Change Cloudron user management to Mastodon (app) user management on existed app

[itbeard]

For now, we have a huge issue with user password reset in the case when using Cloudron user management, and as far as I understood there is no anyway for solving this issue now.

My question: is it possible move non-Cloudrone users to Mastodon user management system in existed app?

[nebulon]

@itbeard what exactly is the issue with the password reset? If you are using the Cloudron user database, they should be able to reset the password there. Does this not work?

[itbeard]

@nebulon bug with password reset described here: https://forum.cloudron.io/topic/7978/when-using-cloudron-user-management-non-cloudron-users-cannot-reset-password

[nebulon]

ah right, so I tried to at least find out how mastodon stores the user account state (which backend to be used) in the db, but it seems they don't, which makes it even harder to migrate. Can you maybe ask with the upstream project on how users can be migrated between the user backends?

[itbeard]

@nebulon thx for you suggestion!
After small research of my two instances (with Cloudron user management and with Mastodon user management) I notice that in bose instances inside postgres DB existed "public.users" table that contains "encrypted_password" values. So I assume that if I'll be able manually disable SSO through .env.production, then users will be able to log in and recover passwords. Am I right?

[nebulon]

@itbeard so actually I am currently doing various testing around this to see if there is a combination of steps and settings which allows some migration.

[itbeard]

@nebulon I already migrated In half an hour can describe manual of how I did it (if needed)

[nebulon]

@itbeard ah very nice, yes this would be very helpful to share. We can then also put something in our docs for other users to benefit from.

[itbeard]

So, how switch your currently existing Mastodon app from Cloudron user management to Mastodon user management?

Short answer - it is impossible, but... You can save settings and create DB dump, then delete the old app, create a new one and apply old settings and dump of DB!
This approach works only if your Mastodone app use external file storage for files (like S3 or else). If you store user files inside Cloudron - you need to download them to your computer before switching!

Prerequisite:

1. You need dump of app postgress DB. It can be done through app console and command
   PGPASSWORD=${CLOUDRON_POSTGRESQL_PASSWORD} pg_dump --no-owner --no-privileges --username=${CLOUDRON_POSTGRESQL_USERNAME} --host=${CLOUDRON_POSTGRESQL_HOST} ${CLOUDRON_POSTGRESQL_DATABASE} > /tmp/pgdump.sql
   Your dump will be waiting for you at tmp/pgdump.sql. Just upload it to your local machine by pressing "Upload" button in app terminal (PC, laptop, whatever)
2. You need to save your custom settings from .env.production file. File placed in app/code folder - just type ls -a to see it and then use vim to copy file content.
3. In app settings save to notes your notification email-address (if you change it after installation).

Steps to switching:
0. Turn on RecoveryMode of your old instance

1. Save all settings and DB dump (see info above)
2. Delete old app
3. Install new Mastodon app from Cloudrone AppStore
   • !IMPORTANT: during the installation process choice "Leave user management to the app" option!
4. After app installation you need just update .env.production, re-set email address for notification, and import DB (more info about importing process here https://docs.cloudron.io/guides/import-postgresql/)
   • IMPORTANT: Do all of the updates in RecoveryMode of app
5. Upload old files (if you do not use an external file store like Amazon S3 etc.)

That is it! After these short manipulations (it takes 20-30mins) Mastadon user management will be turned on and your users will be able to reset their passwords without any troubles.

[nebulon]

@itbeard awesome, thanks a lot for the writeup. I will try to play this through on my end to verify the process.

[itbeard]

@nebulon IMPORTANT!
After migration to Mastadon user management, we found the small (or not) issue: 2FA authentication keys based on one-time-password were broken for users who used them. Looks like those keys were related to the environment, but the environment was changed (because we create new Mastodon App while migrating the process).

As a result we decided to disable 2FA for all our users who used it before migration.

How it can be fixed:

1. Find all users in DB who use 2FA (look into table public.users, column otp_required_for_login with value 't')
2. Reset for those users next columns values to default: otp_required_for_login, otp_backup_codes, encrypted_otp_secret, encrypted_otp_secret_iv, encrypted_otp_secret_salt
3. Send an email to those users asking them to re-setting-up 2FA.

What the interesting - disable 2FA through admin panel does not works for users from old app, so we did it right through DB

[redegelde]

sound good,
okay what if i am transferring from VPS. Is this the same routine?
or easier by setting up clean cloudron Mastodon app and then putting back the backup
regards
Eric

[itbeard]

@redegelde looks the same. You need to transfer only files, Mastodon config, and Postgre DB (Reddis DB also can be transferred but is not necessary). But be sure that your version of Mastodon exactly the same as on Cloudron (4.0.2 for now). There can be an incompatibility between DB schemes of two different versions of Mastodon.

[redegelde]

@itbeard pfff, hope for easy fix on running instance. It is lot of work, and with an instance with almost 800 users now tricky, dont wont to lose them

[girish]

@redegelde an idea is to do a "dry run" first. Just clone the app and play around with the commands to see how well it works.

[itbeard]

@redegelde I did it on the instance with 500+ users and all was fine. Just keep backup near)

[redegelde]

Wow okay. Thank you

[redegelde]

been a while, and still on the Cloudron But more and more now not able to changer there email or password getting the the line "your are logged in external"
so i thing going to run your steps @itbeard or does Cloudron have the solution now
regards
Eric