Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


    Cloudron Forum

    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular

    Password Protected Cloudron Nginx

    Feature Requests
    5
    16
    576
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • O
      oj last edited by

      When setting up a Cloudron server, there are often sections of the site that you wish to restrict access to. Web applications often provide their own authentication and authorization methods, but the web server itself can be used to restrict access if these are inadequate or unavailable eg. filespizza, Jirafeau, etc.

      This tutorial shows how.

      Would it make sense to enable this in an easier fashion via the Cloudron Admin interface?

      Some users would prefer that their entire Cloudron work server be safer behind a server-level login-password combination.

      girish 1 Reply Last reply Reply Quote 0
      • girish
        girish Staff @oj last edited by girish

        @oj I think that makes sense. If you can point out specific apps, we can simply add the new authProxy addon to the apps. Should be trivial. Did you have any more in mind other than file pizza and Jirafeau? By re-using the auth proxy we can user management + 2FA integration etc automatically.

        O 1 Reply Last reply Reply Quote 0
        • O
          oj @girish last edited by

          @girish If it were possible to control web-app use/read access, then I would immediate install filepizza, Jirafeau, Prometheus server/ altertmanager, CloudTorrent and Transmission.

          Further, if it is could be used to restrict read access to the content in Surfer and WikiJS...then that too.

          mehdi 1 Reply Last reply Reply Quote 0
          • nebulon
            nebulon Staff last edited by

            @oj just to be on the same page, are you looking for generally putting an app behind a login page, or just some subpaths or sections of the app?

            O 1 Reply Last reply Reply Quote 0
            • mehdi
              mehdi App Dev @oj last edited by

              @oj Transmission at-least is already behind authentication

              1 Reply Last reply Reply Quote 0
              • nebulon
                nebulon Staff last edited by

                Yes, also surfer has a way to password or user protect the public pages. So I wonder if this falls into the app's area to be implemented or a platform feature.

                O 1 Reply Last reply Reply Quote 0
                • O
                  oj @nebulon last edited by

                  @nebulon Generally put an app behind a login page.

                  nebulon 1 Reply Last reply Reply Quote 0
                  • nebulon
                    nebulon Staff @oj last edited by

                    @oj ah ok, that is indeed easier then. Still there are at least two choices, we could enable the authproxy addon for apps where it makes sense or we could essentially allow the authproxy for any app. I would prefer a more selective approach, but maybe I don't see all the use-cases. For example putting a matomo behind an auth proxy blindly would essentially render the app useless as far as I can tell.

                    O 1 Reply Last reply Reply Quote 0
                    • O
                      oj @nebulon last edited by

                      @nebulon Yes, I see that my Surfer now has a "Password Restricted" option...Thanks! (I don't think it had it when I set it up over a year ago!)

                      1 Reply Last reply Reply Quote 0
                      • O
                        oj @nebulon last edited by oj

                        @nebulon Agree.

                        Essentially, my country's Information Technology rules (and punitive legal actions) have moved towards a concept of "intermediary liability" for the public actions of the users of the services that I host! Hosting and public distribution of so-called "anti-national" content (i.e. content critical of the governments policies/actions) is one such area...if you can believe it! (It may be difficult to believe this if you are in Europe!)

                        I have no control over these rules...So, as a service provider - in case of a specific, legally binding notice from the government - I could need to control who creates/distributes/reads content via these apps on Cloudron.

                        1 Reply Last reply Reply Quote 0
                        • girish
                          girish Staff last edited by

                          I have added proxyAuth it some apps like file pizza and hastebin now. We can add it to more as we go. Jirafeau already has some admin page, so I think it will be confusing if we have a login page and another admin password page. jirafeau already has a way to restrict uploads - https://docs.cloudron.io/apps/jirafeau/#restricting-uploads . Maybe one of those will be enough. Alternately, I think we have to look into integrating better with the app somehow.

                          O 1 Reply Last reply Reply Quote 2
                          • O
                            oj @girish last edited by

                            @girish Thanks! Have rolled out filepizza... and users love the login experience! Hope Jirafeau too gets the same.

                            L 1 Reply Last reply Reply Quote 0
                            • L
                              lucidfox @oj last edited by lucidfox

                              I'd like to add the password protection to file pizza as well. Seems like I might be missing an obvious setting, but how can can the proxyauth be activated?

                              girish 1 Reply Last reply Reply Quote 0
                              • girish
                                girish Staff @lucidfox last edited by

                                @lucidfox you have to re-install the app. when installing, it gives you the option to password protect or not.

                                L 1 Reply Last reply Reply Quote 0
                                • L
                                  lucidfox @girish last edited by

                                  @girish thanks for that, it worked. i'm not sure how useful the password protection is in practice, at least in my case, because the receiver of the file pizza link would also need to sign in (and not just the uploader). i've gone back to using file pizza without having to login. wondering if this a security risk in anyway?

                                  girish 1 Reply Last reply Reply Quote 0
                                  • girish
                                    girish Staff @lucidfox last edited by

                                    @lucidfox AFAIK, since it's totally peer to peer, there is no risk. Of course, external users can use it but no data goes through your server.

                                    1 Reply Last reply Reply Quote 1
                                    • First post
                                      Last post
                                    Powered by NodeBB