Private CloudronVersions.json

[Lanhild]

The convenience and the standardization benefits of using CloudronVersions.json and its features shouldn't be restricted to publicly accessible URLs.

Whether be it manually pasting a CloudronVersions.json's content in my dashboard, I'd like to be able to install my private custom applications this way.

[robi]

It would be nice if they could be hosted by the local registry app.

[Lanhild]

@robi That'd be a great solution

[ruihildt]

Sounds neat!

[james]

Hello @lanhild

@Lanhild said:

its features shouldn't be restricted to publicly accessible URLs

Although this sounds like a good idea, there is an issue.
A URL is needed to make the app update process work.
With just pasted JSON or an uploaded JSON file the app update flow would never work since there is no target to pull the new JSON from.

---

If this is also about security, there are some options.
Haven't tested this, but a password protected URL should work. i.e URL it with ?password=xx.
Or another security via obscurity way would be to upload the CloudronVersions.json to a LAMP app in a folder with a 'secret' folder.
For example https://lamp.cloudron.dev/a4ef19b785acd7c11ccd0b5c1551a8bd/CloudronVersions.json, the a4ef19b785acd7c11ccd0b5c1551a8bd is the 'password'.

A secure approach would be to use a private docker registry for your community app and to give users credentials for the docker registry which they can configure in Cloudron.
If the community app git repository is not public, there is also no way to just build the docker image yourself.
This way, other people can have the CloudronVersions.json file but will not be able to pull the image without granted access to the private docker registry.

---

@robi said:

It would be nice if they could be hosted by the local registry app.

The docker images? That should already work and is close to my above suggestion with a private registry. You'd just need to configure the docker registry in the Cloudron dashboard under /#/docker.
Or do you mean hosting the CloudronManifest.json file in the registry app as well?

---

I believe to understand that this feature request is not about security, hiding or protecting the CloudronVersions.json, but is about comfort and usability.
If you are fine with losing the automatic app update flow, you can always just run cloudron install --location from the repo, which is not as comfortable as just pasting the JSON but resolves to the same outcome.

Due to the mentioned disadvantages of just pasting JSON or upload a JSON file, it is my opinion that we should not add this.

[robi]

@james said:

No, this is about CloudronVersions.json so the images are not separate from the version files.

Could be on S3 as well since it can do http hosting.

[Lanhild]

@james said:

@robi said:

It would be nice if they could be hosted by the local registry app.

The docker images? That should already work and is close to my above suggestion with a private registry. You'd just need to configure the docker registry in the Cloudron dashboard under /#/docker.

I believe what @robi meant is to be able to store the CloudronVersions.json in a registry, much like what authentik does with blueprints.

[robi]

Following up on this.. @james how do we make this happen with the registry?

[girish]

@robi we are working on this. There is a new container registry app which we have made from scratch. Still finishing things up before we can make an announcement .

[robi]

@girish thanks, can you include basic stats with it?

[robi]

Ohh, also one thing missing is distinguishing of different builds by build number in the UI.

If 2 of 3 are stuck, which ones do I stop?

[huehner]

Hello,
reading this thread i was wondering why can't we just use/offer the classic http with "Basic Authentication" with the username + password embedded in the URL ?

That would (in theory) cloudron avoiding to need to create some separate flow or extra fields
But just use a single/simple url field to (optionally) carry the auth information.

https://user:password@domain/path

That would allow people to use any server / service offering http-basic authentication (essentially any webserver)

Trying that our in cloudron 'Add community app' that immediately fails with "versionsUrl is not a valid URL".

Technically that fails in box/src/community.js but it looks like problem is rather in the frontend here in the onSubmit of the CommunityAppDialog

const [url, version] = versionsUrl.value.split("@");

which seems to use the @ symbol in the URL for some other cloudron specific purpose and thus rejecting otherwise valid urls ?

Note that even allowing those url that would probably need some small change on cloudron backend as fetch API apparently doesn't allow url using url with embedded username/password. But that could be easily avoided converting those if present to the Authorization http header and stripping them from the url object itself.

[james]

Hello @huehner
That should already be possible.
Maybe you can try that?

[huehner]

Hello @james. I tried that before and it fails with the error message i mentioned "versionUrl is not a valid URL".

Trying to explain a bit better what i mean

Problem seems to be that this line in your frontend code
const [url, version] = versionsUrl.value.split("@");

For URL entered in the Cloudron Admin UI of value https://user:password@domain/path

The http-request send by the Admin-UI is
/api/v1/community/app?access_token=<redacted>&url=https://user:password&version=domain/path
which can be seen in Browser Developer tools.

As the frontend code seems use the @ character for its own purpose.
I'm not sure what it is trying to do as in the Publishing documentation there's no information about an @ symbol or some version value in the URL.

With gitlab.cloudron.io not accessible i can't share code link what i talk about for 'split' by @ is this code here

My guess is that this then too short url from that split reaches the backend here: box/src/community.js

and then is no longer a valid URL.

That is just a theory i might be totally wrong (and i don't have a test system i can add some debugging right now)

[joseph]

@huehner said:

With gitlab.cloudron.io not accessible i can't share code link what i talk about for 'split' by @ is this code here

it is git.cloudron.io

[james]

Hello @huehner

One could also integrate an access token into the URL like I have mentioned here:
https://forum.cloudron.io/post/123049

When we prototyped the community app store I even tested this and it worked.

[girish]

@huehner a workaround for now is to use ?username=xx&password=yy . I have fixed the issue that you reported in any case and it will be part of the next release. With the fix you can pass username:password in the URL .