From cbe8c1d5b43fa45c9409173be595bb115bb8419d Mon Sep 17 00:00:00 2001 From: Linus Gasser Date: Sat, 24 Oct 2026 01:11:08 +0200 Subject: [PATCH 1/2] Moving to 2026.10.0 This is only a test. --- .env.sample | 2 +- README.md | 6 +++--- abra.sh | 8 ++++---- compose.yml | 8 ++++---- config.js.tmpl | 4 ++-- nginx.conf.tmpl | 2 +- onlyoffice-entrypoint.sh | 2 +- release/1.0.0+v2026.10.0 | 15 +++++++++++++++ sso-entrypoint.sh | 7 ++++++- 9 files changed, 37 insertions(+), 17 deletions(-) create mode 100644 release/1.0.0+v2026.10.0 diff --git a/.env.sample b/.env.sample index 7b1f51a..237e923 100644 --- a/.env.sample +++ b/.env.sample @@ -31,7 +31,7 @@ LETS_ENCRYPT_ENV=production #SSO_CLIENT_ID=cryptpad #SSO_CLIENT_SECRET_VERSION=v1 #SSO_JWT_ALG=RS256 -#SSO_PLUGIN_VERSION=0.4.0 +#SSO_PLUGIN_VERSION=1.0.0 ## Adding OnlyOffice to cryptpad #COMPOSE_FILE="$COMPOSE_FILE:compose.onlyoffice.yaml" diff --git a/README.md b/README.md index fd011ec..4318087 100644 --- a/README.md +++ b/README.md @@ -74,15 +74,15 @@ OnlyOffice support is provided by `compose.onlyoffice.yaml`. Enable it by adding COMPOSE_FILE="compose.yml:compose.onlyoffice.yaml" ``` -On the next deploy, an entrypoint wrapper (`onlyoffice-entrypoint.sh`) prepares the OnlyOffice config volume **before** CryptPad starts, then the app container runs `install-onlyoffice.sh` to download the OnlyOffice assets. Running the prep work inside the app container (rather than a separate init service) is necessary because Docker Swarm ignores `depends_on` at runtime — a sidecar init container would race the app. +On the next deploy, an entrypoint wrapper (`onlyoffice-entrypoint.sh`) prepares the OnlyOffice config volume **before** CryptPad starts, then the app container runs `install-office.sh` to download the OnlyOffice assets. Running the prep work inside the app container (rather than a separate init service) is necessary because Docker Swarm ignores `depends_on` at runtime — a sidecar init container would race the app. -To support opening documents created with older OnlyOffice versions, set `ONLYOFFICE_OLDEST` in your app config. This writes (or updates) `oldest_needed_version` in `onlyoffice-conf/onlyoffice.properties`, which `install-onlyoffice.sh` reads to fetch older versions in addition to the latest: +To support opening documents created with older OnlyOffice versions, set `ONLYOFFICE_OLDEST` in your app config. This writes (or updates) `oldest_needed_version` in `onlyoffice-conf/onlyoffice.properties`, which `install-office.sh` reads to fetch older versions in addition to the latest: ``` ONLYOFFICE_OLDEST=v6 ``` -If `ONLYOFFICE_OLDEST` is unset, `onlyoffice.properties` is left untouched (CryptPad's own default applies). Only the `oldest_needed_version` key is touched on each deploy, so any other entries in `onlyoffice.properties` are preserved. If you change `ONLYOFFICE_OLDEST` after the assets have already been downloaded, you may need to drop the `cryptpad_oo_dist` volume so `install-onlyoffice.sh` re-runs and pulls the additional versions. +If `ONLYOFFICE_OLDEST` is unset, `onlyoffice.properties` is left untouched (CryptPad's own default applies). Only the `oldest_needed_version` key is touched on each deploy, so any other entries in `onlyoffice.properties` are preserved. If you change `ONLYOFFICE_OLDEST` after the assets have already been downloaded, you may need to drop the `cryptpad_oo_dist` volume so `install-office.sh` re-runs and pulls the additional versions. [`abra`]: https://git.coopcloud.tech/coop-cloud/abra [`coop-cloud/traefik`]: https://git.coopcloud.tech/coop-cloud/traefik \ No newline at end of file diff --git a/abra.sh b/abra.sh index 814d000..5848e46 100644 --- a/abra.sh +++ b/abra.sh @@ -1,7 +1,7 @@ -export CONFIG_VERSION=v2 +export CONFIG_VERSION=v3 export CONFIG_JS_VERSION=v2 -export NGINX_CONF_VERSION=v1 -export SSO_ENTRYPOINT_VERSION=v6 +export NGINX_CONF_VERSION=v2 +export SSO_ENTRYPOINT_VERSION=v7 export SSO_JS_VERSION=v3 export APP_CONFIG_JS_VERSION=v1 -export ONLYOFFICE_ENTRYPOINT_VERSION=v1 +export ONLYOFFICE_ENTRYPOINT_VERSION=v2 diff --git a/compose.yml b/compose.yml index e3a555c..14c66a1 100644 --- a/compose.yml +++ b/compose.yml @@ -3,14 +3,14 @@ version: "3.8" services: app: - image: cryptpad/cryptpad:version-2026.5.1 + image: cryptpad/cryptpad:version-2026.10.0 command: ["npm", "start"] networks: - backend environment: - CRYPTPAD_ADMIN_KEYS - - "CPAD_MAIN_DOMAIN=${DOMAIN}" - - "CPAD_SANDBOX_DOMAIN=${SANDBOX_DOMAIN}" + - "CPAD_MAIN_DOMAIN=https://${DOMAIN}" + - "CPAD_SANDBOX_DOMAIN=https://${SANDBOX_DOMAIN}" # Traefik can't use HTTP2 to communicate with cryptpad_websocket # A workaroung is disabling HTTP2 in Nginx - "CPAD_HTTP2_DISABLE=true" @@ -36,7 +36,7 @@ services: labels: - "traefik.enable=false" - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}" - - "coop-cloud.${STACK_NAME}.version=0.6.0+v2026.5.1" + - "coop-cloud.${STACK_NAME}.version=1.0.0+v2026.10.0" - "backupbot.backup=true" healthcheck: test: ["CMD", "curl", "-f", "http://localhost:3000"] diff --git a/config.js.tmpl b/config.js.tmpl index 0559779..295e2f3 100644 --- a/config.js.tmpl +++ b/config.js.tmpl @@ -46,7 +46,7 @@ module.exports = { * cryptpad/docs/example.nginx.conf (see the $main_domain variable) * */ - httpUnsafeOrigin: 'https://{{ env "CPAD_MAIN_DOMAIN" }}', + httpUnsafeOrigin: '{{ env "CPAD_MAIN_DOMAIN" }}', /* httpSafeOrigin is the URL that is used for the 'sandbox' described above. * If you're testing or developing with CryptPad on your local machine then @@ -67,7 +67,7 @@ module.exports = { * * CUSTOMIZE AND UNCOMMENT THIS FOR PRODUCTION INSTALLATIONS. */ - httpSafeOrigin: 'https://{{ env "CPAD_SANDBOX_DOMAIN" }}', + httpSafeOrigin: '{{ env "CPAD_SANDBOX_DOMAIN" }}', /* httpAddress specifies the address on which the nodejs server * should be accessible. By default it will listen on 127.0.0.1 diff --git a/nginx.conf.tmpl b/nginx.conf.tmpl index 3fee226..a8437d9 100644 --- a/nginx.conf.tmpl +++ b/nginx.conf.tmpl @@ -25,7 +25,7 @@ server { # WebSocket endpoint location ^~ /cryptpad_websocket { - proxy_pass http://{{ env "STACK_NAME" }}_app:3003; + proxy_pass http://{{ env "STACK_NAME" }}_app:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; diff --git a/onlyoffice-entrypoint.sh b/onlyoffice-entrypoint.sh index 6ce6241..e2032c4 100644 --- a/onlyoffice-entrypoint.sh +++ b/onlyoffice-entrypoint.sh @@ -3,7 +3,7 @@ set -e # OnlyOffice init — runs before the original CryptPad entrypoint. # Ensures oldest_needed_version in onlyoffice.properties matches -# ONLYOFFICE_OLDEST before install-onlyoffice.sh / CryptPad reads it. +# ONLYOFFICE_OLDEST before install-office.sh / CryptPad reads it. CONF_DIR="/cryptpad/onlyoffice-conf" PROPS="${CONF_DIR}/onlyoffice.properties" diff --git a/release/1.0.0+v2026.10.0 b/release/1.0.0+v2026.10.0 new file mode 100644 index 0000000..659bd8e --- /dev/null +++ b/release/1.0.0+v2026.10.0 @@ -0,0 +1,15 @@ +CryptPad 2026.10.0 ships a rewritten server (cryptpad-server). Upstream notes: +https://github.com/cryptpad/cryptpad/releases/tag/2026.10.0 + +Recipe changes: +- The websocket is now served on the main HTTP port (3000); the bundled nginx + config is updated (NGINX_CONF_VERSION=v2). +- CPAD_MAIN_DOMAIN / CPAD_SANDBOX_DOMAIN now include the https:// scheme, as + the new server reads them directly. Nothing to change in your .env. +- On first start the image creates config/infra.js from the example; the + origins, bind address and ports are taken from the env vars above. +- Office apps are now based on Euro-Office 9.3 (install-office.sh). Existing + OnlyOffice deployments keep working; new assets are downloaded on start. +- SSO: the plugin must be upgraded to 1.0.0. If your .env pins + SSO_PLUGIN_VERSION to an older version, set SSO_PLUGIN_VERSION=1.0.0. + The plugin's npm dependencies are now installed by sso-entrypoint.sh. diff --git a/sso-entrypoint.sh b/sso-entrypoint.sh index 015976e..872e1a3 100644 --- a/sso-entrypoint.sh +++ b/sso-entrypoint.sh @@ -13,7 +13,7 @@ fi PLUGIN_DIR="/cryptpad/lib/plugins/sso" VERSION_FILE="${PLUGIN_DIR}/.version" -SSO_PLUGIN_VERSION="${SSO_PLUGIN_VERSION:-0.4.0}" +SSO_PLUGIN_VERSION="${SSO_PLUGIN_VERSION:-1.0.0}" # Copy SSO config template into place (mounted as Docker config) if [ -f /sso.js ]; then @@ -29,6 +29,11 @@ else rm -rf "${PLUGIN_DIR}" git clone --depth 1 --branch "${SSO_PLUGIN_VERSION}" \ https://github.com/cryptpad/sso.git "${PLUGIN_DIR}" + # Since CryptPad 2026.10.0 the plugin's dependencies (openid-client, + # node-saml, ...) are no longer bundled with CryptPad itself. + if [ -f "${PLUGIN_DIR}/package.json" ]; then + (cd "${PLUGIN_DIR}" && npm ci --omit=dev) + fi echo "${SSO_PLUGIN_VERSION}" > "${VERSION_FILE}" echo "[sso-entrypoint] SSO plugin installed" fi -- 2.54.0 From 84a9b01df169a0ac2048cc5a7bc91f4536797f62 Mon Sep 17 00:00:00 2001 From: Linus Gasser Date: Sat, 24 Oct 2026 01:41:10 +0200 Subject: [PATCH 2/2] Fixing access rights --- abra.sh | 3 ++- compose.sso.yml | 2 +- compose.yml | 6 ++++++ infra.js.tmpl | 32 ++++++++++++++++++++++++++++++++ release/1.0.0+v2026.10.0 | 5 +++-- sso-entrypoint.sh | 7 ++----- 6 files changed, 46 insertions(+), 9 deletions(-) create mode 100644 infra.js.tmpl diff --git a/abra.sh b/abra.sh index 5848e46..d6da55f 100644 --- a/abra.sh +++ b/abra.sh @@ -1,7 +1,8 @@ export CONFIG_VERSION=v3 export CONFIG_JS_VERSION=v2 export NGINX_CONF_VERSION=v2 -export SSO_ENTRYPOINT_VERSION=v7 +export INFRA_JS_VERSION=v1 +export SSO_ENTRYPOINT_VERSION=v8 export SSO_JS_VERSION=v3 export APP_CONFIG_JS_VERSION=v1 export ONLYOFFICE_ENTRYPOINT_VERSION=v2 diff --git a/compose.sso.yml b/compose.sso.yml index 3a295b8..103900c 100644 --- a/compose.sso.yml +++ b/compose.sso.yml @@ -21,7 +21,7 @@ services: target: /sso-entrypoint.sh mode: 0755 - source: sso_js - target: /sso.js + target: /cryptpad/config/sso.js volumes: cryptpad_plugins: diff --git a/compose.yml b/compose.yml index 14c66a1..d01635a 100644 --- a/compose.yml +++ b/compose.yml @@ -27,6 +27,8 @@ services: configs: - source: config_js target: /cryptpad/config/config.js + - source: infra_js + target: /cryptpad/config/infra.js - source: app_config_js target: /cryptpad/customize/application_config.js @@ -85,6 +87,10 @@ configs: name: ${STACK_NAME}_config_${CONFIG_VERSION} file: config.js.tmpl template_driver: golang + infra_js: + name: ${STACK_NAME}_infra_js_${INFRA_JS_VERSION} + file: infra.js.tmpl + template_driver: golang nginx_conf: name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION} file: nginx.conf.tmpl diff --git a/infra.js.tmpl b/infra.js.tmpl new file mode 100644 index 0000000..76810dc --- /dev/null +++ b/infra.js.tmpl @@ -0,0 +1,32 @@ +// CryptPad infrastructure configuration (cryptpad-server, since 2026.10.0) +// Based on config.local/infra.example.js from the image. +// +// Provided as a Docker config because /cryptpad/config is root-owned in the +// image: docker-entrypoint.sh cannot create this file itself. +// Note: lib/load-config.js additionally overrides origin/sandboxOrigin and +// binds all nodes to 0.0.0.0 when CPAD_MAIN_DOMAIN is set. + +module.exports = { + "public": { + origin: "{{ env "CPAD_MAIN_DOMAIN" }}", + sandboxOrigin: "{{ env "CPAD_SANDBOX_DOMAIN" }}", + httpHost: "0.0.0.0", + httpPort: 3000, + httpSafePort: 3001, + externalWebsocketURL: undefined, + fileHost: undefined, + httpServerId: "", + }, + "front": [ + { host: "0.0.0.0", port: 3010 }, + { host: "0.0.0.0", port: 3011 }, + ], + "core": [ + { host: "0.0.0.0", port: 3020 }, + { host: "0.0.0.0", port: 3021 }, + ], + "storage": [ + { host: "0.0.0.0", port: 3030, wsPort: 3040 }, + { host: "0.0.0.0", port: 3031, wsPort: 3041 }, + ] +}; diff --git a/release/1.0.0+v2026.10.0 b/release/1.0.0+v2026.10.0 index 659bd8e..af0107a 100644 --- a/release/1.0.0+v2026.10.0 +++ b/release/1.0.0+v2026.10.0 @@ -6,8 +6,9 @@ Recipe changes: config is updated (NGINX_CONF_VERSION=v2). - CPAD_MAIN_DOMAIN / CPAD_SANDBOX_DOMAIN now include the https:// scheme, as the new server reads them directly. Nothing to change in your .env. -- On first start the image creates config/infra.js from the example; the - origins, bind address and ports are taken from the env vars above. +- /cryptpad/config is now root-owned in the image, so nothing can be written + there at runtime. config/infra.js (new) and config/sso.js are therefore + mounted as Docker configs (INFRA_JS_VERSION=v1) instead of being copied. - Office apps are now based on Euro-Office 9.3 (install-office.sh). Existing OnlyOffice deployments keep working; new assets are downloaded on start. - SSO: the plugin must be upgraded to 1.0.0. If your .env pins diff --git a/sso-entrypoint.sh b/sso-entrypoint.sh index 872e1a3..bdbf6aa 100644 --- a/sso-entrypoint.sh +++ b/sso-entrypoint.sh @@ -15,11 +15,8 @@ PLUGIN_DIR="/cryptpad/lib/plugins/sso" VERSION_FILE="${PLUGIN_DIR}/.version" SSO_PLUGIN_VERSION="${SSO_PLUGIN_VERSION:-1.0.0}" -# Copy SSO config template into place (mounted as Docker config) -if [ -f /sso.js ]; then - cp /sso.js /cryptpad/config/sso.js - echo "[sso-entrypoint] Copied sso.js config into /cryptpad/config/sso.js" -fi +# sso.js is mounted directly at /cryptpad/config/sso.js as a Docker config: +# since CryptPad 2026.10.0, /cryptpad/config is root-owned and not writable. # Install/update the SSO plugin if [ -f "${VERSION_FILE}" ] && [ "$(cat "${VERSION_FILE}")" = "${SSO_PLUGIN_VERSION}" ]; then -- 2.54.0