Merge pull request 'chore: Configure Renovate' (#7) from renovate/configure into main

Reviewed-on: coop-cloud/cryptpad#7

.drone.yml

@@ -33,7 +33,7 @@ steps:
         from_secret: drone_abra-bot_token
       fork: true
       repositories:
-        - coop-cloud/auto-recipes-catalogue-json
+        - toolshed/auto-recipes-catalogue-json
 
 trigger:
   event: tag

.env.sample

@@ -1,7 +1,40 @@
 TYPE=cryptpad
 
+COMPOSE_FILE="compose.yml"
+
 DOMAIN=cryptpad.example.com
 
+# This is a separate domain for the secure side of Cryptpad. It can be any other domain (subdomain or separate domain)
+SANDBOX_DOMAIN=sandbox.cryptpad.example.com
+
+# CRYPTPAD_ADMIN_KEYS
+## here is an example of the format for one single key
+# CRYPTPAD_ADMIN_KEYS= '"[user1@cryptpad.cctest.autonomic.zone/zew-WaKZimxhNSL3iiVL8SCzVzPB8KhIxZNrRKn+uRo=]",'
+## here is an example of the format for multiple keys (including here because it was confusing to me)
+# CRYPTPAD_ADMIN_KEYS='"[user1@cryptpad.cctest.autonomic.zone/zew-WaKZimxhNSL3iiVL8SCzVzPB8KhIxZNrRKn+uRo=]","[user2@cryptpad.cctest.autonomic.zone/Z7agNvwPXHm9xuEYOYV2YY53fSofgzum86xvhUxJ4nU=]",'
+
+
 ## Domain aliases
 #EXTRA_DOMAINS=', `www.cryptpad.example.com`'
 LETS_ENCRYPT_ENV=production
+
+## Set to true to block unregistered users from accessing any CryptPad applications
+## See https://docs.cryptpad.org/en/admin_guide/customization.html#restricting-guest-access
+#RESTRICT_GUEST_ACCESS=false
+
+## SSO / OIDC (optional — uncomment below and add compose.sso.yml to COMPOSE_FILE to enable)
+# COMPOSE_FILE="$COMPOSE_FILE:compose.sso.yml"
+#SSO_ENABLED=true
+#SSO_ENFORCED=false
+#SSO_PROVIDER_NAME=Authentik
+#SSO_OIDC_URL=https://authentik.example.com/application/o/cryptpad
+#SSO_CLIENT_ID=cryptpad
+#SSO_CLIENT_SECRET_VERSION=v1
+#SSO_JWT_ALG=RS256
+#SSO_PLUGIN_VERSION=0.4.0
+
+## Adding OnlyOffice to cryptpad
+#COMPOSE_FILE="$COMPOSE_FILE:compose.onlyoffice.yaml"
+## Enables installation of older onlyoffice versions so that older documents
+## can also be loaded and converted.
+#ONLYOFFICE_OLDEST=v6

.gitignore

@@ -1 +1,2 @@
 .envrc
+.idea

README.md

@@ -5,13 +5,13 @@
 <!-- metadata -->
 
 * **Category**: Apps
-* **Status**: 0
+* **Status**: 3
 * **Image**: cryptpad/cryptpad
-* **Healthcheck**: No
-* **Backups**: No
+* **Healthcheck**: Yes
+* **Backups**: Yes
 * **Email**: No
 * **Tests**: No
-* **SSO**: No
+* **SSO**: Yes
 
 <!-- endmetadata -->
 
@@ -26,5 +26,63 @@
 5. `abra app deploy YOURAPPDOMAIN`
 6. Open the configured domain in your browser to finish set-up
 
+At this point, anyone with this domain can register new users with this cryptpad instance.
+
+After you have registered a first user, here is how you can make this user into an admin.
+After logging in as your user, go to: https://cryptpad.cctest.autonomic.zone/profile/
+
+Click "Copy Public Key". This will copy your public key into your clipboard. 
+Then run `abra app config YOURAPPDOMAIN` and set the value of CRYPTPAD_ADMIN_KEYS
+to include your public key. The example in .env.sample shows the required format. 
+
+Then redeploy with `abra app deploy YOURAPPDOMAIN --force`. 
+
+Now when you login as your user, and visit https://cryptpad.cctest.autonomic.zone/admin/,
+you should be able to access the admin interface for this cryptpad instance. 
+
+## SSO
+
+SSO support is provided by `compose.sso.yml`. To enable it, add the SSO compose file and set the SSO variables in your app config:
+
+```
+COMPOSE_FILE="compose.yml:compose.sso.yml"
+SSO_ENABLED=true
+```
+
+On the next deploy, the [CryptPad SSO plugin](https://github.com/cryptpad/sso) will be installed automatically.
+
+You also need to configure the remaining SSO environment variables for your OIDC provider:
+
+- `SSO_PROVIDER_NAME` — display name shown on the login button (e.g. `Keycloak`, `Authentik`)
+- `SSO_OIDC_URL` — OIDC discovery URL for your provider
+- `SSO_CLIENT_ID` — OAuth2 client ID
+- `SSO_JWT_ALG` — JWT signing algorithm (e.g. `RS256`)
+
+The client secret is stored as a Docker secret. Insert it with:
+
+```
+abra app secret insert YOURAPPDOMAIN sso_client_s v1 YOUR_CLIENT_SECRET
+```
+
+Then deploy (or redeploy) to apply: `abra app deploy YOURAPPDOMAIN --force`.
+
+## OnlyOffice
+
+OnlyOffice support is provided by `compose.onlyoffice.yaml`. Enable it by adding the compose file to your app config:
+
+```
+COMPOSE_FILE="compose.yml:compose.onlyoffice.yaml"
+```
+
+On the next deploy, an entrypoint wrapper (`onlyoffice-entrypoint.sh`) prepares the OnlyOffice config volume **before** CryptPad starts, then the app container runs `install-onlyoffice.sh` to download the OnlyOffice assets. Running the prep work inside the app container (rather than a separate init service) is necessary because Docker Swarm ignores `depends_on` at runtime — a sidecar init container would race the app.
+
+To support opening documents created with older OnlyOffice versions, set `ONLYOFFICE_OLDEST` in your app config. This writes (or updates) `oldest_needed_version` in `onlyoffice-conf/onlyoffice.properties`, which `install-onlyoffice.sh` reads to fetch older versions in addition to the latest:
+
+```
+ONLYOFFICE_OLDEST=v6
+```
+
+If `ONLYOFFICE_OLDEST` is unset, `onlyoffice.properties` is left untouched (CryptPad's own default applies). Only the `oldest_needed_version` key is touched on each deploy, so any other entries in `onlyoffice.properties` are preserved. If you change `ONLYOFFICE_OLDEST` after the assets have already been downloaded, you may need to drop the `cryptpad_oo_dist` volume so `install-onlyoffice.sh` re-runs and pulls the additional versions.
+
 [`abra`]: https://git.coopcloud.tech/coop-cloud/abra
-[`coop-cloud/traefik`]: https://git.coopcloud.tech/coop-cloud/traefik
+[`coop-cloud/traefik`]: https://git.coopcloud.tech/coop-cloud/traefik

abra.sh

@@ -1 +1,7 @@
-export CONFIG_VERSION=v1
+export CONFIG_VERSION=v2
+export CONFIG_JS_VERSION=v2
+export NGINX_CONF_VERSION=v1
+export SSO_ENTRYPOINT_VERSION=v6
+export SSO_JS_VERSION=v3
+export APP_CONFIG_JS_VERSION=v1
+export ONLYOFFICE_ENTRYPOINT_VERSION=v1

application_config.js.tmpl

@@ -0,0 +1,24 @@
+// CryptPad application customization — generated from environment variables
+// See https://docs.cryptpad.org/en/admin_guide/customization.html
+// For default file, see: https://github.com/cryptpad/cryptpad/blob/main/customize.dist/application_config.js
+
+(() => {
+const factory = (AppConfig) => {
+    {{ if eq (env "RESTRICT_GUEST_ACCESS") "true" }}
+    // Block unregistered users from accessing any applications
+    AppConfig.registeredOnlyTypes = AppConfig.availablePadTypes.slice();
+    {{ end }}
+
+    return AppConfig;
+};
+
+// Do not change code below
+if (typeof(module) !== 'undefined' && module.exports) {
+    module.exports = factory(
+        require('../www/common/application_config_internal.js')
+    );
+} else if ((typeof(define) !== 'undefined' && define !== null) && (define.amd !== null)) {
+    define(['/common/application_config_internal.js'], factory);
+}
+
+})();

compose.onlyoffice.yaml

@@ -0,0 +1,48 @@
+version: "3.8"
+
+services:
+  init-onlyoffice-dirs:
+    image: busybox
+    user: root
+    command:
+      - sh
+      - -eu
+      - -c
+      - |
+        mkdir -p /cryptpad/www/common/onlyoffice/dist /cryptpad/onlyoffice-conf
+        chown -R 4001:4001 \
+          /cryptpad/www/common/onlyoffice/dist \
+          /cryptpad/onlyoffice-conf
+        exec tail -f /dev/null
+    volumes:
+      - cryptpad_oo_dist:/cryptpad/www/common/onlyoffice/dist
+      - cryptpad_oo_conf:/cryptpad/onlyoffice-conf/
+
+  app:
+    # onlyoffice-entrypoint.sh auto-chains through /sso-entrypoint.sh if
+    # compose.sso.yml is also loaded, so order of COMPOSE_FILE doesn't matter.
+    entrypoint:
+      - /onlyoffice-entrypoint.sh
+      - /cryptpad/docker-entrypoint.sh
+    environment:
+      - "CPAD_INSTALL_ONLYOFFICE=yes"
+      - ONLYOFFICE_OLDEST
+    volumes:
+      - cryptpad_oo_dist:/cryptpad/www/common/onlyoffice/dist
+      - cryptpad_oo_conf:/cryptpad/onlyoffice-conf/
+    configs:
+      - source: onlyoffice_entrypoint
+        target: /onlyoffice-entrypoint.sh
+        mode: 0755
+    deploy:
+      labels:
+        - "backupbot.backup.volumes.cryptpad_oo_dist=false"
+
+volumes:
+  cryptpad_oo_dist:
+  cryptpad_oo_conf:
+
+configs:
+  onlyoffice_entrypoint:
+    name: ${STACK_NAME}_onlyoffice_entrypoint_${ONLYOFFICE_ENTRYPOINT_VERSION}
+    file: onlyoffice-entrypoint.sh

compose.sso.yml

@@ -0,0 +1,41 @@
+---
+version: "3.8"
+
+services:
+  app:
+    entrypoint: ["/sso-entrypoint.sh", "/cryptpad/docker-entrypoint.sh"]
+    environment:
+      - SSO_PLUGIN_VERSION
+      - "SSO_ENABLED=${SSO_ENABLED:-false}"
+      - SSO_ENFORCED
+      - SSO_PROVIDER_NAME
+      - SSO_OIDC_URL
+      - SSO_CLIENT_ID
+      - SSO_JWT_ALG
+    secrets:
+      - sso_client_s
+    volumes:
+      - cryptpad_plugins:/cryptpad/lib/plugins
+    configs:
+      - source: sso_entrypoint
+        target: /sso-entrypoint.sh
+        mode: 0755
+      - source: sso_js
+        target: /sso.js
+
+volumes:
+  cryptpad_plugins:
+
+secrets:
+  sso_client_s:
+    external: true
+    name: ${STACK_NAME}_sso_client_s_${SSO_CLIENT_SECRET_VERSION}
+
+configs:
+  sso_entrypoint:
+    name: ${STACK_NAME}_sso_entrypoint_${SSO_ENTRYPOINT_VERSION}
+    file: sso-entrypoint.sh
+  sso_js:
+    name: ${STACK_NAME}_sso_js_${SSO_JS_VERSION}
+    file: sso.js.tmpl
+    template_driver: golang

compose.yml

@@ -3,18 +3,20 @@ version: "3.8"
 
 services:
   app:
-    image: cryptpad/cryptpad:version-2024.3.0
+    image: cryptpad/cryptpad:version-2026.5.1
+    command: ["npm", "start"]
     networks:
-      - proxy
+      - backend
     environment:
+      - CRYPTPAD_ADMIN_KEYS
       - "CPAD_MAIN_DOMAIN=${DOMAIN}"
-      - "CPAD_SANDBOX_DOMAIN=sandbox.${DOMAIN}"
-      # Traefik can't use HTTP2 to communicate with cryptpat_websocket
+      - "CPAD_SANDBOX_DOMAIN=${SANDBOX_DOMAIN}"
+      # Traefik can't use HTTP2 to communicate with cryptpad_websocket
       # A workaroung is disabling HTTP2 in Nginx
       - "CPAD_HTTP2_DISABLE=true"
-      - "CPAD_REALIP_RECURSIVE=on"
-      - "CPAD_REALIP_HEADER=X-Real-Ip"
-
+      - "CPAD_TRUST_PROXY=1"
+      - "CPAD_CONF=/cryptpad/config/config.js"
+      - "RESTRICT_GUEST_ACCESS=${RESTRICT_GUEST_ACCESS:-false}"
     volumes:
       - cryptpad_blob:/cryptpad/blob
       - cryptpad_block:/cryptpad/block
@@ -25,33 +27,50 @@ services:
     configs:
       - source: config_js
         target: /cryptpad/config/config.js
+      - source: app_config_js
+        target: /cryptpad/customize/application_config.js
 
     deploy:
       restart_policy:
         condition: on-failure
+      labels:
+        - "traefik.enable=false"
+        - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
+        - "coop-cloud.${STACK_NAME}.version=0.6.0+v2026.5.1"
+        - "backupbot.backup=true"
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3000"]
+      interval: 30s
+      timeout: 10s
+      retries: 10
+      start_period: 1m
+
+  web:
+    image: nginx:1.31
+    configs:
+      - source: nginx_conf
+        target: /etc/nginx/conf.d/default.conf
+    networks:
+      proxy:
+      backend:
+    depends_on:
+      - app
+    environment:
+      - STACK_NAME
+    deploy:
       labels:
         - "traefik.enable=true"
-        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
-        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`, `sandbox.${DOMAIN}`${EXTRA_DOMAINS})"
-        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
+        - "traefik.docker.network=proxy"
+        - "traefik.http.routers.${STACK_NAME}.tls=true"
+        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8083"
+        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`, `${SANDBOX_DOMAIN}` ${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-          #        - "traefik.http.routers.${STACK_NAME}.tls.domains[0].main=${DOMAIN}"
-          #        - "traefik.http.routers.${STACK_NAME}.tls.domains[0].sans=sandbox.${DOMAIN}"
-        ## Redirect from EXTRA_DOMAINS to DOMAIN
-        #- "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
-        #- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLForceHost=true"
-        #- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
-        - "coop-cloud.${STACK_NAME}.version=0.4.0+version-2024.3.0"
-    # healthcheck:
-    #   test: ["CMD", "curl", "-f", "http://localhost"]
-    #   interval: 30s
-    #   timeout: 10s
-    #   retries: 10
-    #   start_period: 1m
+        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
 
 networks:
   proxy:
     external: true
+  backend:
 
 volumes:
   cryptpad_blob:
@@ -66,3 +85,11 @@ configs:
     name: ${STACK_NAME}_config_${CONFIG_VERSION}
     file: config.js.tmpl
     template_driver: golang
+  nginx_conf:
+    name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION}
+    file: nginx.conf.tmpl
+    template_driver: golang
+  app_config_js:
+    name: ${STACK_NAME}_app_config_js_${APP_CONFIG_JS_VERSION}
+    file: application_config.js.tmpl
+    template_driver: golang

config.js.tmpl

@@ -67,7 +67,7 @@ module.exports = {
  *
  *  CUSTOMIZE AND UNCOMMENT THIS FOR PRODUCTION INSTALLATIONS.
  */
-    httpSafeOrigin: "https://{{ env "CPAD_SANDBOX_DOMAIN" }}",
+    httpSafeOrigin: 'https://{{ env "CPAD_SANDBOX_DOMAIN" }}',
 
 /*  httpAddress specifies the address on which the nodejs server
  *  should be accessible. By default it will listen on 127.0.0.1
@@ -75,7 +75,7 @@ module.exports = {
  *  all addresses, including IPv6, set this to '::'.
  *
  */
-    //httpAddress: '::',
+    httpAddress: '::',
 
 /*  httpPort specifies on which port the nodejs server should listen.
  *  By default it will serve content over port 3000, which is suitable
@@ -111,11 +111,9 @@ module.exports = {
      *  key, which can be found on the settings page for registered users.
      *  Entries should be strings separated by a comma.
      */
-/*
     adminKeys: [
-        //"[cryptpad-user1@my.awesome.website/YZgXQxKR0Rcb6r6CmxHPdAGLVludrAF2lEnkbx1vVOo=]",
+        {{ env "CRYPTPAD_ADMIN_KEYS" }}
     ],
-*/
 
     /* =====================
      *        STORAGE

nginx.conf.tmpl

@@ -0,0 +1,39 @@
+server {
+    listen 8083;
+    server_name localhost;
+
+    access_log /var/log/cpad.log;
+    error_log /var/log/cpad-error.log;
+    #access_log /dev/null;
+    #error_log /dev/null emerg;
+
+    # Main CryptPad app
+    location / {
+        proxy_pass http://{{ env "STACK_NAME" }}_app:3000;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        client_max_body_size 150m;
+
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection upgrade;
+    }
+
+    # WebSocket endpoint
+    location ^~ /cryptpad_websocket {
+        proxy_pass http://{{ env "STACK_NAME" }}_app:3003;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection upgrade;
+    }
+}

onlyoffice-entrypoint.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+set -e
+
+# OnlyOffice init — runs before the original CryptPad entrypoint.
+# Ensures oldest_needed_version in onlyoffice.properties matches
+# ONLYOFFICE_OLDEST before install-onlyoffice.sh / CryptPad reads it.
+
+CONF_DIR="/cryptpad/onlyoffice-conf"
+PROPS="${CONF_DIR}/onlyoffice.properties"
+
+# Wait for init-onlyoffice-dirs to chown the volumes. Swarm ignores
+# depends_on, so the init sidecar and this container start in parallel.
+waited=0
+while [ ! -w "${CONF_DIR}" ]; do
+  if [ "${waited}" -ge 60 ]; then
+    echo "[onlyoffice-entrypoint] timed out waiting for ${CONF_DIR} to become writable" >&2
+    exit 1
+  fi
+  echo "[onlyoffice-entrypoint] waiting for ${CONF_DIR} to be writable (${waited}s)"
+  sleep 1
+  waited=$((waited + 1))
+done
+
+if [ -n "${ONLYOFFICE_OLDEST:-}" ]; then
+  mkdir -p "${CONF_DIR}"
+  touch "${PROPS}"
+  if grep -q '^oldest_needed_version=' "${PROPS}"; then
+    sed -i "s|^oldest_needed_version=.*|oldest_needed_version=${ONLYOFFICE_OLDEST}|" "${PROPS}"
+  else
+    echo "oldest_needed_version=${ONLYOFFICE_OLDEST}" >> "${PROPS}"
+  fi
+  echo "[onlyoffice-entrypoint] oldest_needed_version=${ONLYOFFICE_OLDEST}"
+else
+  echo "[onlyoffice-entrypoint] ONLYOFFICE_OLDEST unset, leaving ${PROPS} untouched"
+fi
+
+# Chain through the SSO entrypoint if compose.sso.yml mounted it.
+if [ -x /sso-entrypoint.sh ]; then
+  exec /sso-entrypoint.sh "$@"
+fi
+
+exec "$@"

renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}

sso-entrypoint.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+set -e
+
+# SSO plugin installer — runs before the original CryptPad entrypoint.
+# Clones the cryptpad/sso plugin into the plugins volume if not already present
+# or if the version has changed.
+
+# Skips SSO setup entirely when SSO_ENABLED is not "true".
+if [ "${SSO_ENABLED}" != "true" ]; then
+  echo "[sso-entrypoint] SSO not enabled, skipping plugin install"
+  exec "$@"
+fi
+
+PLUGIN_DIR="/cryptpad/lib/plugins/sso"
+VERSION_FILE="${PLUGIN_DIR}/.version"
+SSO_PLUGIN_VERSION="${SSO_PLUGIN_VERSION:-0.4.0}"
+
+# Copy SSO config template into place (mounted as Docker config)
+if [ -f /sso.js ]; then
+  cp /sso.js /cryptpad/config/sso.js
+  echo "[sso-entrypoint] Copied sso.js config into /cryptpad/config/sso.js"
+fi
+
+# Install/update the SSO plugin
+if [ -f "${VERSION_FILE}" ] && [ "$(cat "${VERSION_FILE}")" = "${SSO_PLUGIN_VERSION}" ]; then
+  echo "[sso-entrypoint] SSO plugin ${SSO_PLUGIN_VERSION} already installed"
+else
+  echo "[sso-entrypoint] Installing SSO plugin ${SSO_PLUGIN_VERSION} ..."
+  rm -rf "${PLUGIN_DIR}"
+  git clone --depth 1 --branch "${SSO_PLUGIN_VERSION}" \
+    https://github.com/cryptpad/sso.git "${PLUGIN_DIR}"
+  echo "${SSO_PLUGIN_VERSION}" > "${VERSION_FILE}"
+  echo "[sso-entrypoint] SSO plugin installed"
+fi
+
+# Hand off to the original CryptPad entrypoint
+exec "$@"

sso.js.tmpl

@@ -0,0 +1,21 @@
+// CryptPad SSO configuration — generated from environment variables
+// See https://github.com/cryptpad/sso for documentation
+
+module.exports = {
+    enabled: "{{ env "SSO_ENABLED" }}" === "true",
+    enforced: "{{ env "SSO_ENFORCED" }}" === "true",
+    cpPassword: true,
+    forceCpPassword: false,
+    list: [
+        {
+            name: "{{ env "SSO_PROVIDER_NAME" }}",
+            type: "oidc",
+            url: "{{ env "SSO_OIDC_URL" }}",
+            client_id: "{{ env "SSO_CLIENT_ID" }}",
+            client_secret: "{{ secret "sso_client_s" }}",
+            id_token_alg: "{{ env "SSO_JWT_ALG" }}",
+            use_pkce: true,
+            use_nonce: true
+        }
+    ]
+};