coop-cloud/collabora
3
1
Fork 2
generated from coop-cloud/example
Code Issues 2 Pull Requests 1 Releases Wiki Activity

Remove nginx from recipe #17

Open
stevensting wants to merge 1 commits from remove-nginx into main
pull from: remove-nginx
merge into: :main
Conversation 2 Commits 1 Files Changed 4
+9 -104
4 changed files with 9 additions and 104 deletions
Download Patch File Download Diff File Expand all files Collapse all files
abra.sh
+1 -2
View File
@@ -1,2 +1 @@
export NGINX_CONF_VERSION=v3
export COOLWSD_XML_VERSION=v3
export COOLWSD_XML_VERSION=v4
compose.yml
+6 -32
View File
@@ -2,37 +2,6 @@
version: "3.8"
services:
web:
image: "nginx:1.31.5"
environment:
- STACK_NAME
- DOMAIN=${DOMAIN}
configs:
- source: nginx_conf
target: /etc/nginx/nginx.conf
networks:
- proxy
- internal
deploy:
update_config:
failure_action: rollback
labels:
- "traefik.enable=true"
- "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
- "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
- "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
- "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
healthcheck:
test:
[
"CMD-SHELL",
"curl -s -N localhost/hosting/capabilities | grep Collabora",
]
interval: 30s
timeout: 10s
retries: 10
start_period: 5m
app:
image: "collabora/code:26.04.3.2.1"
cap_add:
@@ -58,11 +27,16 @@ services:
- DICTIONARIES=${DICTIONARIES:-de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT}
- extra_params=--o:ssl.enable=false --o:ssl.termination=true ${COLLABORA_ENV_PARAMS}
networks:
- internal
- proxy
deploy:
labels:
- "coop-cloud.${STACK_NAME}.version=4.2.3+25.04.9.4.1"
- "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
- "traefik.enable=true"
- "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=9980"
- "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`)"
- "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
- "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
networks:
proxy:
coolwsd.xml.tmpl
+2 -2
View File
@@ -52,7 +52,7 @@
<sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path>
<child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path>
<mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true">false</mount_jail_tree>
<mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree>
<server_name desc="External hostname:port of the server running coolwsd. If empty, it's derived from the request (please set it if this doesn't work). May be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default=""></server_name>
<file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing cool." type="path" relative="true" default="browser/../"></file_server_root_path>
@@ -239,7 +239,7 @@
<!-- switches from https:// + wss:// to http:// + ws:// -->
<enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>
<!-- SSL off-load can be done in a proxy, if so disable SSL, and enable termination below in production -->
<termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="false">false</termination>
<termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="false">true</termination>
<cert_file_path desc="Path to the cert file" type="path" relative="false">/etc/coolwsd/cert.pem</cert_file_path>
<key_file_path desc="Path to the key file" type="path" relative="false">/etc/coolwsd/key.pem</key_file_path>
<ca_file_path desc="Path to the ca file" type="path" relative="false">/etc/coolwsd/ca-chain.cert.pem</ca_file_path>
nginx.conf.tmpl
-68
View File
@@ -1,68 +0,0 @@
user www-data;
events {
worker_connections 768;
}
http {
resolver 127.0.0.11 valid=30s ipv6=off;
resolver_timeout 5s;
upstream collabora-upstream {
zone collabora-upstream 64k;
server {{ env "STACK_NAME" }}_app:9980 resolve;
keepalive 16;
}
server {
listen 80;
server_name {{ env "DOMAIN" }};
# static files
location ^~ /browser {
proxy_pass http://collabora-upstream;
proxy_set_header Host $http_host;
}
# WOPI discovery URL
location ^~ /hosting/discovery {
proxy_pass http://collabora-upstream;
proxy_set_header Host $http_host;
}
# Capabilities
location ^~ /hosting/capabilities {
proxy_pass http://collabora-upstream;
proxy_set_header Host $http_host;
}
# main websocket
location ~ ^/cool/(.*)/ws$ {
proxy_pass http://collabora-upstream;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header Host $http_host;
proxy_read_timeout 36000s;
}
# download, presentation and image upload
location ~ ^/(c|l)ool {
proxy_pass http://collabora-upstream;
proxy_set_header Host $http_host;
}
# Admin Console websocket
location ^~ /cool/adminws {
moritz commented 2026-09-16 09:59:45 +00:00
Review
Copy Link
Copy Source

Do you know if there are any security considerations, by removing nginx?

Do you know if there are any security considerations, by removing nginx?
stevensting commented 2026-10-06 11:54:37 +00:00
Review
Copy Link
Copy Source

@decentral1se you originally added nginx. Do you have an opinion here?

@decentral1se you originally added nginx. Do you have an opinion here?
decentral1se commented 2026-10-06 12:02:47 +00:00
Review
Copy Link
Copy Source

Can't remember why I even did this, proceed! Thanks for the maintenance work 🙏

Can't remember why I even did this, proceed! Thanks for the maintenance work 🙏
stevensting commented 2026-10-06 12:13:42 +00:00
Review
Copy Link
Copy Source

from my point of view this should be fine, as collabora is intended to be run directly behind a reverse-proxy.
Maybe we could disable the admin console endpoint with the coolwsd directly or at least make it configureable with a disabled default. What do you think @moritz ?

from my point of view this should be fine, as collabora is intended to be run directly behind a reverse-proxy. Maybe we could disable the admin console endpoint with the coolwsd directly or at least make it configureable with a disabled default. What do you think @moritz ?
moritz commented 2026-10-12 11:31:27 +00:00
Review
Copy Link
Copy Source

I think it's an good idea to make the admin console configurable with a disabled default. But I'm not sure, what the other endpoints and proxy header options in the nginx configuration are doing exactly, and what would be the consequences without them.

I think it's an good idea to make the admin console configurable with a disabled default. But I'm not sure, what the other endpoints and proxy header options in the nginx configuration are doing exactly, and what would be the consequences without them.
stevensting commented 2026-10-20 08:56:35 +00:00
Review
Copy Link
Copy Source

Form my point of view all endpoints are non-critical and they should remain open for collabora to work.
^~ /browser static files like css
^~ /hosting/discovery WOPI discovery
^~ /hosting/capabilities info about the server
~ ^/cool/(.*)/ws$ main WOPI endpoint for document editing
~ ^/(c|l)ool downloads etc

The config made ngnix drops everything but the defined endpoints. If we wanted to, we could do it the same for the traefik config, but I would assume that isn't really necessary as collabora is designed to run public facing.
All other config params are already handled by traefik in default config, so no need to add anything.

Form my point of view all endpoints are non-critical and they should remain open for collabora to work. `^~ /browser` static files like css `^~ /hosting/discovery` WOPI discovery `^~ /hosting/capabilities` info about the server `~ ^/cool/(.*)/ws$` main WOPI endpoint for document editing `~ ^/(c|l)ool` downloads etc The config made ngnix drops everything but the defined endpoints. If we wanted to, we could do it the same for the traefik config, but I would assume that isn't really necessary as collabora is designed to run public facing. All other config params are already handled by traefik in default config, so no need to add anything.
proxy_pass http://collabora-upstream;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header Host $http_host;
proxy_read_timeout 36000s;
}
}
}