Best posts made by doodlemania2

All - I have begun packaging this based on instructions found here as well as basing it off of PHP Lamp. It's still VERY rough (IE, doesn't fully build yet), but would appreciate some eyes on it.

https://git.cloudron.io/doodlemania2/pixelfed

Currently, I'm trying to decide whether the initial setup goes in Dockerfile (would think so) or in start.sh in the uninitialized section. It's been a VERY long while since I attempted to package something, so am more than a little rusty

Also, my run.sh is doing an artisan migrate force on each run - thinking that is a good thing cause run wouldn't know if the container updated, but maybe there's another pattern somewhere that is better.

cc: @girish

https://github.com/StreisandEffect/streisand implements an outstanding VPN (more than just OpenVPN) solution for dummies to use. Full Ansible scripts available to construct VMs.
Other features include:
L2TP/IPsec using Libreswan and xl2tpd
A randomly chosen pre-shared key and password are generated.
Windows, macOS, Android, and iOS users can all connect using the native VPN support that is built into each operating system without installing any additional software.
Monit
Monitors process health and automatically restarts services in the unlikely event that they crash or become unresponsive.
OpenSSH
Windows and Android SSH tunnels are also supported, and a copy of the keypair is exported in the .ppk format that PuTTY requires.
Tinyproxy is installed and bound to localhost. It can be accessed over an SSH tunnel by programs that do not natively support SOCKS and that require an HTTP proxy, such as Twitter for Android.
An unprivileged forwarding user and SSH keypair are generated for sshuttle and SOCKS capabilities.
OpenConnect / Cisco AnyConnect
OpenConnect (ocserv) is an extremely high-performance and lightweight VPN server that also features full compatibility with the official Cisco AnyConnect clients.
The protocol is built on top of standards like HTTP, TLS, and DTLS, and it's one of the most popular and widely used VPN technologies among large multi-national corporations.
This means that in addition to its ease-of-use and speed, OpenConnect is also highly resistant to censorship and is almost never blocked.
OpenVPN
Self-contained "unified" .ovpn profiles are generated for easy client configuration using only a single file.
Both TCP and UDP connections are supported.
Client DNS resolution is handled via Dnsmasq to prevent DNS leaks.
TLS Authentication is enabled which helps protect against active probing attacks. Traffic that does not have the proper HMAC is simply dropped.
Shadowsocks
The high-performance libev variant is installed. This version is capable of handling thousands of simultaneous connections.
A QR code is generated that can be used to automatically configure the Android and iOS clients by simply taking a picture. You can tag '8.8.8.8' on that concrete wall, or you can glue the Shadowsocks instructions and some QR codes to it instead!
AEAD support is enabled using ChaCha20 and Poly1305 for enhanced security and improved GFW evasion.
The simple-obfs plugin is installed to provide robust traffic evasion on hostile networks (especially those implementing quality of service (QOS) throttling).
sslh
Sslh is a protocol demultiplexer that allows Nginx, OpenSSH, and OpenVPN to share port 443. This provides an alternative connection option and means that you can still route traffic via OpenSSH and OpenVPN even if you are on a restrictive network that blocks all access to non-HTTP ports.
Stunnel
Listens for and wraps OpenVPN connections. This makes them look like standard SSL traffic and allows OpenVPN clients to successfully establish tunnels even in the presence of Deep Packet Inspection.
Unified profiles for stunnel-wrapped OpenVPN connections are generated alongside the direct connection profiles. Detailed instructions are also generated.
The stunnel certificate and key are exported in PKCS #12 format so they are compatible with other SSL tunneling applications. Notably, this enables OpenVPN for Android to tunnel its traffic through SSLDroid. OpenVPN in China on a mobile device? Yes!
Tor
A bridge relay is set up with a random nickname.
Obfsproxy is installed and configured with support for the obfs4 pluggable transport.
A BridgeQR code is generated that can be used to automatically configure Orbot for Android.
UFW
Firewall rules are configured for every service, and any traffic that is sent to an unauthorized port will be blocked.
unattended-upgrades
Your Streisand server is configured to automatically install new security updates.
WireGuard
Linux users can take advantage of this next-gen, simple, kernel-based, state-of-the-art VPN that also happens to be ridiculously fast and uses modern cryptographic principles that all other highspeed VPN solutions lack.

Just a quick update to those watching this space. I've got the app loading the DB and getting up and running now. Last things to deal with are:

1. An apache error that throws out a 403, probably my .htaccess
2. Moving the logs to /run
3. Try one more time to leverage /app/code but at least this way works!

It's destined to be a standard app for Cloudron so will support server reboots, etc. Some tweaks will need to be made by the CR teams for it to move into the app store but will work with them on those over the coming days.

I can attest that it is definitely NOT a good idea to add more Docker images to a CR box outside of CR. CR assumes it has full use of the box, so, anything additional you add can and possibly will break things

Would it be possible to get a measurement of bandwidth used per month per container (in and out)?

I've packaged this here: https://git.cloudron.io/doodlemania2/pixelfed it's just waiting for review but works if you'd like to try it out.

You can clone the repo locally and deploy it with the Cloudron CLI: https://cloudron.io/documentation/custom-apps/cli/#installing

Could we get per app bandwidth consumption graphs!? Pretty please!!!!

This isn't an endorsement, but I got a "feels too good to be true" deal from ssdnodes.com if anyone wants to check them out. I'm putting my purchase through its paces to see if it holds up to the advertised specs now. Here's my reference link if you are interested.

I'm a volunteer app packager but avid user of Cloudron - it's the simplest thing I've ever done and a great community of folks working to enhance the catalog of apps. It's built to just work!

Ability to create throw away addresses.

https://github.com/HaschekSolutions/opentrashmail

might have committed directly to master teehee

Mastodon is published. I've also pushed Pixelfed if you are interested, pending app store approval.

Re: Installing PixelFed in the LAMP app properly (well enough)

Got this up and running recently without any major hiccups. The only challenge I'm having is for email - there's an option for encryption which is required if I want to use my local CR instance of mail, but not sure what to put there.

Also, the crontab setup was REALLY cool, however, would be groovie if I could get the crontab output to the CR log for the container. The instructions are sending it to dev/null pretty sure, maybe just strip that out?

The app is finished packaging and works pretty well! Final Cloudron specific tweaks like tests, medialinks, etc and then I guess it can publish. If you want it now, you can grab it from my repo: https://git.cloudron.io/doodlemania2/pixelfed and do cloudron install

This is something I've personally been looking for forever! So, great find. Given the proprietary bits, we likely CAN package it as CE and then one would need to just 'upgrade' it per their terms. CR does this with another package (Confluence maybe?) already.

The compose file looks like we could take it apart for CR based use decently, but we'd really need the original Dockerfile files to really do it. Those don't appear to be published anywhere accessible. If you find them, I'd be happy to take a closer look at packaging it for you.

The alternative looks VERY promising, but they are brand new (baserow) and haven't published a repo yet.

That's a lot of pieces! I'd be happy to look at packaging it @oj but will have to do quite a bit of research to see what all is involved. I was thinking it was just that one needed the spreed signaling. Will give it a go!

Yep! I hear they are working on it soonish. +@girish FYI

So, good news, I've got this working in the Cloudron Base image (I think?) using the signaling test client. My next step will be to wrap things up and start testing against live NextClouds. Currently, I'm thinking I'll disable ALL security since it will only be reachable by a local, on box Nextcloud. Open to suggestions on that.

Just to get up and going, I followed the OP instructions - however, I am already working on getting my CR host spruced up to pack it up - seems totally doable!!!

On the mail config, I think it is cause the default "driver" is log and I need to set it to smtp. Will try again.