Since 1.7.10 the viewport-bounded visits fetch silently dropped the start_at/end_at filter on the backend, so all visits inside the viewport were rendered regardless of the date filter. #2817 POST /api/v1/visits no longer links a new visit to a place owned by another user. Passing a foreign place_id is ignored the visit gets a place owned by the requester at the requested coordinates, and the response no longer echoes the other user's place id or coordinates. Map v2 settings panel: "Apply Settings" now actually saves your changes. Points rendering mode, speed-colored routes, live mode, and fog-of-war toggles all persist on click and reload. Apply/Reset buttons moved above the Transportation Mode section so they sit inside the outer form. #2680
  • Uptime Kuma - Package Updates

    Pinned Locked Uptime Kuma
    123
    0 Votes
    123 Posts
    93k Views
    Package UpdatesP
    [2.6.0] Update uptime-kuma to 2.4.0 Full Changelog #7434 feat(notification): add EgoSMS SMS provider for Uganda (Thanks @kristianinc @cursoragent) #7420 feat: Add incidents to RSS (Thanks @dj-tuxis) #7365 feat: Add VKTeams bot notification provider (Thanks @aleshasam) #7433 feat: add optional token field for gamedig monitors (Thanks @aminoacidity) #7415 feat: Adding bearer token (Thanks @aminoacidity @nyeswant) #7431 fix: Add bearer token support to WebSocket upgrade monitor (Thanks @aminoacidity @nyeswant) #7373 fix: update link to documentation about API keys (Thanks @eleanordoesntcode) #7451 fix: handling npm 11.16.0 #7351 fix: NTLM monitor over plain HTTP fails with 400 Bad Request (Thanks @karzac) (Admin only/Authenticated only) Remote Code Execution, a vulnerability from an upstream dependency (Reveal later, ping me if I forgot to reveal)
  • Tiny Tiny RSS - Package Updates

    Pinned Locked Tiny Tiny RSS
    107
    0 Votes
    107 Posts
    44k Views
    Package UpdatesP
    [2.89.0] Update tt-rss to d253047
  • OAuth2/OIDC + MFA support for Cloudron Mail clients

    Feature Requests
    3
    5 Votes
    3 Posts
    165 Views
    F
    Hello @james, this is great to hear! If it turns out that this cannot be added in time for the Cloudron 10 release, it would already be very helpful to at least have an option to disable the platform password for mail login, so users are required to use app passwords instead.
  • 8 Votes
    5 Posts
    248 Views
    TheMeerkatT
    @andreasdueren Three reasons I chose nginx: nginx is already in the base image and central to the Cloudron model. nginx is incredibly light. Caddy’s biggest selling point (auto-HTTPS) is completely irrelevant to Cloudron apps, which are behind a reverse proxy anyway.
  • 0 Votes
    10 Posts
    129 Views
    necrevistonnezrN
    https://forum.cloudron.io/post/74532 and https://forum.cloudron.io/post/74973 Too many times it‘s just this browser…
  • SFTPGo - Package Updates

    Pinned Locked SFTPGo
    16
    0 Votes
    16 Posts
    4k Views
    Package UpdatesP
    [1.4.2] Update sftpgo to 2.7.3 Full Changelog Added a configurable minimum-entropy check (common.secret_min_entropy, default 80) for data-at-rest encryption secrets (CryptFs passphrase, S3 SSE-C key), to reject trivially weak key material at submission time. Logs: added the virtual path to transfer/command logs and to event-log CSV exports. WebClient: replaced glightbox with a custom lightbox implementation for better CSP compatibility. IP list: fixed matching when an IP is covered by multiple conflicting entries. Fixed comparison of unordered slices. Shares: enforce max_tokens atomically via a guarded conditional update, closing a check-then-write race that could let a usage-capped share be used more times than allowed under concurrent access. In-memory reset-code manager: check code expiry at retrieval time instead of relying only on the background cleanup. Fixed a path-confinement bypass in the public browsable-share partial ZIP download. CVE-2026-49244. Fixed a stored XSS where the inline parameter on browsable-share and authenticated user file downloads suppressed Content-Disposition: attachment, allowing an attacker-supplied HTML file to execute in SFTPGo's web origin. These endpoints now always respond with Content-Disposition: attachment and the inline parameter has been removed. CVE-2026-49245. Neutralized CSV formula injection in the Event Manager and event-log CSV exports: cells starting with =, +, -, @, tab or CR are now prefixed with a single quote.