From 11f199ffb8e3450b95931eedbc09427f770062bc Mon Sep 17 00:00:00 2001
From: stevensting <stefan@klasse-methode.it>
Date: Fri, 11 Sep 2026 20:46:35 +0200
Subject: [PATCH] remove nginx, collabora interfaces directly with traefik

---
 abra.sh          |  3 +--
 compose.yml      | 38 +++++----------------------
 coolwsd.xml.tmpl |  4 +--
 nginx.conf.tmpl  | 68 ------------------------------------------------
 4 files changed, 9 insertions(+), 104 deletions(-)
 delete mode 100644 nginx.conf.tmpl

diff --git a/abra.sh b/abra.sh
index 688a82f..65c7800 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,2 +1 @@
-export NGINX_CONF_VERSION=v3
-export COOLWSD_XML_VERSION=v3
+export COOLWSD_XML_VERSION=v4
diff --git a/compose.yml b/compose.yml
index af39a98..1645b7b 100644
--- a/compose.yml
+++ b/compose.yml
@@ -2,37 +2,6 @@
 version: "3.8"
 
 services:
-  web:
-    image: "nginx:1.31.5"
-    environment:
-      - STACK_NAME
-      - DOMAIN=${DOMAIN}
-    configs:
-      - source: nginx_conf
-        target: /etc/nginx/nginx.conf
-    networks:
-      - proxy
-      - internal
-    deploy:
-      update_config:
-        failure_action: rollback
-      labels:
-        - "traefik.enable=true"
-        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
-        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
-        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
-        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "curl -s -N localhost/hosting/capabilities |  grep Collabora",
-        ]
-      interval: 30s
-      timeout: 10s
-      retries: 10
-      start_period: 5m
-
   app:
     image: "collabora/code:26.04.3.2.1"
     cap_add:
@@ -58,11 +27,16 @@ services:
       - DICTIONARIES=${DICTIONARIES:-de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT}
       - extra_params=--o:ssl.enable=false --o:ssl.termination=true ${COLLABORA_ENV_PARAMS}
     networks:
-      - internal
+      - proxy
     deploy:
       labels:
         - "coop-cloud.${STACK_NAME}.version=4.2.3+25.04.9.4.1"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
+        - "traefik.enable=true"
+        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=9980"
+        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
+        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
+        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
 
 networks:
   proxy:
diff --git a/coolwsd.xml.tmpl b/coolwsd.xml.tmpl
index 6723f6d..c73d81f 100644
--- a/coolwsd.xml.tmpl
+++ b/coolwsd.xml.tmpl
@@ -52,7 +52,7 @@
 
     <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path>
     <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path>
-    <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true">false</mount_jail_tree>
+    <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree>
 
     <server_name desc="External hostname:port of the server running coolwsd. If empty, it's derived from the request (please set it if this doesn't work). May be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default=""></server_name>
     <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing cool." type="path" relative="true" default="browser/../"></file_server_root_path>
@@ -239,7 +239,7 @@
         <!-- switches from https:// + wss:// to http:// + ws:// -->
         <enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>
         <!-- SSL off-load can be done in a proxy, if so disable SSL, and enable termination below in production -->
-        <termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="false">false</termination>
+        <termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="false">true</termination>
         <cert_file_path desc="Path to the cert file" type="path" relative="false">/etc/coolwsd/cert.pem</cert_file_path>
         <key_file_path desc="Path to the key file" type="path" relative="false">/etc/coolwsd/key.pem</key_file_path>
         <ca_file_path desc="Path to the ca file" type="path" relative="false">/etc/coolwsd/ca-chain.cert.pem</ca_file_path>
diff --git a/nginx.conf.tmpl b/nginx.conf.tmpl
deleted file mode 100644
index e6e9625..0000000
--- a/nginx.conf.tmpl
+++ /dev/null
@@ -1,68 +0,0 @@
-user www-data;
-
-events {
-  worker_connections 768;
-}
-
-http {
-    resolver 127.0.0.11 valid=30s ipv6=off;
-    resolver_timeout 5s;
-
-    upstream collabora-upstream {
-      zone collabora-upstream 64k;
-      server {{ env "STACK_NAME" }}_app:9980 resolve;
-      keepalive 16;
-    }
-
-    server {
-      listen 80;
-      server_name {{ env "DOMAIN" }};
-
-      # static files
-      location ^~ /browser {
-        proxy_pass http://collabora-upstream;
-        proxy_set_header Host $http_host;
-      }
-
-
-      # WOPI discovery URL
-      location ^~ /hosting/discovery {
-        proxy_pass http://collabora-upstream;
-        proxy_set_header Host $http_host;
-      }
-
-
-      # Capabilities
-      location ^~ /hosting/capabilities {
-        proxy_pass http://collabora-upstream;
-        proxy_set_header Host $http_host;
-      }
-
-
-      # main websocket
-      location ~ ^/cool/(.*)/ws$ {
-        proxy_pass http://collabora-upstream;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "Upgrade";
-        proxy_set_header Host $http_host;
-        proxy_read_timeout 36000s;
-      }
-
-
-      # download, presentation and image upload
-      location ~ ^/(c|l)ool {
-        proxy_pass http://collabora-upstream;
-        proxy_set_header Host $http_host;
-      }
-
-
-       # Admin Console websocket
-       location ^~ /cool/adminws {
-        proxy_pass http://collabora-upstream;
-         proxy_set_header Upgrade $http_upgrade;
-         proxy_set_header Connection "Upgrade";
-         proxy_set_header Host $http_host;
-         proxy_read_timeout 36000s;
-       }
-    }
-}
-- 
2.54.0