CCAI : Cloudron Custom App Installer

[timconsidine]

I’m not a fan of Cloudflare - just put it in as fastest way to address a possible vulnerability.
But proof of work is often a pain for users.
I feel there are only 2 good solutions :
Cloudron re-write as an official utility (resolves authentication much more neatly)
CCAI adds user registration
I’m thinking what direction to take it in if not adopted/rewritten

[robi]

Found 2 bugs with latest CCAI

1. After install of one app, still being logged in, it's impossible to click on another app to proceed with installation. Starting over of course requires re-logging in.

2. I was upgrading to 9.0.12 while attempting this so got this:
   [9:05:52 PM] [2025-11-26 03:05:51] Failed to install app: 400 message: Box version exceeds Apps maxBoxVersion

[timconsidine]

@robi thank you for the report.
I will investigate.
I'm hoping that Cloudron will bring out their own version of this - the app would be so much easier for everyone if logging in was not needed (it was in the dashboard somewhere)

I've not updated to 9.0.x yet - waiting for a later release

[robi]

@timconsidine you are welcome.

You can always test on the demo server.

And at least the second issue is easily solved via an expected version bump or just take out the check. Not sure why it's needed. Is it?

[humptydumpty]

revive! and...

Thanks @timconsidine for this. I kept coming across CCAI but never looked into it until now. Brilliant approach. I have a few questions.

• Is there a doc/faq page on how to use this in case I want to add an app that isn't listed in the catalog?
• I noticed zoneminder (alpha) in the list - Is it safe enough to install on a production server? (just want to take a peek at it)
• If I install CCAI on my own server - is it pass protected or can anyone access/use it then?
• Q more for @staff what's your opinion on CCAI - will you deploy something similar to it?

[timconsidine]

@humptydumpty thank you.
I am travelling today but will improve documentation when I get back.

In the interim :

• there is a button on front screen to add an app by yourself into the catalogue. It’s just filling in some basic details, so quite easy. But I will document it.
• if you don’t want it to go into the catalogue, you can scroll down, login and then populate the form manually with details for a one-off deployment
• if you deploy CCAI, it will currently be open front page just like CCAI.appx.uk is now (and you can import the master catalogue to your instance). I wasn’t sure that CCAI would have an ongoing usefulness so I didn’t add a login screen and wanted to leave it open for users. But with Cloudron team being always busy, I think there is a case for a private version, and will make a parallel app with login.
• a chunk of the app is handling the authentication needed to install an app (login to the Cloudron instance). If Cloudron were to implement something similar, most/all of this could go because the user’s instance would be already authenticated. So easier and more secure. I will have a go at building such an approach, behind a login screen. It could produce some efficiencies and also be more suited to a login protected and “private” installation.

Reminder for anyone looking at CCAI.
Cloudron authentication details are NEVER stored in this open version. They persist in memory for 15 minutes, then expire. And the user can logout before then if they wish.
It was critical for me that CCAI is secure to use, but I understand people won’t be 100% convinced without checking the source. But it’s there for people to do so if they want.

I paused work on CCAI pending a direction, so some polishing is needed for longer term usefulness, and I will look at doing this.

[timconsidine]

@humptydumpty oh, about zoneminder ….

Yes it is safe to install in a production server.
The app installs and loads and some essential configuration can be done, like adding a camera.
But it’s not currently loading a stream from the camera.

The reason it is ALPHA with warnings is that Zoneminder has some complex runtime internal links for streaming feed which does not fall easily into Cloudron’s separation of /app/code and /app/data. I have been trying to find a solution to this but paused to consider how.

I might need to do some code tweaks during deployment to handle the runtime link generation.
It’s not ideal but might be possible to do in a way which can produce a stable maintainable app.

I want Zoneminder for my own use, so not giving up yet.
You can install to take a peek, just don’t expect the camera feed to show … or let me know if it does !!

[timconsidine]

I have no doubt that Cloudron team would do a much better job of implementing a custom app installer. Technically not difficult and they have the benefit of working it into and inside the platform.

But I acknowledge that a decision to do so is not technically driven, but strategic. Making it easier to install custom apps to Cloudron will, in my opinion, support strong Cloudron growth.

But it comes with the risk of low-quality custom apps harming Cloudron reputation and increasing support loads.
If it’s an official platform-based installer, it could be difficult to push back against support tickets, even if the app is marked UNSTABLE or CUSTOM.

Maybe some community based app ranking or scoring could help, but I acknowledge these are not robust answers to the issue.

[girish]

Yes, I want to able to support this natively in Cloudron itself. I think we will put this in 9.1 roadmap. But before we implement, we will make a proposal here just to make sure it is what everyone is expecting . Probably only after new years though since most of the team is off and on given holidays.

[timconsidine]

Announcing ...

CCAI-P : Cloudron CustomApp Installer Personal Edition

Recognising that many users are reluctant to enter their cloudron credentials on an open url, I have adapted the current "open" CCAI custom app installer, into a "closed" app using cloudron ProxyAuth for authentication, and a token for installations.

While a one-time install of the Personal CustomApp Installer is needed, manually or using the hosted CCAI, after that, the user is secure with their own app deployment, and credentials do not need to be entered on a 3rd party site.

The Personal Edition has a button to import the master app catalogue when needed.

The Personal Edition feels a lot faster as no login code / 2FA is needed.

---

My Git Repo : https://git.cloudron.io/timconsidine/cloudron-customapp-installer-personal

Built Docker Image : tcmbp132021/cloudron-customapp-installer-personal:v1.0.0

Available on the open CCAI site https://ccai.appx.uk

---