add env and readme for configuring admin

This allows subdomains or separate domains - a convenience for setups that have a wildcard pointing at the CC server.

.drone.yml

@@ -33,7 +33,7 @@ steps:
         from_secret: drone_abra-bot_token
       fork: true
       repositories:
-        - coop-cloud/auto-recipes-catalogue-json
+        - toolshed/auto-recipes-catalogue-json
 
 trigger:
   event: tag

.env.sample

@@ -1,7 +1,18 @@
 TYPE=cryptpad
 
+
 DOMAIN=cryptpad.example.com
 
+# This is a separate domain for the secure side of Cryptpad. It can be any other domain (subdomain or separate domain)
+SANDBOX_DOMAIN=sandbox.cryptpad.example.com
+
+# CRYPTPAD_ADMIN_KEYS
+## here is an example of the format for one single key
+# CRYPTPAD_ADMIN_KEYS= '"[user1@cryptpad.cctest.autonomic.zone/zew-WaKZimxhNSL3iiVL8SCzVzPB8KhIxZNrRKn+uRo=]",'
+## here is an example of the format for multiple keys (including here because it was confusing to me)
+# CRYPTPAD_ADMIN_KEYS='"[user1@cryptpad.cctest.autonomic.zone/zew-WaKZimxhNSL3iiVL8SCzVzPB8KhIxZNrRKn+uRo=]","[user2@cryptpad.cctest.autonomic.zone/Z7agNvwPXHm9xuEYOYV2YY53fSofgzum86xvhUxJ4nU=]",'
+
+
 ## Domain aliases
 #EXTRA_DOMAINS=', `www.cryptpad.example.com`'
 LETS_ENCRYPT_ENV=production

.gitignore

@@ -1 +1,2 @@
 .envrc
+.idea

README.md

@@ -26,5 +26,19 @@
 5. `abra app deploy YOURAPPDOMAIN`
 6. Open the configured domain in your browser to finish set-up
 
+At this point, anyone with this domain can register new users with this cryptpad instance.
+
+After you have registered a first user, here is how you can make this user into an admin.
+After logging in as your user, go to: https://cryptpad.cctest.autonomic.zone/profile/
+
+Click "Copy Public Key". This will copy your public key into your clipboard. 
+Then run `abra app config YOURAPPDOMAIN` and set the value of CRYPTPAD_ADMIN_KEYS
+to include your public key. The example in .env.sample shows the required format. 
+
+Then redeploy with `abra app deploy YOURAPPDOMAIN --force`. 
+
+Now when you login as your user, and visit https://cryptpad.cctest.autonomic.zone/admin/,
+you should be able to access the admin interface for this cryptpad instance. 
+
 [`abra`]: https://git.coopcloud.tech/coop-cloud/abra
-[`coop-cloud/traefik`]: https://git.coopcloud.tech/coop-cloud/traefik
+[`coop-cloud/traefik`]: https://git.coopcloud.tech/coop-cloud/traefik

abra.sh

@@ -1 +1,3 @@
-export CONFIG_VERSION=v1
+export CONFIG_VERSION=v2
+export CONFIG_JS_VERSION=v2
+export NGINX_CONF_VERSION=v1

compose.yml

@@ -3,17 +3,18 @@ version: "3.8"
 
 services:
   app:
-    image: cryptpad/cryptpad:version-2024.3.0
+    image: cryptpad/cryptpad:version-2025.9.0
     networks:
-      - proxy
+      - backend
     environment:
+      - CRYPTPAD_ADMIN_KEYS
       - "CPAD_MAIN_DOMAIN=${DOMAIN}"
-      - "CPAD_SANDBOX_DOMAIN=sandbox.${DOMAIN}"
-      # Traefik can't use HTTP2 to communicate with cryptpat_websocket
+      - "CPAD_SANDBOX_DOMAIN=${SANDBOX_DOMAIN}"
+      # Traefik can't use HTTP2 to communicate with cryptpad_websocket
       # A workaroung is disabling HTTP2 in Nginx
       - "CPAD_HTTP2_DISABLE=true"
-      - "CPAD_REALIP_RECURSIVE=on"
-      - "CPAD_REALIP_HEADER=X-Real-Ip"
+      - "CPAD_TRUST_PROXY=1"
+      - "CPAD_CONF=/cryptpad/config/config.js"
 
     volumes:
       - cryptpad_blob:/cryptpad/blob
@@ -30,18 +31,9 @@ services:
       restart_policy:
         condition: on-failure
       labels:
-        - "traefik.enable=true"
-        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
-        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`, `sandbox.${DOMAIN}`${EXTRA_DOMAINS})"
-        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
-        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-          #        - "traefik.http.routers.${STACK_NAME}.tls.domains[0].main=${DOMAIN}"
-          #        - "traefik.http.routers.${STACK_NAME}.tls.domains[0].sans=sandbox.${DOMAIN}"
-        ## Redirect from EXTRA_DOMAINS to DOMAIN
-        #- "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
-        #- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLForceHost=true"
-        #- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
-        - "coop-cloud.${STACK_NAME}.version=0.4.0+version-2024.3.0"
+        - "traefik.enable=false"
+        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
+        - "coop-cloud.${STACK_NAME}.version=0.4.1+version-2025.9.0"
     # healthcheck:
     #   test: ["CMD", "curl", "-f", "http://localhost"]
     #   interval: 30s
@@ -49,9 +41,32 @@ services:
     #   retries: 10
     #   start_period: 1m
 
+  web:
+    image: nginx:1.25
+    configs:
+      - source: nginx_conf
+        target: /etc/nginx/conf.d/default.conf
+    networks:
+      proxy:
+      backend:
+    depends_on:
+      - app
+    environment:
+      - STACK_NAME
+    deploy:
+      labels:
+        - "traefik.enable=true"
+        - "traefik.docker.network=proxy"
+        - "traefik.http.routers.${STACK_NAME}.tls=true"
+        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8083"
+        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`, `${SANDBOX_DOMAIN}` ${EXTRA_DOMAINS})"
+        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
+
 networks:
   proxy:
     external: true
+  backend:
 
 volumes:
   cryptpad_blob:
@@ -66,3 +81,7 @@ configs:
     name: ${STACK_NAME}_config_${CONFIG_VERSION}
     file: config.js.tmpl
     template_driver: golang
+  nginx_conf:
+    name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION}
+    file: nginx.conf.tmpl
+    template_driver: golang

config.js.tmpl

@@ -67,7 +67,7 @@ module.exports = {
  *
  *  CUSTOMIZE AND UNCOMMENT THIS FOR PRODUCTION INSTALLATIONS.
  */
-    httpSafeOrigin: "https://{{ env "CPAD_SANDBOX_DOMAIN" }}",
+    httpSafeOrigin: 'https://{{ env "CPAD_SANDBOX_DOMAIN" }}',
 
 /*  httpAddress specifies the address on which the nodejs server
  *  should be accessible. By default it will listen on 127.0.0.1
@@ -75,7 +75,7 @@ module.exports = {
  *  all addresses, including IPv6, set this to '::'.
  *
  */
-    //httpAddress: '::',
+    httpAddress: '::',
 
 /*  httpPort specifies on which port the nodejs server should listen.
  *  By default it will serve content over port 3000, which is suitable
@@ -111,11 +111,9 @@ module.exports = {
      *  key, which can be found on the settings page for registered users.
      *  Entries should be strings separated by a comma.
      */
-/*
     adminKeys: [
-        //"[cryptpad-user1@my.awesome.website/YZgXQxKR0Rcb6r6CmxHPdAGLVludrAF2lEnkbx1vVOo=]",
+        {{ env "CRYPTPAD_ADMIN_KEYS" }}
     ],
-*/
 
     /* =====================
      *        STORAGE

nginx.conf.tmpl

@@ -0,0 +1,39 @@
+server {
+    listen 8083;
+    server_name localhost;
+
+    access_log /var/log/cpad.log;
+    error_log /var/log/cpad-error.log;
+    #access_log /dev/null;
+    #error_log /dev/null emerg;
+
+    # Main CryptPad app
+    location / {
+        proxy_pass http://{{ env "STACK_NAME" }}_app:3000;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        client_max_body_size 150m;
+
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection upgrade;
+    }
+
+    # WebSocket endpoint
+    location ^~ /cryptpad_websocket {
+        proxy_pass http://{{ env "STACK_NAME" }}_app:3003;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection upgrade;
+    }
+}