Cloudron Forum

• Main Page: https://fossorial.io/
• Git: https://github.com/fosrl/pangolin
• Licence: AGPL-3
• Docker: Yes
• Demo:

• Summary:
  Pangolin is a self-hosted tunneled reverse proxy management server with identity and access management, designed to securely expose private resources through encrypted WireGuard tunnels running in user space. With Pangolin, you retain full control over your infrastructure while providing a user-friendly and feature-rich solution for managing proxies, authentication, and access, and simplifying complex network setups, all with a clean and simple dashboard web UI.

• Notes: Self-hosted alternative to Cloudflare Tunnels. Allows you to securely expose services in your homelab without opening ports on your firewall.

• Alternative to link: https://alternativeto.net/software/fossorial-pangolin/

I upgraded from 9.0.17 to 9.1.3 yesterday and everything went smooth as butter! Thanks to the Cloudron team for the awesome work!

Temporary work-around for anyone experiencing the same issue:

1. Access the SQL DB via the Cloudron App Terminal
2. Manually elevate the user via SQL:

UPDATE tc_users SET administrator = 1, userlimit = -1 WHERE email = 'user@domain.com'

3. Do whatever admin tasks you need to do, noting that admin permissions will be removed at next login or app restart.

@p44 You raise several valid points. Infact when I originally setup the I.T infrastructure for my SME, I chose service providers primarily based on technical aspects. Secondary was the cost element, but I did not pay any mind to political aspects.

But recent events (e.g. Russian invasion of Ukraine, Trump's ongoing global trade war) have changed my point of view where I now feel that it is important to make some political considerations as well. After all, as a business, when choosing a trade partner, you want to be assured of a certain level of economic and regulatory stability, both of which are closely tied to politics.

Have companies such as Digital Ocean or Cloudflare wronged me or my business in any way? No
Was I satisfied with service that I received from them? Absolutely yes
Are they directly responsible for the decisions being made by the current US administration? No
Is it unfair for me to stop purchasing their services due to no fault of their own? Perhaps so

In trying to find suitable EU software providers for my business, I am just trying to safeguard the business from any ill effects that could be caused by the political turmoil and uncertainty that lies ahead. It could be the case that in some scenarios, I am unable to find an EU based alternative and therefore must continue to use a US based service. And that's fine too. But at least I would have done what I could to reduce risk and exposure.

@James , I think I found the issue. After googling the time out error message, I came across some threads on other forums which seemed to indicate that it could be related to large email messages that are not being indexed within the 120000 ms / 2 Minutes timeout interval. So I went to mail4's INBOX , deleted the largest email (17.7MB) and then re-ran the script. This time it failed during indexing mail4's TRASH folder. Once I deleted the email from the TRASH folder, voila, indexing was successful.

So perhaps the timeout needs to be increased or be a user defined value.

In my case, I am running my Cloudron instance as a VM on a Synology DS1621+ which features an AMD Ryzen V1500B processor (4 cores, 8 threads, 2.2 Ghz base clock). It isn't a very fast processor so that could be a contributing factor.

Is there any estimated timeframe for the release of 9.0?

Another upvote for Nextcloud AIO. OP created this topic almost 2 years ago and since then, Nextcloud AIO has not only become very stable but also has a mature feature set.

Due to the recent Trump administration shenanigans, I have decided that I will make concerted efforts to reduce my dependency on U.S. software companies, wherever possible. Ever since I came across Cloudron 4 years ago, I have been using Digital Ocean as my VPS provider. However this past weekend, I switched to Hetzner thanks to the number of satisfied users on this forum. The transition went smoothly with only one app (Nextcloud) running into some issues which I was able to resolve by myself using the official Cloudron documentation - so great job @girish @nebulon and the rest of the Cloudron team!

I have also been using Cloudflare DNS during the above period and while I have been happy with the services rendered, I feel that I need to change to a DNS provider incorporated in a country that respects global democracy, such as an EU member state.

Bunny DNS seems to be a popular choice on reddit and is supported on Cloudron. Does anyone here have personal experience with them? Are there other providers worthy of consideration?

And how would I go about migrating from Cloudflare DNS to a new provider with minimal downtime to applications hosted on my Cloudron server?

Thanks in advance for your feedback! Once the DNS migration is complete, I will start to look at migrating my outbound email relay provider (currently Amazon SES) followed by my remote backup provider (Backblaze) to friendlier destinations.

I would love to see more “business” apps such as Odoo, ERPNext, Docmost, OpenCloud etc. At the moment I feel that the Cloudron App store is largely dominated by “developer” and “personal” apps, which I suppose is kind of expected considering the type of crowd that’s into self hosting & open source.

Environment

• Cloudron Version: 9.1.3
• App: Traccar 6.12.2
• User Management: Enabled (Cloudron SSO)

Description

When a user logs in via Cloudron SSO, their administrative permissions within Traccar are automatically reverted to a standard "User" status. Even after manually elevating the user in the database (setting administrator = 1 and userlimit = -1 in the tc_users table), the changes are overwritten the moment the user authenticates via SSO or the app is restarted.

This creates a persistent "Write Access Denied" state for the primary administrator, preventing the management of devices, geofences, or server settings.

Steps to Reproduce

1. Install Traccar on Cloudron with User Management (SSO) enabled.

2. Login via SSO (Initial status is a standard user).

3. Manually elevate the user to admin in the Traccar UI.

4. Confirm Admin access is active in the Traccar UI (Settings and Server menus are visible).

5. Log out and log back in via Cloudron SSO, or restart the app.

6. The user's administrator status in tc_users is reverted to 0x00, and administrative access is lost.

SQL: SELECT email, administrator FROM tc_users WHERE email = '[redacted]';

Expected Behavior
The Cloudron SSO sync should respect existing administrator flags within the Traccar database.

I am testing the new unstable release of Docmost and encountering a consistent 400 Bad Request error when attempting to use the file attachment feature in the editor. The upload fails immediately, regardless of file size (tested with files as small as 30kb).

Environment:

Host: Cloudron 9.1.3
App: Docmost 0.70.3

Steps to Reproduce:

1. Install the unstable Docmost app.
2. Open any document and attempt to insert an attachment or image.
3. Select a small file (e.g., 30kb).
4. The UI throws an upload error, "Error processing file upload."

App Logs:
The logs show a clear BadRequestException indicating the storage backend is either unconfigured or inaccessible:

2026-03-22T16:08:56Z {"level":"error","time":"2026-03-22T16:08:56.462Z","pid":92,"hostname":"914b186f-aa30-4c30-929d-c63219d35ecf","req":{"method":"POST","url":"/api/files/upload","ip":"X.X.X.X","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.3.1 Safari/605.1.15"},"context":"AttachmentController","err":{"type":"BadRequestException","message":"Error uploading file to drive","stack":"BadRequestException: Error uploading file to drive\n    at AttachmentService.uploadToDrive (/app/code/apps/server/dist/core/attachment/services/attachment.service.js:176:19)\n    at async AttachmentService.uploadFile (/app/code/apps/server/dist/core/attachment/services/attachment.service.js:68:9)\n    at async AttachmentController.uploadFile (/app/code/apps/server/dist/core/attachment/attachment.controller.js:89:34)","response":{"type":"Object","message":"Error uploading file to drive","stack":"","error":"Bad Request","statusCode":400},"status":400,"options":{},"name":"BadRequestException"},"msg":"Error uploading file to drive"}
2026-03-22T16:08:56Z {"level":"error","time":"2026-03-22T16:08:56.462Z","pid":92,"hostname":"914b186f-aa30-4c30-929d-c63219d35ecf","req":{"method":"POST","url":"/api/files/upload","ip":"X.X.X.X","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.3.1 Safari/605.1.15"},"context":"AttachmentService","msg":"Error uploading file to drive:"}

Expected Behavior:
The app should successfully accept the file and store it in the designated local storage path within /app/data/.

Another upvote to have this in the app store!

Looks like there already is docker image available: https://github.com/traccar/traccar-docker

@p44 @perelin @Gengar thank you for your suggestions, I'll be sure to check them out! Will post an update here once I have made a decision regarding a DNS provider.

Upvoting this. Really pleased that Paperless-ng is now available on Cloudron, but for those of us who need the ability to create multiple user accounts and store files in a folder structure, docspell seems to be a great option.

Disregard, it was a firewall issue on my DMZ VLAN. Please close/delete this topic.

Now on version 3.0.

This new update comes with a lot of new features:

• Multiple Pages and Easy Layout Management
• Import data from LinkedIn, JSON Resume
• Refreshed UI with a more natural UX
• Export a PDF within 5 seconds
• Get customized links to your resume for easy access/sharing
• Custom-made backend, no more connections to Google/Firebase. Your data is safe, as it has always been.

@nj Thanks for your hard work with this! I am looking forward to the day this becomes available in the app store us n00bs.

I have Kasm running behind a Cloudron reverse proxy and connected to Cloudron's OIDC directory for user authentication. It was pretty straightforward to set up, but if anyone wants/needs a written guide, I am happy to do so.

1. Install Kasm. (I have it running on a dedicated VM and followed the single server installation instructions: https://kasmweb.com/docs/latest/install/single_server_install.html)

2. Once installed, log into the Kasm host using the admin credentials and then configure the reverse proxy by going to Infrastructure > Zones in the left hand side panel and following the instructions here: https://kasmweb.com/docs/latest/how_to/reverse_proxy.html#update-zones
   (Note: in my case, the default parameters worked fine)

3. Install the Cloudron App proxy and point it to your Kasm host e.g. https://[IP-ADDRESS]:443. Now you should be able to access the Kasm login page via the domain you set in the app proxy. e.g. kasm.yourdomain.tld

4. To use OpenID authentication, first we need to add Kasm as an OIDC client in Cloudron. Go to Cloudron > User Director > OpenID Connect Provider > New Client, and enter the following:
   Name: kasm
   Login callback URL: https://kasm.yourdomain.tld/api/oidc_callback
   Signing Algorithm: RS256

Copy the resulting Client ID and Client Secret for use in step 5.

5. Now in Kasm, go to Access Management > Authentication > OpenID and follow the instructions here: https://kasmweb.com/docs/latest/guide/oidc.html
   Main parameters to be set are:
   Display Name: Can be anything e.g. Login with Cloudron
   Hostname: kasm.yourdomain.tld
   Client ID: paste from step 4
   Client Secret: paste from step 4
   Authorization URL: https://my.yourdomain.tld/openid/auth
   Token URL: https://my.yourdomain.tld/openid/token
   User Info URL: https://my.yourdomain.tld/openid/me
   Scope (One Per Line): openid profile email
   Username Attribute: sub
   Redirect URL: this should be automatically populated and should match what you entered as the callback url in step 4 i.e. https://kasm.yourdomain.tld/api/oidc_callback

I believe that should be it! Give it a shot and let me know if you run into any issues. There could be a possibility that I forgot to document something in the above steps. Once it is confirmed to be working, I will polish it up and submit it as a community guide.

I was attempting to send user invitations via the Stirling-PDF app but noticed the SMTP settings are currently unconfigured. Looking at the package, it appears that Managed SMTP isn't currently enabled for this app.

Could we update the Cloudron app to include the Cloudron SMTP app relay? This would allow the app to automatically use Cloudron’s built-in mail server settings via environment variables, rather than requiring users to manually configure external SMTP credentials within the app UI.