Cloudron Forum

Hi,

I’d like to suggest adding quick action buttons directly on each app tile/row in the My Apps page (both grid view and list view) so admins can act faster without opening the app details page.

Idea:

• Show a small set of context-aware actions on each app:
  • Start / Stop / Restart
  • Retry task (when a task failed / app is in error state)
  • (Optional) quick links like Logs / Terminal in a “…” menu
• Actions should be state-dependent (e.g., only show Start when stopped, Retry only when applicable).

Why this helps

• Saves a lot of clicks when managing multiple apps (maintenance, incident response, batch operations).
• Makes the dashboard feel more “at a glance” and operational.

I just created dummy button using Claude AI, here are the samples:

Grid view:

List View

Thank you
Regards

@LoudLemur said:

@IniBudi I am not sure, but according to Grok:

"you've got a classic volumetric DDoS (the kind that floods bandwidth with junk traffic like UDP floods or SYN floods) that chewed through 1TB and knocked your server offline. Cloudflare free + Hetzner/Netcup anti-DDoS is a solid starter setup, but it's getting bypassed or overwhelmed because:Most attacks hit your VPS's real IP directly (bypassing Cloudflare unless everything is perfectly proxied).
Hetzner's protection (Arbor/Juniper-based) is automated but often slow to kick in or just null-routes your IP (blackholes the whole server to protect their network). Netcup's 2 Tbps filter is better but still leaks big attacks or causes brief downtime.
Cloudflare free is unmetered and excellent for web traffic routed through it (absorbs massive attacks at the edge), but it only helps if traffic never reaches your VPS.

The 1TB bandwidth bill/spike proves the attack was hitting your origin directly.Immediate Effective Fixes (Do These Right Now — Mostly Free)Force everything through Cloudflare
In Cloudflare DNS, make ALL records Proxied (orange cloud icon). No A/AAAA records pointing directly to your VPS IP. This routes attacks to Cloudflare's global network first.
Lock your VPS firewall to Cloudflare IPs only (this is the #1 game-changer)
Block everything except Cloudflare's published IP ranges. This stops 99% of direct IP attacks. Hetzner: Use their Cloud Firewall (or iptables).
Netcup: Same with ufw/iptables.
Cloudflare publishes the list here: cloudflare.com/ips (update it automatically via their API — there's a simple cron script for this).
Result: Attack traffic dies at Cloudflare; your VPS barely sees clean traffic.

Activate Cloudflare's emergency mode Turn on "I'm Under Attack" mode (Security → Overview).
Enable Bot Fight Mode + managed WAF rules + rate limiting (free tier has these).
Set Security Level to "High" or "I'm Under Attack".
This challenges suspicious traffic with JS/captchas before it even reaches your server.

Extra quick wins Use Cloudflare Tunnel (cloudflared) if possible — runs on your VPS and proxies traffic without exposing any ports publicly. Zero public IP exposure.
On the server: iptables rate limiting + fail2ban for extra layers.
Contact your VPS support immediately — they can sometimes manually tune mitigation.

These steps alone usually stop the bandwidth massacre because Cloudflare absorbs the junk at their edge (they've mitigated 11+ Tbps attacks).The Strongest Solutions (Ranked by Effectiveness vs Cost)Here's what actually survives big attacks in 2026:Best affordable strong solution: Switch VPS to OVHcloud + keep Cloudflare free/Pro
OVH has the strongest built-in, always-on DDoS protection in the budget VPS world (unlimited, multi-Tbps scrubbing centers, rarely null-routes, works great for L3/L4 volumetric). Users consistently report it handles attacks that destroy Hetzner/Netcup. Pair it with Cloudflare for L7 (web) protection and you're basically bulletproof for most attacks. Migration is straightforward (snapshot your server, spin up OVH VPS, point DNS). This is the combo I recommend for 90% of people in your spot.
Specialized DDoS-protected hosting DDoS-Guard (or similar like PATH.net / Evolution Host): Purpose-built for heavy volumetric attacks. Offers protected VPS or proxy services with fixed pricing and excellent filtering. Great if you want to stay cheap but stronger than Hetzner/Netcup.
BuyVM: Super cheap add-on protection (handles 700M+ pps).

Upgrade Cloudflare only (if you love your current VPS)
Go Pro ($20/mo) for advanced WAF, better rate limiting, and more rules. Still use the firewall lockdown above. For non-HTTP/UDP (games, APIs, etc.), you'll eventually need Cloudflare Spectrum (paid) or a dedicated L4 protector.
Enterprise-level (if budget allows and attacks are constant)
Cloudflare Magic Transit (BGP routing) + your VPS, or Akamai/Imperva. These are what big sites use — full network scrubbing.

Quick Reality CheckIf your server is a website/API (HTTP/HTTPS), the Cloudflare + firewall lockdown + OVH combo will solve 95% of cases for very low cost.
If it's a game server, UDP-heavy service, or Minecraft/etc., prioritize a host with native L4 protection (OVH or specialized like TCPShield) — Cloudflare free alone won't proxy those ports easily.The core principle for any strong solution: You need high-capacity upstream scrubbing so the 1TB flood never reaches your VPS bandwidth/CPU.Do the immediate firewall + proxy steps first — that often fixes it instantly without spending anything. If you tell me exactly what your server runs (website? game? API? ports?), attack type (from CF analytics), or your budget, I can give exact config commands/scripts or migration steps.

"

I already created inbound traffic firewall only accept Cloudflare IPs. Unfortunately, my server is still down.

I don't know why the attacker is targeting my website, the content only talks about Digital Marketing, SEO, etc.

Hmm, I am still searching alternative solution because I just use Cloudflare Free and cheap VPS.

Thank you for sharing @loudlemur

@loudlemur hmm my server's just hit by DDoS and it consumed 1TB bandwidth. If we only use Cloudflare free and VPS that has anti DDoS feature (like Hetzner or Netcup) but the server still down. Is there effective way to mitigate this situation?

@nebulon I think because of storage problem, but it's already fixed. Thank you Nebulon and Robi.

@robi no brother, but it solved when I restored to the latest backup. And I don't why it can run smoothly.

Hi everyone,

I’d like to ask about a LAMP app that won’t start and always shows “Not responding.”

This started when my server storage became full. I have since upgraded the storage, and I later realized the backups were being stored on the local server.

After that, one of my LAMP apps still wouldn’t run and kept showing “Not responding.”

I then deleted the backup files from the local server. However, even though the storage is no longer full, the app still won’t start.

This is cloudron-troubshoot information:

Vendor: QEMU Product: Standard PC (i440FX + PIIX, 1996)
Linux: 6.8.0-106-generic
Ubuntu: noble 24.04
Execution environment: kvm
Processor: AMD EPYC 9654 96-Core Processor
BIOS pc-i440fx-10.1  CPU @ 2.0GHz x 3
RAM: 8131136KB
Disk: /dev/vda1        15G
[OK]    node version is correct
[OK]    IPv6 is enabled in kernel. No public IPv6 address
[OK]    docker is running
[OK]    docker version is correct
[OK]    MySQL is running
[OK]    netplan is good
[OK]    DNS is resolving via systemd-resolved
[OK]    unbound is running
[OK]    nginx is running
[OK]    dashboard cert is valid
[OK]    dashboard is reachable via loopback
[FAIL]  Database migrations are pending. Last migration in DB: /20260217120000-mailPasswords-create-table.js. Last migration file: /package.json.
        Please run 'cloudron-support --apply-db-migrations' to apply the migrations.
[OK]    Service 'mysql' is running and healthy
[OK]    Service 'postgresql' is running and healthy
[OK]    Service 'mongodb' is running and healthy
[OK]    Service 'mail' is running and healthy
[OK]    Service 'graphite' is running and healthy
[OK]    Service 'sftp' is running and healthy
[OK]    box v9.1.3 is running
[OK]    Dashboard is reachable via domain name

Any idea what might be causing this? This is the first time I’ve run into this issue.

Thanks in advance.

I’m thinking the same as @robi.

I tried asking Google Gemini to propose a design that surfaces key actions like Start, Stop, Restart, and Retry Task.

Directly on the main page, so we don’t have to open the app just to access them.

Grid view:

List View:

I am not sure I may have found a bug in Cloudron version 9.1.0.

I previously used TOTP and then switched to Passkey. After that, in Login Tokens, I clicked “Log out from all.”

What happens is that after a short while, my account is prompted to set up the passkey again. This is now the second time I’ve had to set up a passkey.

Is this a known issue or a bug?

@timconsidine said in What's Your Antivirus Recommendation?:

@IniBudi said in What's Your Antivirus Recommendation?:

I got a new insight here. I don't recognize that Mac and iOS are better than Windows and Android in terms of malware infection.

Well Mac and iOS are not immune - best approach is AV is still needed - but I think it is fair to say that they are less targeted and more robust.

My 'ha ha ha' comment was not intended as gloating, but scepticism. Hope I did not give the wrong impression.

Thank you, yes I got your points.

I ask this question because I believe you and other members here are more experience and expert than me.

So every comments will be good insight for me non tech guys.

@timconsidine said in What's Your Antivirus Recommendation?:

@IniBudi I took Sophos as a personal but multi device plan. Years ago. Seems to have rolled on.

I use Mac and iOS so no viruses there (ha ha ha).
But I need to review.

Don’t generally use android but just got new tablet, so need to review for that.

Haha, thank you.

I got a new insight here. I don't recognize that Mac and iOS are better than Windows and Android in terms of malware infection.

One day, I need to switch to iOS. Currently, I'm using Windows 11 (office laptop), and my personal devices are Mac and Android.

@humptydumpty said in What's Your Antivirus Recommendation?:

@IniBudi said in What's Your Antivirus Recommendation?:

Bitdefender, Kaspersky, or Norton. WDYT?

It's all about resource usage as some will noticeably slow down your device. Avoid Norton at all costs. Bitdefender is good. Kaspersky is/has Russian ties. Eset was my favorite back in the day due to how lightweight it was and pricing fit my student budget. Malwarebytes free is what I use nowadays, but if you're looking for real-time protection then get one of their premium plans. If I wasn't tied to Windows due to my CAD software requirements, I would have switched to Linux or Mac. Like Tim, I also have an iPhone so I'm covered on that end. I don't use any AV on my CR servers. There are some discussions about this on the forum if you're interested.

Thank you for the recommendation and your valuable insight! I read these reports, and your statement is similar to these reports:

• https://www.av-comparatives.org/tests/summary-report-2025/
• https://www.av-test.org/en/antivirus/home-windows/
• https://www.av-test.org/en/antivirus/mobile-devices/

@necrevistonnezr said in What's Your Antivirus Recommendation?:

@humptydumpty said in What's Your Antivirus Recommendation?:

Kaspersky is/has Russian ties.

In Germany, you use it anymore in a business context due to the offical warning of the Federal Office for Information Security (BSI), as such use against a warning would not be considered "state of the art".
https://www.heise.de/en/news/BSI-Warning-against-Kaspersky-products-still-valid-after-US-sanctions-9777484.html

Ah, I see, it's not only about product benefit, but it's more than that, I mean, it's talking about compliance risk.

@timconsidine said in What's Your Antivirus Recommendation?:

I use Sophos, for my Mac desktop and laptop. I probably need to review this so I’m interested in others’ answers.

Sophos if I am not mistaken it's only for enterprise, right? What's your consideration using Sophos?

@robi said in What's Your Antivirus Recommendation?:

Eset when needed, mostly not necessary.

What's the OS that you're using? So, you don't need AV on smartphone and laptop?

@humptydumpty said in What's Your Antivirus Recommendation?:

Malwarebytes free on windows. It detected a sneaky and persistent cryptomining malware that windows security missed. You get the occasional notification ad to buy a subscription and a reminder that it hasn’t scanned recent downloaded files. Other than that, no complaints.

Yes, I also used Malwarebytes but I consider other AV like Bitdefender, Kaspersky, or Norton. WDYT?

Hi All,

I'd like to know your AV recommendation for Windows, Mac, iOS, or Android that you're currently using.

And what's the consideration using the AV vendor? And do you use AV for Cloudron server?

Thank you for your insight!

@fbartels thank you, it's good news

I’d like to ask about using Actual Budget. For example, let’s say I install the Actual Budget app on a subdomain.

I’ve enabled OpenID so that other Cloudron users on my server can access it.

My question is, if I wanna track finances together with my wife, is that possible?

I’d really appreciate any experiences from anyone here who has used Actual Budget or any other apps for shared financial tracking.

Thank you.
Regards.

Thank you @nebulon

@potemkin_ai is the script still relevant on the latest version of Cloudron?

Hi @timconsidine, thank you for your efforts in making CCAI. However, is there any tutorial video on how to install it and update the application if we use CCAI? So, the newbie like me can understand the whole process.

Hi @joseph, I just followed the Vaultwarden instructions to set up Cloudron OIDC.

Here is the reference:
https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect

• Set up SSO on Vaultwarden Admin Dashboard

• Create OpenID Clients
  Add your login callback URL

https://vaultwarden.example.tld/identity/connect/oidc-signin

• Make sure your email is the same as your user email on Cloudron.

Login you can log in using SSO.

@joseph I just tested, and now I can use the SSO login. Thank you @james and @vladimir.d

I came across Safeline through a Meta Ads. The ad was run by a web dev based in Indonesia who offers a course on how to secure WordPress websites against hacking.

After reviewing the course modules listed on the landing page, I noticed that Safeline was mentioned and that it can be integrated with Cloudflare.

This caught my interest, so I decided to do some research.

I then looked into third-party benchmarks and evaluations of Safeline’s protection capabilities and found the following articles:

• https://dev.to/carrie_luo1/the-6-best-web-application-firewalls-compared-2024-1d9l
• https://medium.com/@tvvzvpb186/which-open-source-waf-really-delivers-a-head-to-head-benchmark-37631e08fb7f

Based on the benchmark data presented in those articles, Safeline appears to perform well in blocking common web application attacks.

That said, this is purely based on third-party analysis. I have not personally used Safeline in a production environment yet.

I should also mention that I am not an IT developer or sysadmin by profession. My background is primarily in digital marketing, so I fully understand that many people in this forum have far deeper technical expertise than I do.

That said, I find Safeline interesting due to its feature set and open-source offering, which prompted me to explore it further and request the app here.