What's coming in Cloudron 10
-
Since we are getting swarmed by bots and crawlers (including our gitlab/forum/crm), we decided to include some features that will help in protecting apps. The first one is VPN protection. With this feature, people can access apps only via the VPN.
In the network UI, there is a setting called "VPN protection". First enable the feature and select how to route the client traffic.
There is a per-app checkbox to VPN protect the app:
If you try to access mautic now without a VPN connection, you will see (placeholder):
With OpenVPN/Wireguard connection, you will see mautic .
Of course, this feature is mostly useful for internal apps. For public facing apps (like ghost, gitlab, nodebb), we are working on a different solution.
@girish I'd like to ask regarding this feature.
- Could we enable the VPN to protect my.cloudron.app?
- Is it possible to make custom rules? I mean if I want to protect WP-login.php and WP-admin, but I need to exclude this file /wp-admin/admin-ajax.php.
Thank you for making awesome feature!
-
@girish I'd like to ask regarding this feature.
- Could we enable the VPN to protect my.cloudron.app?
- Is it possible to make custom rules? I mean if I want to protect WP-login.php and WP-admin, but I need to exclude this file /wp-admin/admin-ajax.php.
Thank you for making awesome feature!
@IniBudi I think we will have to implement that in a future release. It's quite a bit more complex to protect specific paths. We have to build some sort of WAF for that. The VPN protection works more at a network level and not much in the http level.
-
girish said:
Ubuntu 26.04 support
We will have Ubuntu 26.04 LTS Resolute Raccoon support next release. I have managed to test this across most of the providers we support. We will have a guide during release time to upgrade manually from Ubuntu 24.04.
Before someone asks, I don't know the ETA for Cloudron 10 yet, I think we will need 2-3 weeks more at least.
-
Since networking/vpn/security is currently being worked on is there any opportunity here to provide native Tailscale support as an option? Specifically we offload heavy compute to external boxes (think AI compute hosted elsewhere) and I'd like to add Cloudron to my Tailnet so that Open WebUI running on Cloudron for example, can have access to some private compute and resources without having to worry about persisting through updates/backups/breaking Cloudron DNS etc.
-
-
Since we are getting swarmed by bots and crawlers (including our gitlab/forum/crm), we decided to include some features that will help in protecting apps. The first one is VPN protection. With this feature, people can access apps only via the VPN.
In the network UI, there is a setting called "VPN protection". First enable the feature and select how to route the client traffic.
There is a per-app checkbox to VPN protect the app:
If you try to access mautic now without a VPN connection, you will see (placeholder):
With OpenVPN/Wireguard connection, you will see mautic .
Of course, this feature is mostly useful for internal apps. For public facing apps (like ghost, gitlab, nodebb), we are working on a different solution.
@girish you selected mautic for this example in the screenshot. Is it possible to differentiate already between different paths? As link redirects, assets etc. would still need to be served publicly - but the admin interface not.
Thanks for clarification!
(Ask me about B2B marketing automation & low code business solutions, if thats interesting for you.)
-
@girish you selected mautic for this example in the screenshot. Is it possible to differentiate already between different paths? As link redirects, assets etc. would still need to be served publicly - but the admin interface not.
Thanks for clarification!
@dsp76 Good point about the matuc example. But I think URL based protection is more complicated because we will need help from the apps. For example, it will require all of mautic admin and it's assets to be designed to be served from under a specific subpath. I haven't really investigated how friendly apps are in this regard but most likely we will have to handle this package by package (in a future release).
-
We will be working on the following for Cloudron 10. mail server needs a bunch of housekeeping and fixes and will be the focus for this release.
Mail related:
- mail: allow cloudron email to be used as a mail relay. this will allow one cloudron to relay emails via another cloudron without having to disable mail from validation.
- mail: fix mail forwarding. there's been lots of bug reports on this feature. have to investigate the root cause
- mail: admin notes field for mailboxes and lists
- mail: housekeeping task. we want to move away from usage of ldap for auth entirely. many of the node ldap modules have become unmaintained
- mail: housekeeping task. the mail database is partly in box code and partly in mail server. have to move everything into mail server. this will help us implement backup/restore of mail nicely as well.
- mail: expose mailbox indexing and spam learning status in the UI
Non-mail related:
- Ubuntu 26.04 support
- Improved progress reporting - show percentage complete and elapsed/estimated time for backups and app installations
- Convert backup site creation dialog to a view
- Policy change: self updating ubuntu packages will be permitted i.e apt update and apt upgrade is allowed.
- Personal access tokens will be renamed to API tokens.
- VPN protection of apps
girish said:
mail: fix mail forwarding. there's been lots of bug reports on this feature. have to investigate the root cause
The mailing list feature has got a revamp. For a start, it's completely removed and all the lists will be migrated to a mailbox with the Cloudron superadmin as the owner.
Each mailbox now has a capability to set up forwarding (same options as mailing list):
For the delivery aspect:
- SRS is still the way to go to overcome SPF.
- We follow best practices from gmail - https://support.google.com/mail/answer/175365?hl=en . Body/message headers are not changed. We also add Forwarding headers. Spam filtering is done before forwarding.
- We now attach ARC headers when forwarding. However, ARC is a system of trust and mostly the big mail providers won't trust ARC headers originating from Cloudron. So, this is mostly a theoretical exercise.
Unfortunately, there is nothing much we can do here about the delivery aspect. If it works, it works.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login