From fffcec12a85df80c54165c5b30f46c1be0ade6cc Mon Sep 17 00:00:00 2001 From: kellergoech <38539019+kellergoech@users.noreply.github.com> Date: Fri, 24 Jul 2026 07:06:50 +0200 Subject: [PATCH 1/2] Adjust collavora to new distroless container --- weboffice/collabora.yml | 26 +++++++++----------------- 1 file changed, 9 insertions(+), 17 deletions(-) diff --git a/weboffice/collabora.yml b/weboffice/collabora.yml index 9ab276e2..417fe2b3 100644 --- a/weboffice/collabora.yml +++ b/weboffice/collabora.yml @@ -24,7 +24,7 @@ services: COLLABORATION_CS3API_DATAGATEWAY_INSECURE: "${INSECURE:-true}" collabora: - image: collabora/code:26.04.2.2.1 + image: collabora/code:26.04.2.3.1 # release notes: https://www.collaboraonline.com/release-notes/ networks: opencloud-net: @@ -32,13 +32,13 @@ services: # WOPI host allowlist; the WOPI endpoint is served by the opencloud proxy on the opencloud domain aliasgroup1: https://${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} DONT_GEN_SSL_CERT: "YES" - extra_params: | - --o:ssl.enable=${COLLABORA_SSL_ENABLE:-true} \ - --o:ssl.ssl_verification=${COLLABORA_SSL_VERIFICATION:-true} \ - --o:ssl.termination=true \ - --o:welcome.enable=false \ - --o:net.frame_ancestors=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} \ - --o:net.lok_allow.host[14]=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} \ + extra_params: > + --o:ssl.enable=${COLLABORA_SSL_ENABLE:-true} + --o:ssl.ssl_verification=${COLLABORA_SSL_VERIFICATION:-true} + --o:ssl.termination=true + --o:welcome.enable=false + --o:net.frame_ancestors=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} + --o:net.lok_allow.host[14]=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} --o:home_mode.enable=${COLLABORA_HOME_MODE:-false} username: ${COLLABORA_ADMIN_USER:-admin} password: ${COLLABORA_ADMIN_PASSWORD:-admin} @@ -55,16 +55,8 @@ services: logging: driver: ${LOG_DRIVER:-local} restart: always - entrypoint: [ '/bin/bash', '-c' ] - command: [ 'coolconfig generate-proof-key && /start-collabora-online.sh' ] healthcheck: - test: - [ - "CMD", - "bash", - "-c", - "exec 3<>/dev/tcp/127.0.0.1/9980 && printf 'GET /hosting/discovery HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 && cat <&3 | head -1 | grep -q '200 OK'" - ] + test: ["CMD", "/usr/bin/coolwsd", "--probe"] interval: 15s timeout: 10s retries: 5 From 27fd36711308bf41e87aa80c676b3375e80de4cf Mon Sep 17 00:00:00 2001 From: micbar Date: Fri, 24 Jul 2026 12:13:55 +0200 Subject: [PATCH 2/2] feat: add proof key side car --- weboffice/collabora.yml | 57 +++++++++++++++++++++++++++++++++++------ 1 file changed, 49 insertions(+), 8 deletions(-) diff --git a/weboffice/collabora.yml b/weboffice/collabora.yml index 417fe2b3..ae36fbee 100644 --- a/weboffice/collabora.yml +++ b/weboffice/collabora.yml @@ -23,22 +23,50 @@ services: COLLABORATION_APP_INSECURE: "${INSECURE:-true}" COLLABORATION_CS3API_DATAGATEWAY_INSECURE: "${INSECURE:-true}" + # One-shot service that generates the WOPI proof key on first start and + # keeps it in a named volume, like the proofKeyGeneration feature of the + # collabora-online helm chart. + # To rotate the key, remove the volume and start again: + # docker compose down collabora && docker volume rm _collabora-proof-key + collabora-proof-key: + image: alpine/openssl:3.5.7 + entrypoint: ["/bin/sh"] + command: + - -ec + - | + if [ ! -s /proof/proof_key ]; then + openssl genrsa -traditional -out /proof/proof_key.tmp 4096 + chown 1001:1001 /proof/proof_key.tmp + chmod 400 /proof/proof_key.tmp + mv /proof/proof_key.tmp /proof/proof_key + echo "WOPI proof key generated" + else + echo "WOPI proof key already exists" + fi + volumes: + - collabora-proof-key:/proof + logging: + driver: ${LOG_DRIVER:-local} + restart: "no" + collabora: image: collabora/code:26.04.2.3.1 # release notes: https://www.collaboraonline.com/release-notes/ networks: opencloud-net: + depends_on: + collabora-proof-key: + condition: service_completed_successfully environment: # WOPI host allowlist; the WOPI endpoint is served by the opencloud proxy on the opencloud domain aliasgroup1: https://${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} - DONT_GEN_SSL_CERT: "YES" extra_params: > - --o:ssl.enable=${COLLABORA_SSL_ENABLE:-true} - --o:ssl.ssl_verification=${COLLABORA_SSL_VERIFICATION:-true} - --o:ssl.termination=true - --o:welcome.enable=false - --o:net.frame_ancestors=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} - --o:net.lok_allow.host[14]=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} + --o:ssl.enable=${COLLABORA_SSL_ENABLE:-true} + --o:ssl.ssl_verification=${COLLABORA_SSL_VERIFICATION:-true} + --o:ssl.termination=true + --o:welcome.enable=false + --o:net.frame_ancestors=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} + --o:net.lok_allow.host[14]=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} --o:home_mode.enable=${COLLABORA_HOME_MODE:-false} username: ${COLLABORA_ADMIN_USER:-admin} password: ${COLLABORA_ADMIN_PASSWORD:-admin} @@ -52,11 +80,24 @@ services: # (e.g. Microsoft fonts like Arial, Calibri, Cambria by installing the `ttf-mscorefonts-installer` package). - /usr/share/fonts/truetype:/usr/share/fonts/truetype/more:ro - /usr/share/fonts/truetype:/opt/cool/systemplate/usr/share/fonts/truetype/more:ro + # WOPI proof key generated by the collabora-proof-key service. + - type: volume + source: collabora-proof-key + target: /etc/coolwsd/proof_key + read_only: true + volume: + subpath: proof_key logging: driver: ${LOG_DRIVER:-local} restart: always healthcheck: - test: ["CMD", "/usr/bin/coolwsd", "--probe"] + # --use-env-vars makes the probe read extra_params, so it probes with + # the same http/https scheme the server actually runs with; without it + # the probe falls back to coolwsd.xml where ssl.enable defaults to true + test: ["CMD", "/usr/bin/coolwsd", "--probe", "--use-env-vars"] interval: 15s timeout: 10s retries: 5 + +volumes: + collabora-proof-key: