Cloudron Forum

updated the screenshots in the original post to better show what it is now

great ux and community version capabilities imho

@girish cloudron-netbird-app seems to be working nicely, now

any chance of making it a recognised app option for the vpn-protection features now in cloudron?

https://github.com/marcusquinn/cloudron-netbird-app/issues/149

cloudron SSO should be working now, available for testing in the latest release

and got a new session working on syncing users with app visibility permissions, and seeing if we can integrate this with the new cloudron vpn protection features as a potentially easier way to give users vpn gated access to private wan apps

@braginini take a look at the latest version of the cloudron-netbird-app package — might help you get more people trying and adopting it (and hopefully nullifying all the tailscale-only options i see, that i was aggrieved enough with to work on this

fan of your work, very impressive ux!

@timconsidine and the approach might open up similar being possible for other cloudron apps needing tls passthrough

@timconsidine credit to you for the idea, sir!

in my quick tests it seemed to work fine, serving a page from a mac mini.

there should be enough .md info in the package to help any AI understand it all to help with setup and testing

as always, aidevops.sh has subagents for cloudron app packaging, netbird setup and use, etc

An update on the NetBird Cloudron package—the single-VPS reverse-proxy candidate is now merged and available to build from source:
https://github.com/marcusquinn/cloudron-netbird-app

• One Cloudron app packages NetBird management, dashboard, embedded login, native client transport and relay/STUN. Ordinary private mesh access does not need a second IP or the optional public proxy.
• The 2.1.0 candidate adds the optional NetBird reverse proxy inside that same app. This exposes selected HTTP services on mesh peers through public HTTPS, without requiring visitors to install NetBird.
• The single-VPS setup requires a second public IPv4 and documented root-admin host configuration. No second VPS or replacement of Cloudron’s managed nginx is required. This is an opt-in administrator-managed integration, not a built-in Cloudron feature.
• A controlled live deployment has exercised native peer registration, public ACME TLS, traffic to a remote WireGuard peer, header authentication and forwarded-IP spoof rejection.
• The latest integrated source passes local build/runtime checks covering initial setup, restart persistence, unprivileged services, native-port browser redirects and native OAuth continuity. Host-ingress tests include port-collision rejection and fail-closed checks.
• Setup, rollback and qualification documentation are included. The proxy is disabled by default, and its public ingress does not automatically inherit Cloudron’s normal HTTP protections.
• This is ready for experienced source-build testers, not a production-certification or App Store announcement. Full restore, renewal, reboot/platform upgrade and broader isolation/load qualification remain open. Optional Cloudron SSO onboarding is a separate follow-up.
• Feedback on fresh installations, desktop/mobile clients, custom ports and the documented single-VPS setup would be useful. Please use an isolated test environment and retain recovery access before changing host networking.
  Implementation and verification details:
  https://github.com/marcusquinn/cloudron-netbird-app/pull/141

@timconsidine clever, i like the thinking! investigating...

AI's reply. Not tested, but seems good:

@timconsidine @sponch thanks for investigating and documenting the transport issue.

I’ve now published v2.0.16, which adopts the dedicated native-client transport model:

• Dashboard, API and OIDC remain on normal Cloudron HTTPS/443.
• NetBird management, signal and relay traffic use a dedicated TLS/HTTP2 TCP port.
• The default external port is 33073, but use whichever TCP port is configured in Cloudron.

Client example:

sudo netbird up
--management-url https://netbird.example.com:33073
--setup-key YOUR_SETUP_KEY

The selected TCP port must be reachable through the server firewall. NetBird’s own configurable UDP STUN port is also retained. I did not use Cloudron’s TURN addon because its relay credential model is incompatible with NetBird’s built-in relay.

Internally, the native listener maps to container port 33074, because current NetBird releases reserve 33073 for their legacy gRPC listener.

Reverse Proxy clusters are still not included. That feature requires raw TLS passthrough on public port 443, which Cloudron does not currently provide per app. The dedicated client port fixes peer registration but does not remove that separate platform constraint.

Release: https://github.com/marcusquinn/cloudron-netbird-app/releases/tag/v2.0.16
Community app: https://ca.cloudron.io/app/netbird

Local runtime tests passed first-run setup, TLS validation, HTTP/2 negotiation, restart and persistence checks. I still need confirmation from a real Cloudron installation, so please let me know whether a native client now registers successfully.

@sponch Can you try again from the latest release, please?

@timconsidine latest release should work. Let me know if now. I'll get notifications for any new issues now.

@timconsidine sorry, forgot to star my own repo to get notifications — looking now — should be a quick fix & release with you soon...

We're pretty-much now in the age of: "I'll have my AI speak to your AI, and TLDR me the results."

Wild times.

@RoundHouse1924 Nice find, and good inspiration for how to create and maintain a fork. Thanks for the share.

probably the right decision, given what it does is all moving into markdown files as ai agents

@alexsam maybe also of interest:

• https://forum.cloudron.io/topic/15724/buzz-private-open-source-slack-teams-discord-alternative-using-encrypted-nostr-relays-and-ai-agents

i packaged the relay so you can self-host:

• https://ca.cloudron.io/app/buzz

the db isn't encrypted, but if you encrypt your relay server and self-host that (not in a data centre) that should be pretty good for privacy and teamwork

@sponch Can you post issues to the github repo and any relevant info, please? My systems will pick them up, review, and patch. Sorry, I can maintain it, but rely on other user feedback in case there's things my setup solved but don't work yet for others.

If I can recommend a look, too, at my main ai harness invention: https://aidevops.sh, because it's really good at diagnosing issues and logging them to the git repo for then solving.

@necrevistonnezr "money" is just a test score for your ability to create and preserve the value of goodwill. Many will fail that, and that's OK. They can take keep taking the tests gain until they figure it all out, or die trying.

• https://x.com/jimmysong/status/2084798666616009103?s=20

@LoudLemur nice, don't think ca.cloudron.io can track use stats to see which are popular enough to promote to official?

I've only packaged and shared three: netbird, aidevops, and buzz — managed to automate those updates now, just once a day, so trusting the app updates themselves to remain good, but using myself, so should notice any issues quickly.

@scooke I believe just a private sync service / relay, for if you don't trust theirs.