This is an automated archive made by the Lemmit Bot.
The original was posted on /r/selfhosted by /u/azukaar on 2025-02-20 17:58:52+00:00.
Original Title: ๐ Cosmos 0.18 - All in one secure Reverse-proxy, container manager with app store, integrated VPN, authentication provider, Storage, and Monitoring, now with Automated Backups, CA, OpenID Gate and more!
link:
0.18 is out! And it is juicy!
2 years ago, I started a journey to try and make self-hosting an accessible and safe alternative to SaaS product. Make servers reliable, well setup, and secured, for people to be able to manage their personal corner of the web, without sacrificing all their weekend and without sacrificing utility. Updates after updates, Cosmos has slowly built-up toward that goal, slowly adding important, large features such WAF, then VPN, then monitoring, etc... And finally, 2 years later, the final pillar of the Cosmos ecosystem has been built: backups! With this in, Cosmos is finally what I would consider to be an extensive but flexible 360 solution to self-hosting your digital life at home.
Additionally to this, other changes have been made to improve quality of life, with (among other things) a focus toward support for standalone, non-FQDN setups (basically improving support for .local and self-sign HTTPS certificate, with the new integrated CA)
As reminder, this is along-side the existing features:
- App Store ๐ฆ๐ฑ To easily install and manage your applications, with simple installers, automatic updates and security checks. This works alongside manual installation methods, such as importing docker-compose files, or the docker CLI
- Storage Manager ๐๐ To easily manage your disks, including Parity Disks and MergerFS
- Network Storages ๐ก๐ Based on RClone, To easily manage your network storages, including accessing remote ones (ex. Dropbox) or share NFS / FTP / ... from the UI, protected by the smart shield
- Reverse-Proxy ๐๐ Targeting containers, other servers, or serving static folders / SPA with automatic HTTPS, and a nice UI
- Authentication Server ๐๐ค With strong security, multi-factor authentication and multiple strategies (OpenId, forward headers, HTML)
- Customizable Homepage ๐ ๐ผ To access all your applications from a single place, with a beautiful and customizable UI
- Container manager ๐๐ง To easily manage your containers and their settings, keep them up to date as well as audit their security. Includes docker-compose support!
- VPN ๐๐ To securely access your applications from anywhere, without having to open ports on your router.
- Monitoring ๐๐ Fully persisting and real-time monitoring with customizable alerts and notifications, so you can be notified of any issue.
- Identity Provider ๐ฆ๐ฉ To easily manage your users, invite your friends and family to your applications without awkardly sharing credentials. Let them request a password change with an email rather than having you unlock their account manually!
- SmartShield technology ๐ง ๐ก Automatically secure your applications without manual adjustments (see below for more details). Includes anti-bot and anti-DDOS strategies. Now includes TCP protection (FTP, SSH, Games, ...)
- CRON ๐๐ง To easily schedule tasks on the server or inside containers
New SSO Web Auth Gate
The Cosmos web auth gate is the feature that allows you to put a login screen on top of applications that do not have them included, or maybe have some less secure version (ex. just a http basic auth form). Thanks to this feature, you can put a proper secure login form in front of any page, with support for 2FA and so on. This was one of the first feature implemented in Cosmos, and it has been overhauled! The main change has been to change it from using a login form to using OpenID internally. The result is that it helps working around the browser limitation of cookies and domains.
Previously, if you had a Cosmos setup with multiple domains/sub-domains (ex cosmos.domain.com and app.domain.com) You would need to log into both those URLs separately (with the same account, but still) because the browser cannot share the cookies. it is now not required anymore, which is going to help a lot for people using .local domains. Also the login time has been extended to one week instead of 48h to ensure you dont need to login all the time.
SUDO Admin Mode
I was always worried about extending the session time (previously 48h) to a longer duration because your account can control everything on Cosmos... On the other hand, having to login all the time is frustrating! Starting 0.18, I was able to extend the duration of the session to one week (please note that means you are logged off after one week of inactivity, not after one week from login).
In order to keep your server safe, your session will now be a non-admin, sudo-able session, just like you would have in a Linux environment. You can use any of your apps normally, but if you want to do some admin stuff in the Cosmos dashboard, there is a new "Admin" button on the top right that allows you to sudo yourself temporarily into an admin to do maintenance work.
HTTPS Certificate Authority
Self-signed HTTPS certificates have a lot of shortcomings. You need to manually trust them in your browser, and some apps (especially in IOS, like Emby) straight out do not accept them. In 0.18, Cosmos now integrate and manages its own CA. This means, instead of manually trusting certs, you can trust the CA once on your device, and Cosmos will always use it to renew certs.
This will solve most issues self-signed certs will have! Again, a huge leap forward to allow using .local domains instead of FQDN. Any of your user can go to the "trust" tab and trust the CA themselves on their device:
Backups
The star of the show: Backups! Backups are a critical part of any system. In the event of a catastrophic failure, backups are the main way to recover your data. It is important to have a backup strategy in place to ensure that your data is safe and secure.
Cosmos includes an entire backup system that allows you to easily create and manage backups of your data. This system is designed to be flexible and easy to use, allowing you to create backups on a schedule or manually. The backups are also encrypted for your security.
It uses Restic under the hood, allowing you more control, even if you were to stop using Cosmos. Please note that this is part of the premium version of Cosmos!
Navigate the snapshots and restore data (fully or partially) in the original folder or elsewhere
The Integration between Rclone and Restic allows you to seamlessly backup any folder into any remote storage supported by RClone (which you can also manage from the Cosmos UI!).
Conclusion
This update is yet again a huge leap forward in term of quality of life, and the backup feature wraps up two years of intensive work on feature implementation for Cosmos. Moving forward, the focus will be shifted slightly toward improving existing feature, improving stability, and implementing smaller feature, like the lazy container feature. The only big feature I can think of I'd like to implement sometime in the future are custom dashboard. Something else that I want to focus on eventually, is integration with apps. Finally, a lot of work is left to do in Constellation to improve the VPN feature.
But until then, I am going to take a breather, appreciate and be grateful what we've all been able to achieve together. Cosmos is a HUGE ambitious project, and I still cannot believe how far it has come. As I always say, thanks for all of you, your trust and your support!
Changelog
- UI to backup and restore containers/folders/volumes using Restic
- Implements sudo mode - your normal token last longer, but you need to "sudo" to do admin tasks
- Re-Implements the SSO using openID internally - fixes issue where you need to re-loging when app are on different domains (because of browser cookies limitations)
- Implements local HTTPS Certificate Authority, to locally trust self-signed certificates on devices
- Added new folder button to file picker
- Cosmos now waits for CRON jobs to be over before restarting the server
- Fixed bug with RClone storage duplication in the UI
- Implements ...
***
Content cut off. Read original on https://old.reddit.com/r/selfhosted/comments/1iu4rom/cosmos_018_all_in_one_secure_reverseproxy/
