But I like Excalidraw ! And I want it on my Cloudron ! And I want it to be as private as possible (completely private maybe not possible).

And I liked @chmod777 suggestion in https://forum.cloudron.io/post/120436.

So I have made package changes and pushed 1.1.2.
There is now a file /app/data/user/json where you can set 2 options.
{"privacyBundle":true,"useCSP":true}

• the first removes some stuff from the image (actually technically, builds a stock repo bundle, and a bundle with stuff removed)
• the second injects headers in your browser to stop the browser calling certain remote sites.

Restart container after editing, of course.

There is then also a new script in container /app/code/verify-runtime.sh which outputs diagnosis, with a summary at the end :

== summary ==
settings: privacyBundle=true, useCSP=true
servedIndex: /app/data/www/index.html
bundleMatch: privacy
cspMeta: YES
cspConnectSrc: 'self' blob:
privacyEndpoints: YES
externalStringsInBundle: firebasestorage.googleapis.com, libraries.excalidraw.com, scripts.simpleanalyticscdn.com, excalidraw.nyc3.cdn.digitaloceanspaces.com
externalStringsMeaning: present in static files, not proof of requests

Is it private? I think so, as much as it can be. The glaring violations have been dealt with. If you're in paranoia mode, use browser Dev Tools to check network activity.

So, now, it's def worth having this modified Excalidraw on Cloudron

EDIT : surprisingly having 2 app versions in the same app does not increase dockermimage size much. I guess because of sharing of layers. But nonetheless

I would very much prefer an installation of excalidraw without any third party connections.

Honestly ... I didn't encounter the issues you raised, simply because I never work in the way that I sign up to the SaaS aspect. I just use the UI, save a PNG or screenshot and throw away the design. Only use it for quick sketches and explainer diagrams.

My package was purely to get it off my Traefik/docker-compose VPS onto Cloudron, because might shut down the Traefik VPS.

Yes, entirely viable to just use the main website and did that for a while.

Should it go in the AppStore ?
I don't have a strong view.
Others might, because, as you say, privacy issues.
But they don't crop up for me in this app.

IMO, one can just bookmark https://excalidraw.com/ and use it (saves your cloudron CPU some cycles )? But I don't want to make a decision by myself about this, privacy is a very big area and different people have different tolerance - Are people OK with above? Just a general question for everyone.

Thank you

My git : https://git.cloudron.io/timconsidine/cloudron-excalidraw
Built cloudron docker image : tcmbp132021/cloudron-excalidraw:v2

Available for convenience on CCAI (custom app installer) https://ccai.appx.uk

The GitHub release is v0.18.0 (2025-03-11) but this version number does not reflect the wide and stable deployment of Excalidraw, so I feel it can be considered for official adoption, even though it has not reached the normal criterion of a v1.0 release.

I have been running Excalidraw on a plain VPS via docker-compose.yml, but can now remove it from there and deploy on my primary preferred production server (Cloudron).

I use it (not in cloudron) with a simple docker-compose:

services:
  whiteboard:
    image: ghcr.io/nextcloud-releases/whiteboard
    restart: always
#    ports:
#      - 3002:3002
    environment:
      - NEXTCLOUD_URL=https://your.nextcloud.url
      - JWT_SECRET_KEY=KEYsome-strong-one

Looking at their docs https://docs.excalidraw.com/docs/@excalidraw/excalidraw/installation#dimensions-of-excalidraw
It's just an npm install, so should be easy to package for Cloudron and if need be swap out an integration that also uses an npm install by changing the target name in the code, like Cryptpad if they're not interested in a switch.

We now have tldraw,

Given that tldraw wants their ball back, it wold be worth looking at Excalidraw.

The lack of collaboration of features within self-host (unless they have changed that) is a shame but not a blocker to having this on Cloudron (imho).

Shame self-hosting doesn't have collaboration features yet

I note those lines about the self-hosted version not having collaborative features are no longer present on the GitHub repo, and so presumably the the self-hosted version does indeed now have those features!

We now have tldraw, but just a quick bump on this post for those interested to compare: https://plus.excalidraw.com/excalidraw-plus-vs-excalidraw

What is not at all clear to me is whether or not Excalidraw Plus is self-hostable or not - have you managed to work that out?

• https://excalidraw.com/
• https://libraries.excalidraw.com/
• https://plus.excalidraw.com/excalidraw-plus-vs-excalidraw