diff --git a/.drone.yml b/.drone.yml
index e76fc20..7cc1874 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -3,10 +3,12 @@ kind: pipeline
 name: deploy to swarm-test.autonomic.zone
 steps:
   - name: deployment
-    image: decentral1se/stack-ssh-deploy:latest
+    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
     settings:
       host: swarm-test.autonomic.zone
       stack: collabora
+      networks:
+       - proxy
       generate_secrets: true
       purge: true
       deploy_key:
@@ -16,17 +18,24 @@ steps:
       STACK_NAME: collabora
       LETS_ENCRYPT_ENV: production
       NGINX_CONF_VERSION: v1
-      LOOLWSD_XML_VERSION: v1
+      COOLWSD_XML_VERSION: v1
+      SECRET_ADMIN_PASSWORD_VERSION: v1
 trigger:
   branch:
     - main
 ---
 kind: pipeline
-name: recipe release
+name: generate recipe catalogue
 steps:
   - name: release a new version
-    image: thecoopcloud/drone-abra:latest
+    image: plugins/downstream
     settings:
-      command: recipe collabora release
-      deploy_key:
-        from_secret: abra_bot_deploy_key
+      server: https://build.coopcloud.tech
+      token:
+        from_secret: drone_abra-bot_token
+      fork: true
+      repositories:
+        - coop-cloud/auto-recipes-catalogue-json
+
+trigger:
+  event: tag
diff --git a/.env.sample b/.env.sample
index d33f855..28ae38e 100644
--- a/.env.sample
+++ b/.env.sample
@@ -4,3 +4,4 @@ LETS_ENCRYPT_ENV=production
 NEXTCLOUD_DOMAIN=nextcloud.example.com
 ADMIN_USERNAME=admin
 SECRET_ADMIN_PASSWORD_VERSION=v1
+FRAME_ANCESTORS=
diff --git a/README.md b/README.md
index 4ce600e..44eb663 100644
--- a/README.md
+++ b/README.md
@@ -18,9 +18,9 @@
 
 1. Set up Docker Swarm and [`abra`](https://git.autonomic.zone/coop-cloud/abra)
 1. Deploy [`coop-cloud/traefik`](https://git.autonomic.zone/coop-cloud/traefik)
-1. `abra app YOURAPPDOMAIN config` - be sure to change `$DOMAIN` to something that resolves to
+1. `abra app config YOURAPPDOMAIN` - be sure to change `$DOMAIN` to something that resolves to
    your Docker swarm box
-1. `abra app YOURAPPDOMAIN deploy`
+1. `abra app deploy YOURAPPDOMAIN`
 
 ## Acknowledgements
 
diff --git a/abra.sh b/abra.sh
index b44d613..895aa1e 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,2 +1,2 @@
 export NGINX_CONF_VERSION=v2
-export COOLWSD_XML_VERSION=v1
+export COOLWSD_XML_VERSION=v2
diff --git a/compose.yml b/compose.yml
index 03306f1..1529ba1 100644
--- a/compose.yml
+++ b/compose.yml
@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   web:
-    image: "nginx:1.22.1"
+    image: "nginx:1.23.3"
     environment:
       - STACK_NAME
       - DOMAIN=${DOMAIN}
@@ -24,7 +24,7 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
 
   app:
-    image: "collabora/code:22.05.8.2.1"
+    image: "collabora/code:22.05.10.1.1"
     cap_add:
       - MKNOD
     secrets:
@@ -39,11 +39,12 @@ services:
       - DOMAIN=${DOMAIN}
       - DONT_GEN_SSL_CERT=true
       - NEXTCLOUD_DOMAIN=${NEXTCLOUD_DOMAIN}
+      - FRAME_ANCESTORS
     networks:
       - internal
     deploy:
       labels:
-        - "coop-cloud.${STACK_NAME}.version=2.1.2+22.05.8.2.1"
+        - "coop-cloud.${STACK_NAME}.version=2.2.0+22.05.10.1.1"
 
 networks:
   proxy:
diff --git a/coolwsd.xml.tmpl b/coolwsd.xml.tmpl
index 2e2e3e4..3f5fad0 100644
--- a/coolwsd.xml.tmpl
+++ b/coolwsd.xml.tmpl
@@ -125,7 +125,7 @@
         <host desc="The IPv4 private 10.0.0.0/8 subnet (Podman).">10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
         <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
       </post_allow>
-      <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (coolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors>
+      <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (coolwsd and WOPI host are always allowed). Separate multiple hosts by space.">{{ env "FRAME_ANCESTORS" }}</frame_ancestors>
       <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by coolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs>
 
       <!-- this setting radically changes how online works, it should not be used in a production environment -->