@vk182 said in Hiding apps behind the proxy app to enable cloudron authentication:

Can you please point me to the documentation on how this can be done? I understand now that and app updates itself, isn't it?

I have done so already here

said in Hiding apps behind the proxy app to enable cloudron authentication:

I did a recent post about this, see: https://forum.cloudron.io/post/115963

You can think of that process like an app update, that only updates the app to use the Cloudron proxyauth add-on and does nothing with the application itself.

Can you please point me to the documentation on how this can be done? I understand now that and app updates itself, isn't it?

If you have apps, that should not be publicly accessible, you could always only allow connections from specific IP-Addresses like e.g. a VPN.

Is it possible to block single app from public access within the same Cloudron instance? I do not want to overcomplicate the configuration and have nested servers...

@vk182 said in Hiding apps behind the proxy app to enable cloudron authentication:

Do I understand correctly, that proxyAuth add-on will respect the Access Control setting of the app and allow access only to the allowed users via their Cloudron authentication? The target app may want the extra auth then but that is fine.

You understood correctly.

@vk182 said in Hiding apps behind the proxy app to enable cloudron authentication:

Is there a way to add proxyAuth for the existing app?

Yes that can be done.
You can think of that process like an app update, that only updates the app to use the Cloudron proxyauth add-on and does nothing with the application itself.

@vk182 said in Hiding apps behind the proxy app to enable cloudron authentication:

p.s. Just as a side note, what is the best way to isolate the particular app from the public interface?

If you have apps, that should not be publicly accessible, you could always only allow connections from specific IP-Addresses like e.g. a VPN.

Example setup could look something like this:

• Main Cloudron server - running the VPN app and all other public apps
• Separate Cloudron server - named intranet running all apps that should only be accessible from whitelisted IP-Addresses like the VPN (public IP of Main Cloudron)
• non-public apps on this Cloudron intranet server
• People who should be allowed to access the intranet server get a VPN client cert
• The Cloudron intranet server can be connected to the Main Cloudron User Directory, thus syncing users for apps that have OIDC/LDAP
• For the Intranet Cloudron server, you'd have to configure the firewall on a hosting provider level to only allow access from the Public IP of the Main Cloudron

Thus isolating public from intranet and still maintaining the comfortable setup of Cloudron User Directory.
Also comes in handy if you don't want your public apps (like Website or Shop) to go offline only when you need to update/reboot the intranet server.

Is there a way to add proxyAuth for the existing app? I do understand that documentation says it is impossible, but what if we have quite a big data already in the app that we want to protect and we are not able to just run a fresh install?

p.s. Just as a side note, what is the best way to isolate the particular app from the public interface? This will allow us to be able to hide any app without clear reinstall with proxyAuth. This public-interface disabling also would come handy if we wanted the app to only be allowed on the VPC interface (i.e. on our ZeroTier network, but not on the public).

That way there's no way around the gate if configured via app subdomain and no additional proxy app is needed.

@vk182 said in Hiding apps behind the proxy app to enable cloudron authentication:

What would be the cleanest, most durable way to prevent external access to the target app’s subdomain, so that it is reachable only through the proxy? We are trying to avoid custom modifications or unsupported hacks that might break updates or interfere with Cloudron’s normal operation.

Even though you have stated this.
It would be a simple change to the app and the extra maintenance would be somewhat manageable. Depending on how many apps you want to do this with.

I did a recent post about this, see: https://forum.cloudron.io/post/115963

With the same approch you can edit any Cloudron app and add the proxyAuth addon.

Looks like a feature in high demand, with a fair amount of use cases...

@vk182 said in Hiding apps behind the proxy app to enable cloudron authentication:

host several applications that do not support native Cloudron user authentication

Are these custom apps or are you running them inside e.g.: the LAMP app?