just had the same issue and wanted to add something here as a documentation:

If both Grafana and Prometheus are running as a cloudron-app, you can add Prometheus as a data-source in Grafana by inputting http://<PROMETHEUS-SERVICE-UUID>:9090 in the URL-field where PROMETHEUS-SERVICE-UUID can be found form the prometheus container either by looking up its installation location in the Storage-Tab or by connecting via terminal and copying the hostname.

Cheers,
Jan

@girish since it worked with my other NAS, I am pretty confident now that it is rather a Permission-Issue on the TrueNAS-Side which I dont understand well enough as of yet.

Thanks for the link!

@girish as a quick fix this would help aslong as the contents still are encrypted

@DanTheMan did you have success? Trying to do the same thing now. My approach will be:

1. Set up a Container with Authelia (cloud also be a VM) in my private network alongside the Cloudron VM as in the same sub-net or vLAN
2. Adapt Authelias Config accordingly, I want it to utilize a LDAP Backend and for starters integrating the one that Cloudron offers.
3. Let Cloudron do the Cert-handling and expose Authelia via Cloudron-App-Proxy
4. Adapt the Nginx-Config for the Cloudron Apps, I want to protect to require the SSO flow Authelia offers.

How did you approach the issue? Did you do things differently?

@girish any news on this? As in Europe we currently have this ongoing war between Ukrain and Russia with a hight amount of cyber-attacks in circulation, it would be great to bump up the available security measures as much as possible

If you would be going to create a tunable security-setting here, it would also be really great if you could give the option to select which TLS-Versions should be supported and maybe set a sensible default to support 1.1, 1.2 and 1.3.

Also, do you know if Cloudron uses a Version of NGINX that already supports QUIC protocol rather than TCP to transport HTTP?

Would also be glad to lend a hand if you need support with getting this to work.

@fbartels is there a way to easily or "automatically" track all installed cloudron apps with Prometheus? As in: Do Cloudron-Apps come with a node_exporter installed and configured?

If not is there a best practice to start connecting Cloudron-Apps metrics into Prometheus?

Thanks and best Regard,
Jan

Unfortunately I am experiencing the same bug currently... having a backup of my metrics would be kind of important to me.

@BrutalBirdie any know work-a-rounds?

@DanTheMan did you have success? Trying to do the same thing now. My approach will be:

1. Set up a Container with Authelia (cloud also be a VM) in my private network alongside the Cloudron VM as in the same sub-net or vLAN
2. Adapt Authelias Config accordingly, I want it to utilize a LDAP Backend and for starters integrating the one that Cloudron offers.
3. Let Cloudron do the Cert-handling and expose Authelia via Cloudron-App-Proxy
4. Adapt the Nginx-Config for the Cloudron Apps, I want to protect to require the SSO flow Authelia offers.

How did you approach the issue? Did you do things differently?

@girish any news on this? As in Europe we currently have this ongoing war between Ukrain and Russia with a hight amount of cyber-attacks in circulation, it would be great to bump up the available security measures as much as possible

If you would be going to create a tunable security-setting here, it would also be really great if you could give the option to select which TLS-Versions should be supported and maybe set a sensible default to support 1.1, 1.2 and 1.3.

Also, do you know if Cloudron uses a Version of NGINX that already supports QUIC protocol rather than TCP to transport HTTP?

Would also be glad to lend a hand if you need support with getting this to work.

Unfortunately I am experiencing the same bug currently... having a backup of my metrics would be kind of important to me.

@BrutalBirdie any know work-a-rounds?

@girish since it worked with my other NAS, I am pretty confident now that it is rather a Permission-Issue on the TrueNAS-Side which I dont understand well enough as of yet.

Thanks for the link!

Blocking /metrics and /health endpoints for Apps by default

I'd also like to track Jellyfin which I love to run as an cloudron App. It comes with pre installed Prometheus endpoint according to the documentation which I'd like to use. The default Cloudron-location for this file is /app/data/jellyfin/config/system.xml
However I dont want to expose this endpoint to the public Internet. Any Ideas how I could prevent this?

If we find a good solution, I think it would be best to have the /metrics and /health endpoints blocked by default because Cloudron-Admins most likely dont want to expose these to the Internet anyway.

@girish would you have an Idea where I could apply such a config change?

Best regards and thanks for the answer in advance

PS: Will gladly contribute to the Documentation as we found a good solution. I just fell down the rabbit hole to a certain degree in advancing my home-lab more towards a real data-center

@girish said in Permission issues using mounts for app data storage:

@Jan-Macenka for permission related issues, I had created https://docs.cloudron.io/volumes/#sharing perviously. Can you check that section ?

Thanks for the quick answer. Will look into the suggested work-around tomorrow!

@fbartels is there a way to easily or "automatically" track all installed cloudron apps with Prometheus? As in: Do Cloudron-Apps come with a node_exporter installed and configured?

If not is there a best practice to start connecting Cloudron-Apps metrics into Prometheus?

Thanks and best Regard,
Jan

Having a similar issue right now and would need help getting my setup to work.

My Setup:

Everything is running on my physical Server with 2xSSD and 1x NVMe.

Proxmox as Virtualzation pattform running "bare-metal" on the Server taking the NVMe Disk.

1x VM operating TrueNAS as a virtualized NAS wich recieves the 2xSSDs as pass-through and serves these out via NFS + SMB (CIFS), Intention is that the NAS is accessable as such in my Home-Network and can also hold the "slower" kind of data of the Cloudron-Space.

1x VM operating Cloudron, my intention is to have NextCloud inside Cloudron and mount the "Networkshares" to have the data there.
Have declared the Networkshares as Shares directly in Cloudron and am able to move the data-partitions of some other Apps (not NextCloud) over there.

For the NextCloud-App, I mounted the Data-Networkshare as a volume to the app, so its visible under /media/myNASdataShare but "obviously" its owned by rootand not yellowtent or www-data. Inside the NextCloud App, I can declare it as an External-Storage of type local, can see alt he data and can read from it but can not manipulate these. I was wondering wether this was due to a root_squash flag inside Cloudron for the mount but then it should not be possible to move other App-Data to the NFS-Share.

Maybe there is something similar happening inside the NextCloud-App-Container.

My goal:
Being able to use (read/write) the NFS-Shares which are properly configured to be consumed by other clients inside NextCloud.

Any Ideas on what I could do or where I should look?

Thanks in advance for your support!

just had the same issue and wanted to add something here as a documentation:

If both Grafana and Prometheus are running as a cloudron-app, you can add Prometheus as a data-source in Grafana by inputting http://<PROMETHEUS-SERVICE-UUID>:9090 in the URL-field where PROMETHEUS-SERVICE-UUID can be found form the prometheus container either by looking up its installation location in the Storage-Tab or by connecting via terminal and copying the hostname.

Cheers,
Jan

having the same problem currently, where can i find the containers UUID?