Excalidraw - Virtual whiteboard for sketching hand-drawn like diagrams

[marcusquinn]

@jdaviescoates I can't see a repo for it. Kinda typical of the FOSS as marketing model, which is fair enough, choices of features to hold back might be questionable though.

[jdaviescoates]

@jdaviescoates said in Excalidraw - Virtual whiteboard for sketching hand-drawn like diagrams:

Shame self-hosting doesn't have collaboration features yet

I note those lines about the self-hosted version not having collaborative features are no longer present on the GitHub repo, and so presumably the the self-hosted version does indeed now have those features!

[Sam_uk]

Anecdotal but I just tried to collaborate on a self-hosted version and it didn't work

[timconsidine]

@marcusquinn said in Excalidraw - Virtual whiteboard for sketching hand-drawn like diagrams:

We now have tldraw,

Given that tldraw wants their ball back, it wold be worth looking at Excalidraw.

The lack of collaboration of features within self-host (unless they have changed that) is a shame but not a blocker to having this on Cloudron (imho).

[robi]

@timconsidine Cryptpad has a collab whiteboard built in btw

[timconsidine]

Yes, but it (meaning the whiteboard library) is from Russia - can't touch it.
Also bit simplistic, or that's their examples.
Excalidraw is best I have seen so far.

[robi]

@timconsidine Ah, perhaps you can let them know of the better option?

Looking at their docs https://docs.excalidraw.com/docs/@excalidraw/excalidraw/installation#dimensions-of-excalidraw
It's just an npm install, so should be easy to package for Cloudron and if need be swap out an integration that also uses an npm install by changing the target name in the code, like Cryptpad if they're not interested in a switch.

[chetbaker]

Just pointing out I would also be interested in seeing developments on Cloudron side to hopefully self-host this in case it's possible.

[samuk]

I'd use this

[josephcosta]

The library is also usable in nextcloud:
https://github.com/nextcloud/whiteboard/blob/main/README.md

I use it (not in cloudron) with a simple docker-compose:

services:
  whiteboard:
    image: ghcr.io/nextcloud-releases/whiteboard
    restart: always
#    ports:
#      - 3002:3002
    environment:
      - NEXTCLOUD_URL=https://your.nextcloud.url
      - JWT_SECRET_KEY=KEYsome-strong-one

[Grienauer]

I used the SAAS Version. And it is quite good and a nice tool!
lg Nico

[timconsidine]

I have packaged Excalidraw for Cloudron as a custom app.

My git : https://git.cloudron.io/timconsidine/cloudron-excalidraw
Built cloudron docker image : tcmbp132021/cloudron-excalidraw:v2

Available for convenience on CCAI (custom app installer) https://ccai.appx.uk

The GitHub release is v0.18.0 (2025-03-11) but this version number does not reflect the wide and stable deployment of Excalidraw, so I feel it can be considered for official adoption, even though it has not reached the normal criterion of a v1.0 release.

I have been running Excalidraw on a plain VPS via docker-compose.yml, but can now remove it from there and deploy on my primary preferred production server (Cloudron).

[robi]

Nice Christmas present

Thank you

[girish]

@timconsidine We were just looking into this and your package works out of the box, good stuff! To say upfront, none of this is your or the package's fault. The app is closely tied to the SaaS/cloud service and as such has some dangerous "pitfalls" . Like Sign up goes to the SaaS service. Sharing won't work because it also requires the SaaS . Apart from this, there is also calling to DO CDN, firestone google APIs, some analytics service. Is my understanding correct?

IMO, one can just bookmark https://excalidraw.com/ and use it (saves your cloudron CPU some cycles )? But I don't want to make a decision by myself about this, privacy is a very big area and different people have different tolerance - Are people OK with above? Just a general question for everyone.

[timconsidine]

@girish that's good analysis.
That's good example of why we need review before adopting it into AppStore.

Honestly ... I didn't encounter the issues you raised, simply because I never work in the way that I sign up to the SaaS aspect. I just use the UI, save a PNG or screenshot and throw away the design. Only use it for quick sketches and explainer diagrams.

My package was purely to get it off my Traefik/docker-compose VPS onto Cloudron, because might shut down the Traefik VPS.

Yes, entirely viable to just use the main website and did that for a while.

Should it go in the AppStore ?
I don't have a strong view.
Others might, because, as you say, privacy issues.
But they don't crop up for me in this app.

[chmod777]

is there maybe a way to block a cloudron app from accessing the internet/making calls to external servers? this way it would block any saas connection to google or similar?

I would very much prefer an installation of excalidraw without any third party connections.

[james]

Hello @chmod777
This is something you have to raise upstream since this is a software development decision that can not be done by us.

[timconsidine]

In https://forum.cloudron.io/post/118908 @girish rightly questioned how private bundling stock Excalidraw is, and as a result whether it is not just easier to use the hosted version.

But I like Excalidraw ! And I want it on my Cloudron ! And I want it to be as private as possible (completely private maybe not possible).

And I liked @chmod777 suggestion in https://forum.cloudron.io/post/120436.

So I have made package changes and pushed 1.1.2.
There is now a file /app/data/user/json where you can set 2 options.
{"privacyBundle":true,"useCSP":true}

• the first removes some stuff from the image (actually technically, builds a stock repo bundle, and a bundle with stuff removed)
• the second injects headers in your browser to stop the browser calling certain remote sites.

Restart container after editing, of course.

There is then also a new script in container /app/code/verify-runtime.sh which outputs diagnosis, with a summary at the end :

== summary ==
settings: privacyBundle=true, useCSP=true
servedIndex: /app/data/www/index.html
bundleMatch: privacy
cspMeta: YES
cspConnectSrc: 'self' blob:
privacyEndpoints: YES
externalStringsInBundle: firebasestorage.googleapis.com, libraries.excalidraw.com, scripts.simpleanalyticscdn.com, excalidraw.nyc3.cdn.digitaloceanspaces.com
externalStringsMeaning: present in static files, not proof of requests

Is it private? I think so, as much as it can be. The glaring violations have been dealt with. If you're in paranoia mode, use browser Dev Tools to check network activity.

So, now, it's def worth having this modified Excalidraw on Cloudron

---

EDIT : surprisingly having 2 app versions in the same app does not increase dockermimage size much. I guess because of sharing of layers. But nonetheless