9.3 KiB
Self host Cloudron
The Cloudron platform can be installed on your own cloud server. The self hosted version comes with all the same features as the managed version.
The CLI tool
The cloudron tool has a machine subcommand that can be used to create, update and maintain a self-hosted Cloudron.
Installation
Installing the CLI tool requires node.js and npm. The CLI tool can be installed using the following command:
npm install -g cloudron
Depending on your setup, you may need to run this as root.
You should now be able to run the cloudron machine help command in a shell.
Machine subcommands
create Creates a new Cloudron
restore Restores a Cloudron
migrate Migrates a Cloudron
update Upgrade or updates a Cloudron
eventlog Get Cloudron eventlog
logs Get Cloudron logs
ssh Get remote SSH connection
backup Manage Cloudron backups
AWS EC2
Requirements
To run the Cloudron on AWS, first sign up with Amazon AWS.
The Cloudron uses the following AWS services:
- EC2 for creating a virtual private server that runs the Cloudron code.
- Route53 for DNS. The Cloudron will manage all app subdomains as well as the email related DNS records automatically.
- S3 to store encrypted Cloudron backups.
The minimum requirements for a Cloudron heavily depends on the apps installed. The absolute minimum required EC2 instance is t2.small.
The Cloudron runs best on instances which do not have a burst mode VCPU.
The system disk space usage of a Cloudron is around 15GB. This results in a minimum requirement of about 30GB to give some headroom for app installations and user data.
Cost Estimation
Taking the minimal requirements of hosting on EC2, with a backup retention of 2 days, the cost estimation per month is as follows:
Route53: 0.90
EC2: 19.04
EBS: 3.00
S3: 1.81
-------------------------
Total: $ 24.75/mth
For custom cost estimation, please use the AWS Cost Calculator
Setup
Open the AWS console and create the required resources:
- Create a Route53 zone for your domain. Be sure to set the Route53 nameservers for your domain in your name registrar.
- Create a S3 bucket for backups. The bucket region must be the same region as where you intend to create your Cloudron (EC2).
- Create an SSH key pair in the target region (
Key Pairsin the left pane of the EC2 console). - Create AWS credentials. You can either use root or IAM credentials.
- For root credentials:
- In AWS Console, under your name in the menu bar, click
Security Credentials - Click on
Access Keysand create a key pair.
- In AWS Console, under your name in the menu bar, click
- For IAM credentials:
- You can use the following policy to create IAM credentials:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "route53:*",
"Resource": [
"arn:aws:route53:::hostedzone/<hosted zone id>"
]
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::<your bucket name>",
"arn:aws:s3:::<your bucket name>/*"
]
},
{
"Effect": "Allow",
"Action": "ec2:*",
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"ec2:Region": "<ec2 region>"
}
}
}
]
}
Create the Cloudron
Create the Cloudron using the cloudron machine command:
cloudron machine create ec2 \
--region <aws-region> \
--type t2.small \
--disk-size 30 \
--ssh-key <ssh-key-name> \
--access-key-id <aws-access-key-id> \
--secret-access-key <aws-access-key-secret> \
--backup-bucket <bucket-name> \
--backup-key <secret> \
--fqdn <domain>
The --region is the region where your Cloudron is to be created. For example, us-west-1 for N. California and eu-central-1 for Frankfurt. A complete list of available
regions is list here.
The --disk-size parameter indicates the volume (hard disk) size to be allocated for the Cloudron.
The --backup-key <secret> will be used to encrypt all backups prior to uploading to S3. Keep that secret in a safe place, as you need it to restore your Cloudron from a backup! You can generate a random key using pwgen -1y 64.
NOTE: The cloudron machine create subcommand will automatically create a corresponding VPC, subnet and security group for your Cloudron, unless --subnet and --security-group arguments are explicitly passed in. If you want to reuse existing resources, please ensure that the security group does not limit any traffic to the Cloudron since the Cloudron manages its own firewall and that the subnet has an internet gateway setup in the routing table.
First time setup
Visit https://my.<domain>/setup.html to do first time setup of your Cloudron.
Once the setup is done, you can access the admin page in the future at https://my.<domain>.
Backups
The Cloudron has a backup schedule of creating one once a day. In addition to regularly scheduled backups, a backup is also created if you update the Cloudron or any of the apps (in this case only the app in question will get backed up).
Since this might result in a lot of backup data on your S3 backup bucket, we recommend adjusting the bucket properties. This can be done adding a lifecycle rule for that bucket, using the AWS console. S3 supports both permanent deletion or moving objects to the cheaper Glacier storage class based on an age attribute. With the current daily backup schedule a setting of two days should be already sufficient for most use-cases.
You can list backups using the following command:
cloudron machine backup list <domain>
Restore
The Cloudron can restore itself from a backup using the following command:
cloudron machine create ec2 \
--backup <backup-id> \
--region <aws-region> \
--type t2.small \
--disk-size 30 \
--ssh-key <ssh-key-name> \
--access-key-id <aws-access-key-id> \
--secret-access-key <aws-access-key-secret> \
--backup-bucket <bucket-name> \
--backup-key <secret> \
--fqdn <domain>
The backup id can be obtained by listing the backup. Other arguments are similar to Cloudron creation. Once the new instance has completely restored, you can safely terminate the old Cloudron from the AWS console.
Updates
Apps installed from the Cloudron Store are updated automatically every night.
The Cloudron platform itself updates in two ways:
-
An update is applied onto the running server instance. Such updates are performed every night. You can use the Cloudron UI to perform updates.
-
An upgrade requires a new OS image and thus has to be performed using the CLI tool. This process involves creating a new EC2 instance is created using the latest image and all the data and apps are restored. The
cloudron machine updatecommand can be used when an upgrade is available (you will get a notification in the UI).
cloudron machine update --ssh-key <ssh-key> <domain>
Once the upgrade is complete, you can safely terminate the old EC2 instance.
The Cloudron will always make a complete backup before attempting an update or upgrade. In the unlikely case an update fails, it can be restored.
SSH
If you want to SSH into your Cloudron, you can
ssh -p 202 -i ~/.ssh/ssh_key_name root@my.<domain>
If you are unable to connect, verify the following:
- Be sure to use the my. subdomain (eg. my.foobar.com).
- The SSH Key should be in PEM format. If you are using Putty PPK files, follow this article to convert it to PEM format.
- The SSH Key must have correct permissions (400) set (this is a requirement of the ssh client).
Spammers frequently abuse EC2 public IP addresses and as a result your Cloudron might possibly start out with a bad reputation. The good news is that most IP based blacklisting services cool down over time. The Cloudron sets up DNS entries for SPF, DKIM automatically and reputation should be easy to get back.
-
Once your Cloudron is ready, apply for a Reverse DNS record to be setup for your domain. You can find the AWS request form here.
-
Check if your IP is listed in any DNSBL list here. In most cases, you can apply for removal of your IP by filling out a form at the DNSBL manager site.
-
Finally, check your spam score at mail-tester.com.
Other Providers
Currently, we do not support other cloud server provider. Please let us know at support@cloudron.io, if you want to see other providers supported.