Cloudron Forum

If this post is a bit long, please let us know!

@LoudLemur well done Be aware that windmill push out releases like their pants on fire. Almost daily at times. My windmill community package has fallen behind, and I’m not much motivated to be constantly re-packaging it for Cloudron. I’m likely to do one update then freeze it or hand the baton over. So very pleased to see your package as alternative. It would likely save you some hassle to decide an upgrade policy for Windmill. Once per week or whatever. Otherwise you might be forever publishing.

Update: hardening pass complete, production-proven, and one correction on backups A few days on from the original post, the package has been through a full integration and hardening pass on a live Cloudron box. Most of this is good news. There is also one correction to a claim in the original that is important enough to lead with. ️ Correction: bundled-ClickHouse backup needs care (a fix is in progress) The original post said that /app/data backup "just works, no custom backup hook needed." That holds right up until ClickHouse happens to be running a background merge during the backup snapshot. Here is the race. ClickHouse continuously creates and deletes temporary merge directories under its store (tmp_merge_*, tmp_insert_*, tmp_fetch_*). Cloudron's rsync syncer walks that tree, and if one of those directories disappears between enumeration and read, readTree receives null and crashes on .sort(). The part that matters: that crash aborts the entire server backup run, not only Langfuse. Every app scheduled after it is left on the previous night's snapshot. The failure is timing-dependent, so it appears intermittently with no configuration change on your side. This affects any ClickHouse-backed package (Plausible, PostHog, SigNoz, and others), so we have filed it upstream as a platform robustness issue: https://forum.cloudron.io/topic/15663/backup-task-crashes-when-a-clickhouse-app-deletes-a-temp-merge-dir-mid-snapshot. A single null-guard before the sort would fix it for every affected app. Until that lands, the workaround (full detail in KNOWN-ISSUES.md: Exclude Langfuse from the automatic backup schedule so a racy run cannot abort the others, and back it up out of band. One correction to the obvious workaround: Cloudron will not back up a stopped app, so "stop the app, then back it up" is not a valid path. A quiesced backup has to be a filesystem-level snapshot taken outside the platform, or you simply re-run the schedule, since it is a timing collision and usually clears on the next attempt. The real fix is the next release. Version 0.2.0 moves the ClickHouse store to a persistentDir and backs it up as a consistent logical dump through backupCommand and restoreCommand, which removes the race structurally, because the syncer never walks the live store at all. It is scoped and tracked, and it gets its own backup-and-restore round-trip gate before it ships. What is new since the original A full hardening pass on the live instance, covering the code, configuration and dependency surface, container capabilities, the network surface, the authentication surface, and secrets at rest and in transit. Verdict: pass. The write-up is here: SECURITY.md. In short: the internal services (ClickHouse and the worker) are unreachable from outside; the only surface open without a login is /api/public/*, which is API-key gated by design; secrets are 0600; and the encryption key is byte-identical across both update and restore. Production-proven from the public package: installed from the versions-url exactly as any operator would, OIDC single sign-on confirmed end to end, presigned trace-media working through the proxy, update and backup-restore both preserving the encryption key, and memory measured under sustained ingestion (peak around 2.6 GiB, with the 5 GiB default holding comfortably). Integration note: agentgateway If you are considering wiring agentgateway's own traces into Langfuse, it will not work on agentgateway 1.3.1, and the cause is not on the Langfuse side. Its config.tracing OTLP exporter sends cleartext even when the endpoint is https://, and Cloudron's TLS-terminating proxy rejects that with a 400. Langfuse accepts the identical payload over TLS without complaint. agentgateway simply will not negotiate TLS for trace export, and there is no configuration option to change that. Filed upstream: [agentgateway issue — link]. Open WebUI and the Langfuse SDKs both handle TLS correctly, so the integrations described in the original post work as written. What is next Version 0.2.0 is the ClickHouse backup rework described above. Source, issues and pull requests are here: https://github.com/OrcVole/langfuse-cloudron. Real-world memory-footprint reports and "works on my install" confirmations remain very welcome.

@loudlemur I didn't write the skills . But @james is a good candidate for feedback .

@robi said: @LoudLemur would it be more discoverable if it was published as a blog or docs site and then include llms.txt and llms-full.txt to make parsing easier for the agents? Thanks, @robi You can see the blog here: https://wanderingmonster.dev/blog/cloudron-packaging-assessment-toolkit/

I have a new offline solution with llamafile that runs on n M1 really well. Should see how it runs on CPU only VPSs.

@scooke It is a bit like buying a fancy car. Having the luxury of that car is brilliant when you are actually driving it but when you need to sleep or park, it is a total waste. Generally, the high end video cards with huge amounts of VRAM are a luxury for most people, who instead make do with buying a much more humble piece of kit. However, if instead of buying the hardware outright, they pay for the car only when they need it, they can enjoy a much more luxurious and capable experience. So many new AI applications are being created these days, I think I shall start a discussion thread on it and what Cloudron could do to support it.

@LoudLemur late reply not sure I understand your question so this answer may not be what you want but in picture form ... [image: 1768330247721-mermaid-diagram-2026-01-13-185009-resized.png]

@marcusquinn Thanks for that. Looks like my post is a duplicate of: https://forum.cloudron.io/topic/13141/litellm-openrouter-self-hosted-alternative-proxy-provides-access-to-openai-bedrock-anthropic-gemini-etc?_=1759700788590 (I posted 3 apps, checked the first one, and then forgot to check if the other two had already been requested!) @girish What is the procedure to merge this dupe with @jagan 's earlier request here? https://forum.cloudron.io/topic/13141/litellm-openrouter-self-hosted-alternative-proxy-provides-access-to-openai-bedrock-anthropic-gemini-etc?_=1759700788590 I can see the topic tools, merge option, but it is a bit confusing on how to paste/include jagan's thread.

@LoudLemur thank you !

Not a bad concept. Doesn't need dedicated hardware, might be able to run on the build/demo server or other sponsoring org. Integrate with CCAI upgraded to a distributed DB or some master/share topology to keep a running list of all custom packages successfully installed and make them available to everyone else.

@timconsidine it may be more useful as a separate package connected to a local CPU only LLM to handle the non-linear needs. I have a way to deploy tiny ones as a single file if need be.

@BrutalBirdie Yup. Quite a few examples of Nani un-gagged: https://x.com/search?q=nani__ooo&src=typed_query