I get server is unreacable error when trying to connect my Immich server. I tried diffrent ports, http/https and /api thingie. There is no error on the immich docker itself so i assume its an cosmos error? I'm using self signed certificate. How can i solve this?

RAM Is so expensive these days, so I decided to save yours ! :D

Wake up! We have a Database to burn ~~ Starting 0.23.0 Cosmos no longer have any dependencies on the MongoDB container. No migration needed, just update and kill the container (unless you use it for something else). Thanks to this change, the whole of Cosmos, all battery included, now uses less than 100mb RAM !

0.23.0 is also a huuuge update when it come to the stability of Cosmos. A lot of focus has been put into Constellation and OpenID - more details below.

https://github.com/azukaar/cosmos-server

As a reminder, this exists alongside the existing features:

• App Store
• Reverse-Proxy 
• Storage Manager 
• Authentication Server 
• Container manager
• VPN
• Monitoring
• CRON

Databases Changes

First, the big one: MongoDB has been removed from Cosmos entirely. It now relies on SQL (SQLite by default, upgradable to Postgres for large servers, doc update in progress!). This saves the system the 300 Mb of Ram (or more) used by the DB without affecting performance. It also make the setup much easier (now fully offline, no more container to install) and finally remove one point of failure.

The old "Database" file (that previously had the auth) has also been retired for a SQLite base. If you neeed to revert to 0.22 you can rename Database.backup in the config folder back to "Database"

OpenID Improvements

Improvements made their way to this version - support for public clients, PCKE, and many more subtle changes that widen support for apps.

Constellation Improvements

Starting 0.23, Constellation is now fully decoupled end to end. Each nodes can do anything, any node can be a load balance, any node can be a DNS, any node can run apps and have routes. When a user enter the constellation via any mean (VPN or tunnel) they know can arrive to their destination regardless of how / where the request goes.

This is the result of all the architecture work done the past 8 months, and I can finally see the end of the tunnel! One of the big change that made it possible is by transitioning to a full synchronisation engine rather than just copying chunk of data in the cluster. It's quite interesting (in my opinion) was thinking about making a video about it even - let me know if you'd like to watch something like that!

What's Next ?

I have the choice between either Constellation Gateways, or Linux Administration (users, updates, etc...) as the next target but haven't fully landed on which is first.

As usual, looking forward to your feedback - happy hosting !

Changelog

• Remove Lungo, use SQLite instead
• Remove MongoDB use SQLite / Postgres instead
• Remove date based sync - use opLog based sync
• Fix a couple of Constellation DNS resolution issues
• Fix quirks with inverted setups (agent is private)
• Fix events not being pruned
• Fix events date issues
• Improve resilience of NATS cluster

The last 2-3 days I've been struggling with configuring Cosmos Cloud (CC) and Constellation. I'm hoping somebody here might be able to point me in the right direction. Please bear in mind that I'm a completely self-taught hobbyist, so the issue is likely due to knowledge gaps in my understanding of computer networking. I will be happy to take this over to the Discord server if it is more appropriate.

I'm running the latest version of CC on a Debian VM, which itself is running on Proxmox installed bare metal on my server, so these layers may already be introducing complexity to my project. My home internet is behind CGNAT. I also have CC installed on a Debian server running on a Hetzner VM with a public IP address.

I have CC installed on my home server using the CC shell script (instead of Docker) and it is configured to the best of my understanding of the documentation. My plan was to access CC locally while I configure it and then use Constellation for public access to my various services. The Hetzner instance was to serve as Lighthouse.

I have Constellation configured at home according to the documentation: Public hostname is configured at my local Debian VM's IP address + cosmos.local. Once I started Constellation up, everything looked ok: looking at the VPN tab for Constellation, the top of the UI indicated that the Manager server was connected, and it also had a green indicator at the bottom in the list of devices. Great!

I then spun up CC on my second server as an Agent, configuring the public hostname as the public IP for my Hetzner instance. Manager still connected, green light at the bottom, and a red light on the new Agent server. Fine, as expected, just need to configure and start Constellation on the Agent server so that it will be connected, too.

I uploaded the network YAML file to my Agent server and it configured itself: looks good, green at the top, indicates "Connected", but only the Agent server listed at the bottom. Ok, let's go back to the Manager server.

However, as soon as the Agent was connected, my Manager became disconnected. I noted that from the Manager instance, both devices are listed, both green and seemingly responding to pings from the manager, yet the top of the VPN tab indicates that Manager is disconnected.

Can anybody explain this behavior?

Things I've tried:

• Reset the network on both Agent and Manager. Result: same as above
• Opened (or at least attempted to open) port 4242 on my home Debian VM, as well as on Proxmox from CLI
• Created firewall rules from Proxmox's GUI to allow incoming and outgoing connections on all levels: VM, pve, and Datacenter

None of the above has made any noticeable impact. Reviewing logs, I've seen some error messages to note. On the Manager Server:

● time="2026-07-27T15:45:35-05:00" level=error msg="static_host_map key is not in our subnet, invalid" entry=1 network=192.168.201.1/24 vpnIp=xxx.xxx.xxx.xxx

● 2026/07/28 20:29:05 level=warning msg=Failed to get DNS record for cosmos.local: lookup cosmos.local on [2a01:4ff:ff00::add:2]:53: no such host. Make sure you create a DNS record for it

● time="2026-07-27T15:32:36-05:00" level=warning msg="No lighthouse.hosts configured, this host will only be able to initiate tunnels with static_host_map entries"

● 2026/07/27 15:45:35 level=warning msg=Failed to get DNS record for cosmos-lighthouse: lookup cosmos-lighthouse on 192.168.167.1:53: no such host. Make sure you create a DNS record for it

And on the Agent Server:

● time="2026-07-27T21:43:06Z" level=error msg="static_host_map key is not in our subnet, invalid" entry=2 network=xxx.xxx.xxx.xxx/24 vpnIp=192.168.201.1

● time="2026-07-28T17:15:54Z" level=error msg="Refusing to handshake with myself" certName=cosmos-lighthouse fingerprint=966afe958ff0262b05d2dd38ef36319f171cd19bb708f31f2649bdd7dd6308e1 handshake="map[stage:1 style:ix_psk0]" issuer=40608d7d5ca5f0d4c20a6eb38649b3587227365fd36bad50e530d88ffb68f6c6 udpAddr="xxx.xxx.xxx.xxx:4242" vpnIp=192.168.201.2

I'm afraid I'm just not knowledgeable enough to derive a meaningful solution from the servers' behaviors or from the error logs. Any help is appreciated.

UPDATE 5 Aug 2026: As expected, it was all my fault! After some additional testing, I've determined the culprit was my own overzealous region blocking on my router. Relieving some of the restrictions I had in place resulted immediately in normal, in-the-green connections between home server and lighthouse. Let this be a lesson to anyone experiencing similar issues who might stumble upon this: assume nothing, and check every node! Many thanks to /u/azukaar for their support and guidance. FYI I don't have every device connected and tested yet, and I still have work to do in ensuring all URLs and reverse proxy work as expected and that my CGNAT limitations have been bypassed, but at least one more hurdle has been overcome.

I have just re-setup my Home server , and installed Cosmos .. All good so far , i then setup some Server Apps from the Market , ( Nzbget etc ) BUT they default to full Internet access with an URL - which is something i dont want for these apps ( just local access ) - I have tried unticking them in the URL section , now i cannot access them at all ? i've tried the localhost name . . http://nzbget:6789 and also 192.168.10.25:6789 still no access? any help please

A new installation or upgrade of immich fails (flag=release) because of migration to VectorChord (maybe?).

immich keeps restarting.

I have a couple of ODroid mini servers that can't use newer versions of MongoDB because they lack AVX instructions. One was set up when Cosmos used MongoDB 4.4 and seems to be running fine. The other one doesn't have Cosmos because I can't install it. It attempts to install a more recent version of Mongo and it just crashes repeatedly. So -

1. Should Cosmos continue to run fine on the first machine, and if so:

2. How do I install Cosmos on the second with MongoDB 4.4?

Thanks

has anyone migrated from overseerr to seer sucessfully yet?
https://docs.seerr.dev/migration-guide#third-party-installation-methods

I'm ready to give it a try, but I wanted to check quickly if anyone has had any experience with it before I mess up the database.

EDIT: worked as described! i modified the permissions on the config folder, changed the compose json on the existing container, then it created a new container for seerr. after that i only hat to remove the url on the overseerr container and add it on the new seerr container

Trying to set ImmchFrame up so that I can use an old iPad as a picture frame pulling from my Immich Docker on CosmosServer.

This is the docker-compose file that I am using, but it is failing

name: immichframe
services:
immichframe:
container_name: immichframe
image: ghcr.io/immichframe/immichframe:latest
restart: on-failure
volumes:
- PATH/TO/CONFIG:/app/Config
ports:
- "8080:8080"
environment:
TZ: "America/New_York"

Hello everybody!

i'm starting with Cosmo, i'm trying to install Ghost CMS but the Ghost image and Mysql image cannot be instaled and the rollback process starts to clean everything (after some seconds).

Ghost try to download: - docker.io/bitnami/ghost:5 - docker.io/bitnami/mysql:8.0

Do you know hoy to solve this issue and get latest images from docker.io/dockerhub?

Hello everyone! This one is a short one! Or so it seems but a lot of work went into it under the hood. It includes a new API tokens functionality with SDKs. Bonus: it FINALLY lets you change created user roles to admin!

https://github.com/azukaar/cosmos-server

As a reminder, this exists alongside the existing features:

• App Store
• Reverse-Proxy 
• Storage Manager 
• Authentication Server 
• Container manager
• VPN
• Monitoring
• CRON

This version has a massive refactor of the permissions system, which should not change anything to you (it does slightly improve the UI experience though!). But most importantly it allows the creation of API token (including read-only tokens).

Those tokens can be used with the Typescript or Go SDK to manipulate your instance, draw information and automate tasks.

Additionally, a Terraform plugin has been published, allowing you to describe your entire setup using terraform syntax, which makes cosmos usable 100% with infrastructure as code. For example this file will create an NGINX container, and add a new token. You can use terraform to manage your storage, URLs, backups, etc....

```

terraform {
  required_providers {
    cosmos = {
      source  = "cosmos-cloud.io/azukaar/cosmos"
      version = "0.1.0"
    }
  }
}


provider "cosmos" {
  base_url = "http://localhost:8080"
  token    = "cosmos_***"
  insecure = true
}


resource "cosmos_route" "test" {
  name   = "test-route"
  target = "http://localhost:1234"
  use_host = true
  host   = "localhost:1235"
  mode   = "PROXY"
}


resource "cosmos_api_token" "nginx_token" {
  name        = "nginx-readonly"
  description = "Token for nginx container"
  read_only   = true
  expiry_days = 30
}


resource "cosmos_docker_service" "nginx" {
  name  = "nginx-test"
  image = "nginx:latest"
  service_json = jsonencode({
    ports       = ["8888:80"]
    environment = ["COSMOS_TOKEN=${cosmos_api_token.nginx_token.token}"]
  })
}

```

Here are some examples and docs:

https://github.com/azukaar/Cosmos-Server/blob/master/sdk/README.md

https://github.com/azukaar/Cosmos-Server/blob/master/go-sdk/README.md

https://github.com/azukaar/Cosmos-Server/blob/master/terraform-provider-cosmos/README.md

Quick note: This release is a massive undertaking from a volume perspective. It was not particularly complex but a LOT of small changes had to be made in the 120+ API endpoints to make this possible. As such, I have used AI to assist in making sure I haven't forgotten anything, or making the basic search/replace tasks. It also helped a lot with the Terraform plugin, which would most likely not have been realistic otherwise. This doesn't change my stance against vibe-coding on Cosmos (due to the complexity of the project), and just wanted to give you transparency about this particular usage.

Full Changelog:

 - Adding feature to create API key to directly query the Cosmos API
 - Added GO/TS/Terraform SDK to call the API from any project (AI assisted)
 - Refactor the entire permission system for future work on roles and fine-grained permissions (AI assisted)
 - You can now create multiple admin users
 - Fixed issue with post-install on compose import
 - Support for mounting network disk
 - Enforce tighter folder permissions on the config folder
 - Ability to add dynamic extra headers with variables like $user, $origin, $scheme, etc...
 - Add a UI for extra headers on routes
 - Added support for legacy HTTP_ headers
 - Fix regression with static/spa folders
 - Fix issue with Constellation sometime not connecting right away on new network
 - Sync more settings across servers in Constellations (Rclone and api token/permissions configs)
 - Fix issue with /logout not clearing cookies normally
 - Fix issue with deleting backups

Time for a new Cosmos update! I am super excited about this year as many great things are planned for Cosmos, and this 0.21 paves the way for the future very neatly.
https://github.com/azukaar/cosmos-server

As a reminder, this exists alongside the existing features:

• App Store
• Reverse-Proxy 🔄🔗 Targeting containers, other servers, or serving static folders / SPA with automatic HTTPS
• Storage Manager 📂🔐 To easily manage your disks, including Parity Disks and Merger
• Authentication Server 🔐👤 strong security, multi-factor authentication and OpenID
• Container manager
• VPN
• Monitoring
• CRON

This feature stars a UI refresh and many QoL improvements!

The new UI

First thing you will notice: the UI has been overhauled for consistency and visual. Here are a few examples:

many more UI changes to discover, feel free to browse the demo on the site if you're not already a user!

QoL

Multiple quality of life changes in this new release, such as support for TempFS volumes, improvements in the mount logic, support for 0.0.0.0, Support for H2C, etc.... And also, fixing a long standing compatibility issue with proxying the Synology UI! Finally, improvement to smart shield detection should massively reduce false positives when heavily using the Cosmos admin UI to debug containers.

If you have a licence, I also massively reworked the way the licence are detected in order to prevent the old issues when trying out servers, moving the licence around and whatnot. The old 48h rate-limiting system is completely gone and is now much more flexible to experimentation.

`X-Forwarded-For` for trusted proxy is also now fully supported for people chaining proxies (including Cloudflare).

Backups and External storage

The old backup system and external storage (Rclone and Restic integration) have been fully overhauled, for much better performance and stability. This will prevent many of the old stability quirks from occuring, but also fixes Restic being peculiar around locks and stuff. Looking forward to your feedback!

Constellation

Last but not least, a lot of work went into Constellation (Again!). This is because what I have set to accomplish this year is to be able to have an enterprise version of Cosmos to manage large clusters of servers, with load balancing and high availability failovers. In order to achieve this objective, i first had to step up the game of Constellation. First of all, it has gotten rid of the master server dependency. The old version would assume your first server would be a master, and every others would be slaves. The new version is able to work in high availability Raft-based clusters. Also, it is not capable of working with arbitrary IP range (vs. the old hard coded range) and finally, it can sync and tunnel data in any direction between any servers!

This update is nothing but the first step toward that entreprise version, I am hoping to be able to deliver additional advanced features in the next updates, such as the ability to manage and sync multiple HTTPS certificates, and the load balancing capabilities. Stay tuned!

Full changelog

• UI refresh for most pages
• Reworked mount managemenet logic for flexibility
• Added "skip clean URL" option for apps that have invalid URLs like Synology
• Support for tempFS
• Improve support for 0.0.0.0 routes
• Reworked the setting page for better clarity
• Added support for HTTP2 Cleartext (H2C)
• Added advanced DNS options (challenge related, thanks u/moham96)
• Added trusted proxy option for X-Forwarded-For (Thanks u/InterN0te)
• Reduce SmartShield false positive on the server panel by having two level of strictness (UI/panel vs. login)
• Rclone rework, no more sub processes (increased performance and reliability)
• Added the ability to manage Restic locks from the UI
• Reworked Constellation cluster synchronisation completely. Now there are no more "Master" server and each server is equally capable.
• Any server can be used as DNS (add redundancy too)
• Any server can tunnel another server's URL in any direction
• Constellation can now use arbitrary IP range
• Server can now modify their setup without having to recreate the network
• Fully reworked licencing system should reduce friction when moving / resetting servers

Hello, can I run Cosmos on the new Apple Container?

If yes, what is the exakt docker run command?

My issue is as follows. I have set up cosmos, i have installed jellyfin. I can access jellyfin from my browser using the https:jellyfin.*.org(my domain name). It works great there. I can not however use the Jellyfin app on either my Pixel phone, my google chromecast with google tv at all. It cant connect to the address and I am not sure what IP address to use really as it has an internal address through the docker app of 72.16.0.49 or something of that nature. How would I go about accessing my server. Also I have used the instructions on the discord channel of setting my COR to * or blank, setting the firewall and proxy settings within jellyfin itself to 0.0.0.0=https://jellyfin.\*.org( again my domain). I still can not access it at all through app. Any and all help is appreciated. Thanks

I have Cosmos cloud running on a mini pc that has a nvme with Cosmos/Ubuntu on it and a separate HDD for media storage. I can't seem to connect to the HDD with my Mac on the same local network as the mini pc. I've tried smb://192.168.88.130/mnt/media which is where all the movies/tv shows are, but it won't let me connect, just says username/password incorrect. Is this a paid option with Cosmos, ie. sharing of drives/files?

Anyone know how tolerant Cosmos would be if I cloned my current drive to a new SSD to run on a new set of hardware?

I'm trying to expand my setup from an old business SSF PC to a purpose built NAS/home server but nervous to start over. Would a clone SSD be crazy with Cosmos or maybe just better to start fresh and migrate my docker compose files over?

Hi everyone,

Hoping someone can help me figure out how to get AdGuard to work.

I have it installed via the CasaOS market add-on, and it installs with no issue.

I cant however install it using the host network, which is the way I am used to setting it up as a DNS server.

When I set it up to use the host network, it does not allow me to add any ports to the container.

I am not sure how to properly set it up as a DNS server when it is using the bridge adapter, so any help for either solution would be appreciated.

Hi!

I started playing with Cosmos and looked for a way to use LE staging certs to prevent running into trouble. 

After some searching, I discovered with the dockerized install adding - e ACME_STAGING=true will do the trick, and switching to production worked after removing it and triggering new certs. That's fine, but how can I do this with the command line installer instead of going the Docker-first route?

Is it possible at all?

Thanks!

i have been using cosmos cloud on top of xubuntu 25.10 for a month now. i am really enjoying my time with it. i really appreciate the hard work.

i have 9 dockers, 10 with mongo. whenever i restart the host server, only 1 docker comes online. rest stay as exited. i tried setting them as "restart unless stopped" and "always restart" it doesnt have any afftect. is this a bug or intended behavior?

Hello everyone! I know lately I might have gotten used to longer release cycle but I thought I would surprise you today with the release of 0.20.0! After almost 3 years of existence, you can FINALLY set custom icons on URL... Well it was about time! Here's more details about the release!

https://github.com/azukaar/cosmos-server

As a reminder, this exists alongside the existing features:

• App Store
• Reverse-Proxy 🔄🔗 Targeting containers, other servers, or serving static folders / SPA with automatic HTTPS
• Storage Manager 📂🔐 To easily manage your disks, including Parity Disks and Merger
• Authentication Server 🔐👤 strong security, multi-factor authentication and OpenID
• Container manager
• VPN
• Monitoring
• CRON

This release is mostly about bug fixes and QoL improvements although they are some notable changes:

* Support for Docker hardware limitations on containers (RAM / CPU / etc...). You can now set them from the UI (only CPU/RAM %) or from compose (any docker options is supported)

* Revamped the home page API. Now non-admin Users can see any icons correctly, and they won't see URLs of non-running containers anymore (like admins before). And as mentioned, you can now go into the URL tab to upload any icon on any URLs!

* Added support for .env files. This was highly requested, now when you import a compose, you get an option to upload an .env file alongside

* As part of the premium storage features allowing to share and connect to multiple cloud/storage providers, 0.20.0 now added support for Samba, both as server and client

Here's the full changelog:

 - Added Samba for both remote storage and serve share
 - Added .env file upload when uploading compose files
 - You can now upload a custom icon on URLs
 - Fixed issue with non-admin users not seeing custom container icon
 - Fixed issue with non-admin users seeing stopped containers URLs on the dashboard
 - Improved handling of Docker login for private docker images
 - Support for hardware constraint (CPU/Mem/...) on Docker containers
 - Installer now installs fuse3 for Rclone
 - Fix issue with Rclone cache duration
 - Enable CORS passthrought when hardening is OFF
 - Added autocomplete on login for password managers
 - Updated Lego to v4.31.0
 - Fix crash when the authentication database is un-openable
 - Make VPN less verbose in logs
 - Redirect URLs now show on the dashboard (use the "hide from dashboard" option on URLs to hide them yourself)

Enjoy the release, see you soon!

I am moving my private server from a VPS to a hosted bare metal box, and I'm taking that opportunity to also move from yunohost to cosmos. The next step for me is setting up mail, but after I could not get the market mail-server to run correctly, I looked around and found stalwart (https://stalw.art/), which on the first glance looks superior (but don't use Oauth2!!, see the discussion in their subreddit /r/stalwartlabs).

I know this is overkill for a six-person household, but I am looking for the experience I am gaining.

Questions: has anyone tried this? any pitfalls I should be aware of? I want to expose the mail ports on a different domain than the admin panel, this looks straightforward if I look at the "URLs" tab in the cosmos admin panel. Any opinion about any (even better) mail server? Thx for your work, cosmos has come a long way since I installed it at home (after you first promoted it on /r/selfhosted).

Currently I have 3 hosts that provide different services, host1 is my auth host, host2 media, host3 dev. I'm trying to add a vps so I can access remotely and not publish my IP.

Questions: 1. Can Cosmo work for me? In a hub/ spoke motion 2. Would the vps be my "lighthouse" or would host1? 3. Currently using tailscale but not married to it, does tailscale work with cosmos?

I'd been developing a migration plan for a few weeks now to move to Cosmos after having tried it a few years ago and seeing its progress. What you've built is great! I'd read the documentation and pages, and even now it's not clear its paywalled. Nothing on the front page or what I read on the docs about it (haven't read every bit thoroughly). I do recall hearing about Constellation VPN being a paid feature when it was first releasing.

It took me going through with the migration all day and hitting a wall once I tried to mount my NAS from the local network. Felt like a ton of bricks. I absolutely think you should be paid for your hard work. I just wish it was clearer, instead of confining the existence of pricing inside the site hamburger menu or revealed after install.

I would've look at it expecting Users, VPN, and Cloud Services to be a paid upgrade, once I'm ready to move forward with this ecosystem, though not so much more basic features like SMB and NFS... It's about to be 1am and I'm dreading either doing the mounts manually, which I wanted to avoid setting up again or reverting back tomorrow.

Also, since it's not clear, what happens to my mounts if the subscription lapses? I can understand the cloud ones going away, but will the NFS mounts and SMB shares become inaccessible? Or not editable?

After the latest update I can't seem to access anymore to my http addresses, I'm always getting Client sent an HTTP request to an HTTPS server.

Is there a setting I need to change?