Bluehost Self-Managed VPS: Reimage Your Server for Cloudron Installation

Cloudron is a turnkey platform that allows you to self-host web applications on your Bluehost Self-Managed VPS. This guide walks you through reimaging your server for Cloudron installation using the Bluehost Portal and shows you how to access your Cloudron dashboard, so you can start deploying apps efficiently and securely.

Reimage Your Server for Cloudron Installation Using Bluehost Portal

To reimage your server and install Cloudron:

1. Log in to your Bluehost Portal.
2. In the left-hand menu, click Hosting.

   
    

3. Click the Manage button on the Self-Managed VPS package.

   
    

4. Click the Reimage button.

   
    

5. Select the Applications tab.

   
    

6. From the list, find Cloudron and click Select.

   
    

7. To confirm, please type "reimage" and then click Proceed to start the process.

   
    

8. Wait a few moments while the installation completes.

   
    

   • Once completed, you will see Cloudron listed in the Server Image section.

     
      

Additional Information and Example Documentation Output

You can run cat /root/README.md to see more information and useful commands:

root@server-123456:~# cat /root/README.md
# Cloudron

## Description

Cloudron is a self-hosting platform that lets you install and manage popular web applications on your server with automatic updates and backups. It handles app configuration, SSL certificates, user management, and system maintenance automatically, making it easy to run a personal or organizational app ecosystem without deep technical expertise.

## Before You Begin

You will need the following before starting setup:

1. **A registered domain name** (e.g. `mycompany.com`) -- purchase from
   Namecheap, GoDaddy, or Porkbun. Cheap `.xyz` or `.online` domains
   cost $1-2/year.
2. **Wildcard DNS configured** -- create a wildcard `A` record pointing
   `*.yourdomain.com` -> your server's public IP. This is required for
   Cloudron to create subdomains for each app automatically.
3. **A DNS provider API key** so Cloudron can automatically manage DNS
   records. Cloudflare is recommended (free). Point your domain nameservers
   to Cloudflare, then create an API token with Zone -> DNS -> Edit permissions.
4. **An admin email address** -- used for Let's Encrypt SSL certificate
   provisioning. Use a valid email you have access to.

> Cloudron requires a real domain because it automatically provisions
> wildcard SSL certificates and creates subdomains for every app you install
> (e.g. `wordpress.yourdomain.com`, `nextcloud.yourdomain.com`).
> This cannot be bypassed in production use.

---

## Minimum Resources

Cloudron requires more resources than a typical single-app image due to its
container orchestration, Docker engine, and built-in services (nginx, MySQL,
mail server, etc.).

| Resource | Minimum |
|----------|---------|
| CPU      | 2 vCPUs |
| RAM      | 3 GB    |
| Disk     | 20 GB   |

---

## How to Use

#### Step 1 -- Wait for First Boot to Complete

After launching the instance, the first-boot script runs automatically in the
background. It opens ports 80 and 443 via iptables and prepares the system for
Cloudron setup. This takes about 2 minutes. You can verify it completed:

```bash
cat /var/log/onboot.log
```

#### Step 2 -- Point Your Domain to This Server

Before opening the setup UI, add these DNS records at your DNS provider:
```
Type: A  |  Name: *  |  Value: your-server-ip  |  TTL: Auto
Type: A  |  Name: @  |  Value: your-server-ip  |  TTL: Auto
```
The wildcard record is required -- Cloudron automatically creates a subdomain
for every app you install (e.g. `wordpress.yourdomain.com`).

#### Step 3 -- Open the Cloudron Setup UI

Open your browser and go to:
```
http://your-server-ip
```

You will see the Cloudron first-time setup wizard. If the page does not load,
wait another minute and try again.

#### Step 4 -- Enter Your Domain and DNS Credentials

Fill in the setup form:
- **Domain** -- your registered domain (e.g. `mycompany.com`)
- **DNS Provider** -- select your provider (Cloudflare recommended)
- **API Token** -- your DNS provider API token
- **Certificate provider** -- leave as `Let's Encrypt Prod - Wildcard`
- **IPv4 Configuration** -- leave as `Public IP`

Click **Next**. Cloudron will create the required DNS records and provision
a wildcard SSL certificate automatically. This may take 2-3 minutes.

#### Step 5 -- Create Your Admin Account

Once DNS and SSL are configured, Cloudron redirects you to
`https://my.yourdomain.com`. Fill in your name, email, username, and
password, then click **Create admin** to access your dashboard.

> Use a real email address -- Let's Encrypt sends certificate renewal
> notices to this address.

---

### Oracle Cloud Deployment

Oracle Cloud has an additional OS-level firewall that blocks ports 80 and 443
even after opening them in the Security List. This image handles this
automatically on first boot -- no manual iptables commands are needed.

If ports are still blocked after booting, SSH in and run:

```bash
iptables -I INPUT -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -p tcp --dport 443 -j ACCEPT
netfilter-persistent save
```

Then follow Steps 2-5 above.

---

### AWS EC2 Deployment

#### Step 1 -- Open Security Group Ports

Open these ports in your EC2 Security Group before accessing the setup page:

| Port | Protocol | Source    | Purpose                    |
|------|----------|-----------|----------------------------|
| 22   | TCP      | Your IP   | SSH access                 |
| 80   | TCP      | 0.0.0.0/0 | Cloudron setup UI + HTTP   |
| 443  | TCP      | 0.0.0.0/0 | HTTPS for apps + dashboard |

**Steps:**
1. Go to EC2 -> Instances -> select your instance -> Security tab
2. Click the Security Group link -> Edit inbound rules
3. Add HTTP (port 80) and HTTPS (port 443) with source Anywhere (0.0.0.0/0)
4. Save rules

## Accessing the Dashboard

Cloudron has no default username or password. Your admin credentials are
created by you during the first-boot setup wizard (Step 5 above). If you
have not completed setup yet, open `http://your-server-ip` to begin.

After setup, your Cloudron dashboard is always at:
```
https://my.yourdomain.com
```

Each app you install gets its own subdomain automatically:
- WordPress -> `https://wordpress.yourdomain.com`
- Nextcloud -> `https://nextcloud.yourdomain.com`
- Gitea -> `https://git.yourdomain.com`

Cloudron acts as an OAuth/OIDC provider -- once logged into the dashboard,
you are automatically signed into all hosted apps.

---

## DNS Provider API Keys

| Provider     | How to get credentials                               |
|--------------|------------------------------------------------------|
| Cloudflare   | My Profile -> API Tokens -> Create Token (Zone:Edit)  |
| AWS Route 53 | IAM -> Users -> Create Access Key + Secret Key         |
| GoDaddy      | developer.godaddy.com -> API Keys                    |
| Namecheap    | Profile -> Tools -> API Access                        |
| DigitalOcean | API -> Generate New Token                            |

Full list: [DNS Provider docs](https://docs.cloudron.io/domains/#dns-providers)

---

## Services

| Service  | Ports   | Purpose                                      |
|----------|---------|----------------------------------------------|
| Cloudron | 80, 443 | Setup UI, dashboard, and hosted applications |
| OpenSSH  | 22      | Remote SSH access                            |

> Do NOT enable UFW -- Cloudron manages its own firewall via iptables.
> Enabling UFW will conflict with Cloudron's internal port management.

---

## Image Contents

- Cloudron 8+ (currently 9.1.6, installed via official installer)
- Docker CE (latest stable, upgraded post-install)
- Ubuntu 24.04 with all security patches applied at build time

> Cloudron bundles and manages its own versions of nginx and Node.js
> internally. These are updated via Cloudron's own update mechanism.

---

## Known Limitations

- Remaining Trivy vulnerabilities are in Cloudron's bundled Node.js
  dependencies and Docker CE binaries compiled with Go stdlib. These are
  managed by Cloudron and Docker upstream respectively and will be resolved
  in their future releases.
- Cloudron requires a real domain name -- it cannot be accessed via IP
  address alone in production use.

---

## Validation Tests

```bash
perl /root/app_test/main.t
```

Runs 11 checks: `box.service` enabled and unit file present, first-boot script
executable, logrotate config present, log directory exists, README copied to
`/root/README.md`, MOTD executable, Docker binary and service available, port 80
listening, and Cloudron box service active.

## Useful Commands (via SSH)

```bash
# Check Cloudron status
systemctl status box

# Restart Cloudron
systemctl restart box

# View Cloudron logs
journalctl -u box -n 100 --no-pager

# View first-boot log
cat /var/log/onboot.log
```

---

## Links

**Cloudron**

* Home: [cloudron.io](https://www.cloudron.io/)
* Documentation: [docs.cloudron.io](https://docs.cloudron.io/)
* App Store: [Cloudron App Store](https://www.cloudron.io/store/)
* DNS Providers: [Supported DNS Providers](https://docs.cloudron.io/domains/#dns-providers)
* Community Forum: [forum.cloudron.io](https://forum.cloudron.io/)
root@server-123456:~#