Posts made by will

@murgero This would be dope to be rolled into cloudron if the owner & devs are open to that.

@marcuswquinn Im interested in this too! (Can I throw money at somebody to make a solid Cloudron app)

Much appreciated!

@girish On #3, thats exactly what I did, the instructions would be welcome, thanks!!
I just ditched mailgun and went back to sendgrid.

Cloudron Team,
I'm having issues setting up mailgun as email relay. Whenever I try to put in my username and password, it says "authentication failed"
Additionally, do I use the Cloudron DKIM key, or the one mailgun gives me to use?
Also, I'm noticing that the generated DKIM key that cloudron populates in my DNS settings with Gandi use an old domain that my Cloudron lo longer resides at.

Can you help untangle?

@Trankery Maybe this could be exposed in the admin settings ui

@msbt I second sendgrid. Easy, awesome, free. Bullet proof so far.

@ei8fdb subdomain.domain.com doesn't get an a record unless you put a site there, because Cloudron doesn't have any apps parked there.

I'm not sure about how the loop back pinning support plays into this, but I'd run through the checklist again to make sure nothing was missed.

1) Verify that you can ping both your static public IP, and the private LAN IP of your Cloudron server. Just to make sure you have connectivity to both.
This is just a sanity check to make sure there isn't some bigger problem.

2) Correct IP in Gandi Dashboard
Just double deck that this is your static IP.

3) DNS propagation (ping from desktop or whatever and make sure the DNS resolves to the correct IP)
Double check that Gandi has passed your DNS/IP settings to other name servers.

4) Turn off port forwarding and go to my.subdomain.domain.com
Expected result, your router login.

This verifies the path between:
[You]-------> [DNS Name Resolution] ------> [IP Address] -----> [Path back home to your server]
If that is good, we go deeper.

5) Turn on port forwarding and try that again.
Expected result: Cloudron login screen.*

6) Try to load on both IE and your phone on 4g and report results.
Just to make sure the setup is correct, but the problem still exists.

Run through those steps, even if you've done them before, just to be thorough. Let us know what happens.

(I'm in meetings all day, I only skimmed, I hope this helps)

@YurkshireLad That's been asked for, search for the topic in the "App Wish list" section.

@YurkshireLad You mean expose Cloudron's internal LDAP to the internet? Can you give a use case?

@JOduMonT said in Cloudron 5.2 released:

cap_drop:

It looks like it is:
Let's look at the default list of capabilities available to privileged processes in a docker container:
chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap

Bottom Line
You are probably running containers with a lot more privileges than they need. Dropping these capabilities when the containers are in production would be a great idea.

Reference:
https://www.redhat.com/en/blog/secure-your-containers-one-weird-trick

From Stack Overflow:
Ok, what you can do is run your container and use pscap and filecap to see what capabilities your container needs. Use captest to test them out. Then, remove all capabilities except what you need with --cap-drop ALL --cap-add foo. Check here for more info github.com/docker/labs/tree/master/security/capabilities. Let me know how that goes for you.

Reference:
https://stackoverflow.com/questions/43467670/which-capabilities-can-i-drop-in-a-docker-nginx-container

@JOduMonT If I understand correctly, docker containers only get the extra capabilities that you specify, is that additional yaml nessessary?

@ei8fdb What does chrome or IE say?

I didn't realize we had such a group of badasses here. Glad to learn a little more about each of you.

I run Cloudron out of a lenovo tiny workstation mounted right next to my router in a closet, with Gandi too!
Port forwarding + email relay were the parts that got me too. Double check all that and if you need more help, just ask.

I'm a senior security consultant for a silicon valley company and I consult on network security for the U.S. Department of Defense.
I am very much in the "do it yourself" category digitally, but tempered with productivity/ease of use.
My background is System Administration, and I have no programming skills. But I'm learning!

@mehdi Even something as simple as a pin could work.

@JOduMonT Unrelated, how do you get files into jellyfin?

@scooke Some apps support LDAP for logging in, some do not. When installing, you'll see "This app manages it's own users" or some such. Other apps will have a section where you can configure what groups or users have access to the app.

In short, yes!

That section is if you want to use your own external LDAP for authentication, think big companies that have existing infrastructure. For most of us, Cloudron's internal LDAP works fine.

@JOduMonT This would be a great hardening step going forward.