cloudron login my.cloudron.example
Username: m
Password: *****************
2FA Token (if enabled): 
write EPROTO 140479727316736:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:802:

Also tried the suffix with --allow-selfsigned but no dice, anyone an idea what that's all about? All certs are there and the browser connection works fine.

Could a temporary port forward/DMZ be the solution?

My feeling is saying that a local IP address from a DNS resolve is kind of "wrong", maybe a browser does not like that

Generally, this is not a problem at all. In fact, that's how every intranet works (or even amazon VPC instances have DNS names that map to internal addresses). Browsers should also have no problem because otherwise every corporate which requires you to VPN in first before connecting to intranet won't work.

I say 'generally' because maybe there are some special intranet/local IP ranges with special behavior that I don't know of.

Hairpinning also shouldn't be a problem because we are talking of local addresses here and it should never need to exit the router.

I think your observation that firefox keeps "hanging" is interesting. Can you quickly try host my.domain.com on the CLI ? Does it translate quickly? Do you also have this DNS over HTTP which is supposedly enabled by default in firefox? I am not sure how it influences all this. Just putting some ideas for you to debug

Firefox seems to keep "hanging". Opera starts with the same issue, but recovers after ~7-8 sec and seems to do a hard refresh (which solves the problem).

My feeling is saying that a local IP address from a DNS resolve is kind of "wrong", maybe a browser does not like that. I tried experimenting with hairpinning and that kind of stuff too.

Update:

I installed ubuntu directly on a system and cloudron on top. 16GB, 4 cores and 256gb storage. VM was the first thought, but installed directly to compare the behavior.

I also installed cloudron on a EC2 instance. No problemo....

Depends on how deep you want to go but you can also try curl https://my.domain.com, you will only see relative URLs like https://paste.cloudron.io/juwojaqume.xml , so I am not sure where the redirects are coming from.

office= onlyoffice document server

When I do wget, I get the following:

https://office.<domain>/
Resolving office.<domain> (office.<domain>)... <localIP>
Connecting to office.<domain> (office.<domain>)|<localIP>|:443... connected.
HTTP request sent, awaiting response... 302 Moved Temporarily
Location: http://office.<domain>/cloudron [following]
URL transformed to HTTPS due to an HSTS policy
https://office.<domain>/cloudron
Reusing existing connection to office.<domain>:443.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://office.<domain>/cloudron/ [following]
URL transformed to HTTPS due to an HSTS policy
https://office.<domain>/cloudron/
Reusing existing connection to office.<domain>:443.
HTTP request sent, awaiting response... 200 OK
Length: 2228 (2,2K) [text/html]

The amount of redirects seems strange to me when I start off with a request to the https address directly.

I get the feeling that there is some kind of loop when requesting a page. Ctrl + F5 seems to solve the issue and makes the page load instantly. Some even get blocked according to the firefox debug inspector.

Many thanks for the response.

Using Amazon Route53 here. I am getting the error: queryNs ESERVFAIL <domain>

There are NS records present and point to Amazon itself

I missed an important step. You have to put the zone name as well in advanced as cloudron.domain.com. I updated the instructions.

Using Amazon Route53 here. I am getting the error: queryNs ESERVFAIL <domain>

There are NS records present and point to Amazon itself

Here's how you do it. The setup is much simpler if you have a programmatic DNS provider (like DO, Cloudflare, Route53 etc). If you don't have this already, I recommend that you setup some subdomain into say DigitalOcean's DNS. For this, you have to setup a DO account and add cloudron.domain.com into DigitalOcean domains. Then setup NS records for cloudron.domain.com to point to Digital Ocean. Please give some 30 mins for NS records to propagate. Once this done:

• Install Cloudron on a VM
• Domain setup
  • Put the domain as cloudron.domain.com and set it up for DO DNS
  • Click on Advanced. Here, choose the Network Interface from the drop down and provide the network interface of the VM/server. Alternately, give it the static IP (give the local IP like 192.168.1.100 or whatever it is).
  • If your main domain domain.com and the subdomain cloudron.domain.com are on different DNS providers, then you have to put the zone name as cloudron.domain.com.
• Finish setup - that's it!

What will happen is:

• Cloudron will get LE certs via DNS. This is why the DO DNS setup was required. Without this, you will need port 80 forwarding for LE and it gets a bit complicated.
• Cloudron will program your DNS with A entries of the local IP. So, my.cloudron.domain.com will actually point to 192.168.1.100. It's not publicly reachable.

Let me know if that works! Or if you have more restrictions in your setup.

Goal:

Cloudron installed on a machine within local network. Without port forwarding or domain. Accepting a self signed cert is good enough right now.