I just wanna share my experiment to install sGTM on Cloudron.

And I think it works well, and I got this code from Claude AI.

You can use this CloudronManifest.json and execute it via Cloudron CLI:

And my question is how to make the update process automatically from Cloudron dashboard?

Thank you.

{
  "id": "com.example.sgtm",
  "title": "Server-side GTM",
  "author": "Admin",
  "description": "Google server-side Tag Manager (sGTM) tagging server, packaged for Cloudron.",
  "tagline": "Self-hosted sGTM tagging server",
  "version": "1.0.4",
  "dockerImage": "gcr.io/cloud-tagging-10302018/gtm-cloud-image@sha256:688d35c6c54473be42d5128befa4d98a722d76d6fdf9cb84d63b52a3f223a1e6",
  "healthCheckPath": "/healthz",
  "httpPort": 8080,
  "manifestVersion": 2,
  "website": "https://services.example.com",
  "contactEmail": "admin@example.com",
  "tags": [
    "analytics",
    "gtm",
    "tracking"
  ],
  "memoryLimit": 1073741824,
  "addons": {
    "localstorage": {}
  }
}

And this is the README.md:

Server-Side GTM (sGTM) on Cloudron — Setup Guide & Best Practices

This guide explains how to run the official Google image gcr.io/cloud-tagging-10302018/gtm-cloud-image as a custom Cloudron app, directly without building a Dockerfile. The image is pinned via the dockerImage field in CloudronManifest.json using an immutable digest (@sha256:...). There is no Dockerfile, and no build process is required.

You will run TWO apps from the same package:

Role	Domain (REMEMBER!)	Required Environment Variables
Serving	services.example.com	CONTAINER_CONFIG + PREVIEW_SERVER_URL (no RUN_AS_*)
Preview	service.example.com	CONTAINER_CONFIG + RUN_AS_PREVIEW_SERVER=true

️ Important: Naming Convention (Easy to mix up!)

• "services" (PLURAL, with an 's') = PRODUCTION / Serving -> serves your gtm.js
• "service" (SINGULAR) = PREVIEW / Debug
• Note: The role is strictly determined by the Environment Variables (ENV VAR), not the domain name. If they ever get swapped, check the variables!

️ Important: Docker Images (A hard-learned lesson!)

• DO NOT use the :stable tag in dockerImage. Cloudron/Docker caches :stable to the old digest. This means an update might report as "successful," but the old version will still be running (e.g., sticking to 4.3.0 instead of 4.4.0). Using --no-cache DOES NOT help here—that's a build-cache flag, not a pull-cache flag, and this setup doesn't use builds anyway.
• USE A DIGEST (@sha256:...). It is immutable and content-addressed, making it impossible to cache incorrectly. Explicit version tags (e.g., :4.4.0) are also safe; only :stable (and :latest) are dangerous because they are mutable.
• Since there is no Dockerfile and no build, setting dockerfileName: null in the app config is the correct approach.

The Correct Serving Path: /gtm.js (NOT /load)

The server only serves the default /gtm.js path. Custom paths like /load WILL NOT work (returning a 400/Not Found error). In your GTM "Web Container" client, it doesn't matter if you fill the Tag serving path with /load or leave it empty—it won't affect anything, as the server will always use the default /gtm.js.

The first-party URL used by your site (via GTM4WP):
https://services.example.com/gtm.js?id=GTM-XXXXXXX
(The ?id= parameter is MANDATORY; without it, you will get an error, which is completely normal).

---

1) Check & Fix Server Roles (If your first-party /gtm.js isn't working)

Check the environment variables for both apps:

cloudron env list --app services.example.com
cloudron env list --app service.example.com

PRODUCTION (services) MUST HAVE:

• CONTAINER_CONFIG = (your configuration string)
• PREVIEW_SERVER_URL = https://service.example.com
• NO RUN_AS_PREVIEW_SERVER variable

If your services app was accidentally set as preview, fix it:

cloudron env unset --app services.example.com RUN_AS_PREVIEW_SERVER
cloudron env set   --app services.example.com PREVIEW_SERVER_URL='https://service.example.com'
cloudron restart   --app services.example.com

PREVIEW (service) MUST HAVE:

• CONTAINER_CONFIG = (your configuration string)
• RUN_AS_PREVIEW_SERVER = true

Test it: Visit https://services.example.com/gtm.js?id=GTM-XXXXXXX -> It should output JavaScript code.

NOTE: CONTAINER_CONFIG and sensitive tokens are NOT stored in this repository. Always set them via cloudron env set, keeping them out of Git.

---

2) Updating the Image to the Latest Version

Because the image is pinned via dockerImage (not a Dockerfile build), updating simply means changing the image reference in CloudronManifest.json and deploying. You DO NOT need --no-cache, and there is no Dockerfile to edit.

Steps:

1. Find the latest version & digest:

   • Go to Google Cloud > Artifact Registry > package gtm-cloud-image (project cloud-tagging-10302018, repo gcr.io), and open the Overview tab.
   • Look at the Tags: find the latest version (e.g., 4.5.0). Copy the "Digest" value (sha256:...) from the version that also holds the stable tag.
   • Alternative: Check Google's server-side release notes for version numbers.

2. Edit CloudronManifest.json:

   • Increase the version (e.g., 1.0.3 -> 1.0.4) — MUST be increased with every update.
   • Change dockerImage to the new digest:
     "gcr.io/cloud-tagging-10302018/gtm-cloud-image@sha256:<NEW_DIGEST>"
     (If you prefer readability, you can use the version tag: ...gtm-cloud-image:4.5.0)

3. Commit & push to your Git repository.

4. Deploy BOTH apps from the repo folder (from any machine with the Cloudron CLI installed):

   git clone https://git.example.com/username/sgtm-cloudron.git   # first time only
   cd sgtm-cloudron
   git pull                                                       # if already cloned
   cloudron update --app services.example.com                     # PRODUCTION
   cloudron update --app service.example.com                      # PREVIEW
   

   Cloudron will read the dockerImage from the local manifest and pull that image directly. A different digest equals a different image, guaranteeing a fresh pull.

Quick Alternative without editing the manifest (Ad-hoc):
This is valid but leaves your repo out-of-sync with what's actually running. If you use this, please update your manifest afterward!

cloudron update --app services.example.com --image gcr.io/cloud-tagging-10302018/gtm-cloud-image@sha256:<DIGEST>
cloudron update --app service.example.com  --image gcr.io/cloud-tagging-10302018/gtm-cloud-image@sha256:<DIGEST>

Verification:

• https://services.example.com/healthz -> Should return OK
• https://services.example.com/gtm.js?id=GTM-XXXXXXX -> Should still return JS code
• GTM > Admin > Container Settings -> Version number should increase.
  • Note: This number is REPORTED via usage beacons triggered by traffic and can be DELAYED up to 24 hours. The preview server rarely gets traffic, so it reports the slowest, and GTM tends to display the oldest version between the two servers. To confirm quickly without waiting: run Preview mode + send a few new requests from the web container, then check the Console (the outdated version warning should disappear).

Update downtime is just a few seconds and WILL NOT affect your site.

---

3) Update Cadence (Security)

The image consists of Node.js + libraries. Google releases periodic security patches. Because this is self-hosted, keeping it updated is your responsibility.

• Update quarterly.
• Update when a version warning appears in the GTM Console.
• Update when a major release drops.
  Just repeat the steps in Section 2.

Note: The enableAutomaticUpdate feature in Cloudron DOES NOT pull new Google versions on its own—it's only for package versions we publish. Google version updates are always manual via Section 2.

---

4) Files in this Repository

• CloudronManifest.json: App metadata + pinned image via dockerImage (digest). This is the SOURCE OF TRUTH for the running version.
• README.md: This file.

If I use this MCP, can I update several apps in just one-command?

@james hmm here's the line.

The memory server usage is mostly full, report from VPS Panel.

But on Cloudron panel, it has more space.

Hi, I just noticed that there's discrepancy report between memory usage on the Cloudron vs VPS Panel.

This is the memory usage report from Cloudron:

And this is from my VPS panel:

Is it something normal or unusual?
Thank you.

@girish I'd like to ask regarding this feature.

• Could we enable the VPN to protect my.cloudron.app?
• Is it possible to make custom rules? I mean if I want to protect WP-login.php and WP-admin, but I need to exclude this file /wp-admin/admin-ajax.php.

Thank you for making awesome feature!

@ikalou what should we do if the package is gone from the Cloudron supported apps? Could we still update it manually?

James, I found the solution. I forget to add {} before and after the variable, that makes my config.json error. Now, it's solved.

{
  "signups_allowed": false,
  "invitations_allowed": true,
}

@james said:

/app/pkg/start.sh

Thank you James for your help but I still can't save the config.json.

Here's the terminal output when I run this command /app/pkg/start.sh

root@731a2:/app/data# /app/pkg/start.sh
=> Exporting env vars expected by Vaultwarden
jq: error (at <stdin>:1): Cannot index string with string "domain"
jq: parse error: Expected string key before ':' at line 1, column 20
=> Generating new admin token
=> Starting Bitwarden
/--------------------------------------------------------------------\
|                        Starting Vaultwarden                        |
|--------------------------------------------------------------------|
| This is an *unofficial* Bitwarden implementation, DO NOT use the   |
| official channels to report bugs/features, regardless of client.   |
| Send usage/configuration questions or feature requests to:         |
|   https://github.com/dani-garcia/vaultwarden/discussions or        |
|   https://vaultwarden.discourse.group/                             |
| Report suspected bugs/issues in the software itself at:            |
|   https://github.com/dani-garcia/vaultwarden/issues/new            |
\--------------------------------------------------------------------/

[INFO] Using saved config from `/app/data/config.json` for configuration.

[2026-05-12 12:31:05.199][vaultwarden][ERROR] Web vault is not found at 'web-vault/'. To install it, please follow the steps in: 
[2026-05-12 12:31:05.199][vaultwarden][ERROR] https://github.com/dani-garcia/vaultwarden/wiki/Building-binary#install-the-web-vault
[2026-05-12 12:31:05.199][vaultwarden][ERROR] You can also set the environment variable 'WEB_VAULT_ENABLED=false' to disable it

I just updated the Vaultwarden to 1.25.0 and finding something unusual.

If I add new custom variables on /app/data/config.json and restart the app.

The configuration is gone, I just want to disable registration, and follow this instruction >> https://docs.cloudron.io/packages/vaultwarden/#disable-registration

  "signups_allowed": false,
  "invitations_allowed": true,

Do you face the same problem? For adding more context, my admin page is disabled.

Thank you
Regards

@james I think this post worth to add on our documentation.

If I am not mistaken, we can install outside GCP. I found tutorial on YouTube.

He installed sGTM on DigitalOcean

But I don't know how to implement it on Cloudron environment.

@robi Yes, I've tested the rclone before that's why I suggest this feature on Cloudron.

I don't know the technical requirement on that, maybe what James said it's more a cloud file storage not for the server backup.

Thank you Robi and James

I’m looking to learn and set up server-side tracking, specifically server-side Google Tag Manager (sGTM).

Right now my setup is the “standard” web-based Google Tag Manager container, and I’m trying to understand how to migrate what I currently have to a server-side approach.

Has anyone here successfully deployed sGTM on Cloudron and is willing to share their experience?

I’m particularly interested because Meta Conversion API (CAPI) seems more robust than relying only on the Meta Pixel, especially with browser privacy changes and ad blockers.

Thank you
Regards

Hi,

I have a Google Drive account with several hundred GB of storage.

Does Cloudron’s backup feature support using Google Drive or OneDrive accounts as backup destinations (as additional backup options)?

I hope this feature could be useful for Cloudron users.

Thank you.
Best regards

Hi,

I’d like to suggest adding quick action buttons directly on each app tile/row in the My Apps page (both grid view and list view) so admins can act faster without opening the app details page.

Idea:

• Show a small set of context-aware actions on each app:
  • Start / Stop / Restart
  • Retry task (when a task failed / app is in error state)
  • (Optional) quick links like Logs / Terminal in a “…” menu
• Actions should be state-dependent (e.g., only show Start when stopped, Retry only when applicable).

Why this helps

• Saves a lot of clicks when managing multiple apps (maintenance, incident response, batch operations).
• Makes the dashboard feel more “at a glance” and operational.

I just created dummy button using Claude AI, here are the samples:

Grid view:

List View

Thank you
Regards

@LoudLemur said:

@IniBudi I am not sure, but according to Grok:

"you've got a classic volumetric DDoS (the kind that floods bandwidth with junk traffic like UDP floods or SYN floods) that chewed through 1TB and knocked your server offline. Cloudflare free + Hetzner/Netcup anti-DDoS is a solid starter setup, but it's getting bypassed or overwhelmed because:Most attacks hit your VPS's real IP directly (bypassing Cloudflare unless everything is perfectly proxied).
Hetzner's protection (Arbor/Juniper-based) is automated but often slow to kick in or just null-routes your IP (blackholes the whole server to protect their network). Netcup's 2 Tbps filter is better but still leaks big attacks or causes brief downtime.
Cloudflare free is unmetered and excellent for web traffic routed through it (absorbs massive attacks at the edge), but it only helps if traffic never reaches your VPS.

The 1TB bandwidth bill/spike proves the attack was hitting your origin directly.Immediate Effective Fixes (Do These Right Now — Mostly Free)Force everything through Cloudflare
In Cloudflare DNS, make ALL records Proxied (orange cloud icon). No A/AAAA records pointing directly to your VPS IP. This routes attacks to Cloudflare's global network first.
Lock your VPS firewall to Cloudflare IPs only (this is the #1 game-changer)
Block everything except Cloudflare's published IP ranges. This stops 99% of direct IP attacks. Hetzner: Use their Cloud Firewall (or iptables).
Netcup: Same with ufw/iptables.
Cloudflare publishes the list here: cloudflare.com/ips (update it automatically via their API — there's a simple cron script for this).
Result: Attack traffic dies at Cloudflare; your VPS barely sees clean traffic.

Activate Cloudflare's emergency mode Turn on "I'm Under Attack" mode (Security → Overview).
Enable Bot Fight Mode + managed WAF rules + rate limiting (free tier has these).
Set Security Level to "High" or "I'm Under Attack".
This challenges suspicious traffic with JS/captchas before it even reaches your server.

Extra quick wins Use Cloudflare Tunnel (cloudflared) if possible — runs on your VPS and proxies traffic without exposing any ports publicly. Zero public IP exposure.
On the server: iptables rate limiting + fail2ban for extra layers.
Contact your VPS support immediately — they can sometimes manually tune mitigation.

These steps alone usually stop the bandwidth massacre because Cloudflare absorbs the junk at their edge (they've mitigated 11+ Tbps attacks).The Strongest Solutions (Ranked by Effectiveness vs Cost)Here's what actually survives big attacks in 2026:Best affordable strong solution: Switch VPS to OVHcloud + keep Cloudflare free/Pro
OVH has the strongest built-in, always-on DDoS protection in the budget VPS world (unlimited, multi-Tbps scrubbing centers, rarely null-routes, works great for L3/L4 volumetric). Users consistently report it handles attacks that destroy Hetzner/Netcup. Pair it with Cloudflare for L7 (web) protection and you're basically bulletproof for most attacks. Migration is straightforward (snapshot your server, spin up OVH VPS, point DNS). This is the combo I recommend for 90% of people in your spot.
Specialized DDoS-protected hosting DDoS-Guard (or similar like PATH.net / Evolution Host): Purpose-built for heavy volumetric attacks. Offers protected VPS or proxy services with fixed pricing and excellent filtering. Great if you want to stay cheap but stronger than Hetzner/Netcup.
BuyVM: Super cheap add-on protection (handles 700M+ pps).

Upgrade Cloudflare only (if you love your current VPS)
Go Pro ($20/mo) for advanced WAF, better rate limiting, and more rules. Still use the firewall lockdown above. For non-HTTP/UDP (games, APIs, etc.), you'll eventually need Cloudflare Spectrum (paid) or a dedicated L4 protector.
Enterprise-level (if budget allows and attacks are constant)
Cloudflare Magic Transit (BGP routing) + your VPS, or Akamai/Imperva. These are what big sites use — full network scrubbing.

Quick Reality CheckIf your server is a website/API (HTTP/HTTPS), the Cloudflare + firewall lockdown + OVH combo will solve 95% of cases for very low cost.
If it's a game server, UDP-heavy service, or Minecraft/etc., prioritize a host with native L4 protection (OVH or specialized like TCPShield) — Cloudflare free alone won't proxy those ports easily.The core principle for any strong solution: You need high-capacity upstream scrubbing so the 1TB flood never reaches your VPS bandwidth/CPU.Do the immediate firewall + proxy steps first — that often fixes it instantly without spending anything. If you tell me exactly what your server runs (website? game? API? ports?), attack type (from CF analytics), or your budget, I can give exact config commands/scripts or migration steps.

"

I already created inbound traffic firewall only accept Cloudflare IPs. Unfortunately, my server is still down.

I don't know why the attacker is targeting my website, the content only talks about Digital Marketing, SEO, etc.

Hmm, I am still searching alternative solution because I just use Cloudflare Free and cheap VPS.

Thank you for sharing @loudlemur

@loudlemur hmm my server's just hit by DDoS and it consumed 1TB bandwidth. If we only use Cloudflare free and VPS that has anti DDoS feature (like Hetzner or Netcup) but the server still down. Is there effective way to mitigate this situation?

@nebulon I think because of storage problem, but it's already fixed. Thank you Nebulon and Robi.

@robi no brother, but it solved when I restored to the latest backup. And I don't why it can run smoothly.

Hi everyone,

I’d like to ask about a LAMP app that won’t start and always shows “Not responding.”

This started when my server storage became full. I have since upgraded the storage, and I later realized the backups were being stored on the local server.

After that, one of my LAMP apps still wouldn’t run and kept showing “Not responding.”

I then deleted the backup files from the local server. However, even though the storage is no longer full, the app still won’t start.

This is cloudron-troubshoot information:

Vendor: QEMU Product: Standard PC (i440FX + PIIX, 1996)
Linux: 6.8.0-106-generic
Ubuntu: noble 24.04
Execution environment: kvm
Processor: AMD EPYC 9654 96-Core Processor
BIOS pc-i440fx-10.1  CPU @ 2.0GHz x 3
RAM: 8131136KB
Disk: /dev/vda1        15G
[OK]    node version is correct
[OK]    IPv6 is enabled in kernel. No public IPv6 address
[OK]    docker is running
[OK]    docker version is correct
[OK]    MySQL is running
[OK]    netplan is good
[OK]    DNS is resolving via systemd-resolved
[OK]    unbound is running
[OK]    nginx is running
[OK]    dashboard cert is valid
[OK]    dashboard is reachable via loopback
[FAIL]  Database migrations are pending. Last migration in DB: /20260217120000-mailPasswords-create-table.js. Last migration file: /package.json.
        Please run 'cloudron-support --apply-db-migrations' to apply the migrations.
[OK]    Service 'mysql' is running and healthy
[OK]    Service 'postgresql' is running and healthy
[OK]    Service 'mongodb' is running and healthy
[OK]    Service 'mail' is running and healthy
[OK]    Service 'graphite' is running and healthy
[OK]    Service 'sftp' is running and healthy
[OK]    box v9.1.3 is running
[OK]    Dashboard is reachable via domain name

Any idea what might be causing this? This is the first time I’ve run into this issue.

Thanks in advance.