Cloudron Forum

@girish, fantastic fast response, thanks you a lot!!

Passkey support in Cloudron 10 works well for me: passwordless login with a Nitrokey, including the PIN prompt, works fine. Thanks!

What's missing for hardware keys: each user can only have one passkey and one TOTP (screenshot 1). With hardware keys you normally register at least two, one for daily use and a backup kept somewhere safe. Today, losing that one key means an admin has to reset 2FA.

Request:

• Multiple passkeys per user.

• A name per key (e.g. "Nitrokey office", "Nitrokey backup"), listed in the profile with date added / last used, and each removable on its own.

• After choosing "security key", a selector to pick the key would be great. If needed, I can provide a login flow from a service that does it nicely.

• Keep both login paths as they are: passwordless (FIDO2) with key + PIN, or username/password with TOTP or the key as second factor.

• Optional: accounts that use only a hardware/FIDO2 key and have no password at all. Is that possible? Would really be great.

• Optional: The login page is good, but a more prominent passkey/FIDO2-only option would be nice.

Somewhat related: https://forum.cloudron.io/topic/15932/login-with-totp-vs-passkey

Thanks!
Tim

@bazinga

@bazinga said:

One question: why did you guys opt for this VPN protection vs simply allowing users to define a white list of source IPs or domains from where the access would be allowed? Would be much simpler and not require the VPN hassle (no matter on an endpoint or a router).

Well, someone requested it ^^. If I remember correctly ++

Hi,

I’m trying to packaging an app that reverse-proxies uploads to a backend in real time (a tunnel/gateway app) to ease my setup. Cloudron’s nginx currently buffers the complete request body before passing it to the app (proxy_request_buffering on). For large uploads this means:

• clients see 100 % progress while the app hasn’t received any data yet,
• the whole body is written to the server disk first,
• the total upload time roughly doubles for streamed workloads.
• A manual test with proxy_request_buffering off; in the app’s vhost confirmed that streaming works as expected, but of course that change is overwritten whenever Cloudron regenerates the config.

Would it be possible to add a manifest option (for example "proxyRequestBuffering": false), or an admin setting per app, to disable request buffering for apps that need streaming uploads?

A related question: Cloudron replaces 502/503/504 responses from the app with its own appstatus.html page. Is there a way for an app to return its own error responses (for example JSON errors for API clients) instead?

Your's Tim, Thanks!

Thank you again for the last ten years. Means a lot.

Team Cloudron.io

Thank you for your service, I trust you and that means a lot to me

You may have a look, it's running quite smoothly for some days, this is not production ready just a try out.
https://github.com/TKaluza/open-wanderer_cloudron

Using komoot after some time, they triggered me a lot. The navigation turned bad, no gpx export of selfmade routes and big paywall.

The pattern is always the same. Bending Spoons acquires tech companies, continues to run the business from Milan, and retains no more than 25 percent of the workforce. In most cases, all employees are even laid off. PressArticle(German)

The github linked changed a bit to https://github.com/open-wanderer/wanderer

I just started using Jmap because of ThunderMail (not Thunderbird), but I really like that server.
@andreasdueren I think having an additional mail server app would be great, but the actual mail server is perfectly integrated into Cloudron itself. Nice find!

If this server becomes more stable (see the breaking changes when updating: https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_15.md), it could be a very nice drop-in replacement for the internal mail server as long as the licence (https://github.com/stalwartlabs/stalwart?tab=readme-ov-file#license) fits. However, reading the 'Enterprise' options (https://stalw.art/enterprise/), it may not be suitable because 'Multi-Tenant' is an 'Enterprise' feature.

If I find some time, I can do some tests and post the results here, but that's low priority.

@joseph said in Best Backup Technology + Small UI Wish for Separating Technologies vs. Providers:

@timka S3 is a pseudo-standard. Tthere is no spec for s3. AWS made a service and then lots of other services made compatible services by reverse engineering. Because of this, there are subtle differences in various implementations. The provider type is just a way for the code to add some provider specific hacks in the code. With that in mind "S3 API Compatible V4" just gets your the generic s3 protocol without any hacks I think it's complicated to document what the hacks are but it's all inside https://git.cloudron.io/platform/box/-/blob/master/src/storage/s3.js?ref_type=heads

Thank you very much for the information. I did not know it.

@joseph OK. But I have one question regarding S3: is 'Amazon S3' a preconfigured S3 API Compatible (v4) variant? Maybe you could add a note to the documentation. What is the difference between "Minio" and "S3 API Compatible V4", or are they the same?

As far as I understand, Seaweed's OSS policy is as follows: 'Free if less than 25 TB.' No licence needed. No hidden fees. No complex tiers.' And thats a downer.

In my opinion, Ceph makes much more sense when used in combination with the right hardware. I think this might be too much for a proper Minio replacement. I assume that many people just use an 'S3 compatible' setup and not a multi-node setup. Considering the Cloudron context, I don't think Ceph is the right choice.

Well, the development of RustFS is proceeding quite quickly (https://github.com/rustfs/rustfs/releases), but there is still no major version. It has the 'rust is better' vibe, but they also address typical deployments directly (single node, single disk, etc.). I'm testing it in other contexts and I like it, but I won't trust it until it has at least reached major version status.

GarageHQ has been around for a while and supports multi-node and single-node deployments. It has a nice Docker deployment and in there documentation is a good read for comparing S3 alternatives: https://garagehq.deuxfleurs.fr/documentation/reference-manual/s3-compatibility/.

@scooke just following the documentation for self development/deploy, it is still basically docker and there are good basic container to start from. I had a some more but moved to my local running TrueNas Scale and using OCID from cloudron.

Is there a technology you prefer for network-based deployments (where no physical/direct access to the server is possible)? For example, would you recommend SSHFS, S3-compatible storage, or something else for remote backup scenarios?
I would appreciate some personal opinions

Also, @girish regarding the backup setup: it might improve usability if the storage provider list were divided into technologies (self-hostable/generic protocols) and providers (cloud services). Perhaps a simple separator like --- could visually split the dropdown:

CIFS Mount
External/Local Disk (EXT4 or XFS)
EXT4 Disk
Filesystem
Filesystem (Mountpoint)
Minio
NFS Mount
S3 API Compatible (v4)
SSHFS Mount
XFS Disk
---
Amazon S3
Backblaze B2 (S3 API)
Cloudflare R2
Contabo Object Storage
DigitalOcean Spaces
Exoscale SOS
Google Cloud Storage
Hetzner Object Storage
IDrive e2
IONOS (Profitbricks)
Linode Object Storage
OVH Object Storage
Scaleway Object Storage
UpCloud Object Storage
Vultr Object Storage
Wasabi

@girish i wanted to the upgrade in christmas time but it auto updated without me noticing and downside. Thank's for your work!

---

• Title: OpenCloud - Secure, Simple & Reliable File Sharing

---

• Main Page: https://opencloud.eu
• Git: https://github.com/opencloud-eu/opencloud
• Licence: Apache-2.0
• Docker: Yes
• Demo: https://docs.opencloud.eu/docs/admin/getting-started/docker-compose/

---

• Summary:
  OpenCloud is an open‐source, self‐hosted file sharing solution that provides a secure and private way to store, access, and share files. Its backend is developed in Go while the web interface is built with Vue.js and TypeScript. Designed for both small deployments (even on a Raspberry Pi) and scalable to data centers, it supports collaboration features such as real‑time file sharing, flexible access controls, and various protocols (WebDAV, gRPC, OIDC, etc.).

---

• Notes:
  I like OpenCloud for its focus on simplicity, data privacy, and its modular microservices architecture that minimizes maintenance efforts. One potential concern is that its rolling release (v1.0.0 Rolling) may require additional evaluation before deploying in production environments.

OCID: https://github.com/opencloud-eu/opencloud/blob/main/README.md#authentication

---

• Alternative to / Libhunt link: https://selfhosted.libhunt.com/opencloud-alternatives
• Screenshots:
  
  

Also thank you for using the PreShared Key Option in wireguard! I appreciate the extra security!

@cloudron-Team Thank you!

Sometimes a lightway calender/contact/todo app would be great. I love keeping things separate.
I did not find much frontends, but I did find this:
https://inf-it.com/open-source/clients/infcloud/
https://github.com/Unrud/RadicaleInfCloud?tab=readme-ov-file

-> Demo:
https://inf-it.com/infcloud/

• Missing: OCID?