avm/hassio-addons
1
0
Fork 0
mirror of https://github.com/alexbelgium/hassio-addons.git synced 2026-08-20 20:07:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(collabora): pass server_name to Collabora, fix aliasgroup escaping and version numbering

Browse Source 
Reported in #2768: several users could not get Collabora to talk to
Nextcloud, and the two options meant to configure it had no effect.

- 99-run.sh read a `domain` option that does not exist in the schema (the
  option is `domain1`), and recent Collabora releases dropped the `domain`
  environment variable entirely, so `domain1` was inert. It now maps to
  `server_name` with a deprecation warning.
- `server_name` and `cert_domain` were in the schema but never passed to
  Collabora. `server_name` is what fixes "Your browser has been unable to
  connect to the Collabora server" behind a reverse proxy.
- `aliasgroup*` entries are matched by Collabora as regular expressions, so
  a dot needs a single backslash. The README asked for two, which can never
  match a real hostname. Values are now normalised (unescaped, escaped and
  double-escaped all give the same correct pattern) and logged at startup.
  Values containing other regex metacharacters are left untouched.
- Added `ssl_termination`, needed when `ssl` is false but Collabora is
  reached over https through a reverse proxy, and `aliasgroup2`/`aliasgroup3`.
- `cert_domain` is a certificate common name, so it is a string, not a bool.
- Releases on CollaboraOnline/online are now Helm charts only, which had
  renumbered the addon from 25.4.9.2 down to 1.3.0 and hid updates from the
  Supervisor. Version tracking moves back to the collabora/code Docker Hub
  tags.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
alexbelgium
2026-07-26 17:26:24 +02:00
parent 26d922de3e
commit 6a27361cef
5 changed files with 148 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
collabora/CHANGELOG.md
View File

@@ -1,4 +1,14 @@
## 26.04.2.4.1 (2026-07-26)
- Fix version numbering: releases on CollaboraOnline/online are now Helm charts only, which had renumbered the addon from 25.4.9.2 down to 1.3.0 and hid updates. The version is tracked from the collabora/code Docker Hub tags again
- `server_name` is now passed to Collabora, fixing `Your browser has been unable to connect to the Collabora server` behind a reverse proxy
- `domain1` was never passed to Collabora at all (the script read a `domain` option that does not exist, and recent Collabora releases dropped that variable). It is now deprecated and applied as `server_name`
- `aliasgroup*` values are normalised: unescaped, escaped and double-escaped dots all produce the correct regex, and the value handed to Collabora is printed in the log
- Added `ssl_termination`, needed when `ssl` is false but Collabora is reached over https through a reverse proxy
- Added `aliasgroup2` and `aliasgroup3` for additional Nextcloud servers
- `cert_domain` is now a string (it is a certificate common name) and is passed to Collabora
- Documented the above, and corrected the README which asked for two backslashes where Collabora expects one
## 1.3.0 (2026-07-16)
- Update to latest version from CollaboraOnline/online (changelog : https://github.com/CollaboraOnline/online/releases)

65
collabora/README.md
View File

@@ -52,22 +52,63 @@ Webui can be found at `https://homeassistant:9980/browser/dist/admin/admin.html`
| Option | Type | Default | Description |
|--------|------|---------|-------------|
| `aliasgroup1` | str | | Nextcloud external domain with escaped dots using two \ (e.g. `nextcloud_domain\\.com`) |
| `domain1` | str | | Collabora external domain with escaped dots using two \ (e.g. `code_domain\\.com`) |
| `aliasgroup1` | str | | External address of the **Nextcloud** server allowed to use this Collabora (e.g. `https://nextcloud_domain\.com:443`) |
| `aliasgroup2` | str | | A second Nextcloud server, same format as `aliasgroup1` |
| `aliasgroup3` | str | | A third Nextcloud server, same format as `aliasgroup1` |
| `server_name` | str | | External hostname (and port) of **this Collabora** server, as the browser reaches it (e.g. `code_domain.com:9980`). Set it when Collabora sits behind a reverse proxy |
| `ssl_termination` | bool | `false` | Set to `true` when `ssl` is `false` but the browser reaches Collabora over `https` through a reverse proxy |
| `extra_params` | str | | Extra parameters passed to the Collabora start script |
| `ssl` | bool | `false` | Enable SSL using certificates from /ssl |
| `certfile` | str | `fullchain.pem` | Certificate file name located in /ssl |
| `keyfile` | str | `privkey.pem` | Private key file name located in /ssl |
| `cert_domain` | str | | Common name of the self-signed certificate generated when `ssl` is `false` |
| `username` | str | | Username for the Collabora admin console |
| `password` | str | | Password for the Collabora admin console |
| `dictionaries` | str | | Space-separated list of dictionary languages to install |
| `domain1` | str | | **Deprecated**, use `server_name` instead |
#### About the escaped dots in `aliasgroup*`
Collabora matches the `aliasgroup*` addresses as **regular expressions**, so a dot
has to be escaped with a **single** backslash: `next\.duckdns\.org`, not
`next\\.duckdns\\.org`. A doubled backslash means "a literal backslash followed by
any character", which never matches a real hostname, and Collabora then rejects the
Nextcloud server.
Earlier versions of this page asked for two backslashes, which was wrong. The add-on
now normalises whatever you type, so `next.duckdns.org`, `next\.duckdns\.org` and
`next\\.duckdns\\.org` all end up as the same correct pattern. The value that is
really handed to Collabora is printed in the add-on log at startup:
```text
Allowed Nextcloud host aliasgroup1: https://next\.duckdns\.org:443
```
Values containing other regex characters (`*`, `|`, `(`, `[`, …) are left untouched,
so hand-written patterns keep working.
`server_name` is **not** a regular expression: write it as a plain hostname, without
backslashes.
### Example configuration
Nextcloud on `https://next.duckdns.org` and Collabora reachable on
`https://code.duckdns.org:9980`, with a reverse proxy handling the certificates:
```yaml
aliasgroup1: nextcloud_domain\\.com
domain1: code_domain\\.com
extra_params: ""
aliasgroup1: https://next\.duckdns\.org:443
server_name: code.duckdns.org:9980
ssl_termination: true
ssl: false
username: admin
password: changeme
```
Same setup, but letting the add-on serve the certificates itself from `/ssl`:
```yaml
aliasgroup1: https://next\.duckdns\.org:443
server_name: code.duckdns.org:9980
ssl: true
certfile: fullchain.pem
keyfile: privkey.pem
@@ -81,7 +122,19 @@ password: changeme
1. Start the add-on and expose the Collabora server to an external domain.
1. Install and configure the Nextcloud add-on.
1. Inside Nextcloud, install the **Nextcloud Office** app.
1. In Nextcloud **Administration Settings → Office**, set the Collabora server URL to `https://yourdomain:9980` and enable **Disable certificate validation**.
1. In Nextcloud **Administration Settings → Office**, set the Collabora server URL to
the **Collabora** address, not the Nextcloud one — with the example above that is
`https://code.duckdns.org:9980` — and enable **Disable certificate validation** if
the add-on serves a self-signed certificate.
1. Add both hostnames to the Nextcloud `trusted_domains`.
The two hostnames have different roles, and swapping them is the most common cause of
`Could not establish connection to the Collabora Online server`:
- `aliasgroup1` is the **Nextcloud** address, it tells Collabora which server is
allowed to ask it to open documents.
- `server_name` is the **Collabora** address, it tells Collabora which URL to hand
back to the browser.
### Custom Scripts and Environment Variables

9
collabora/config.yaml
View File

@@ -15,7 +15,7 @@ options:
env_vars: []
aliasgroup1: ""
certfile: fullchain.pem
domain1: ""
server_name: ""
extra_params:
--o:ssl.enable=false --o:user_interface.use_integration_theme=false
--o:net.proto=IPv4
@@ -33,7 +33,9 @@ schema:
value: str?
TZ: str?
aliasgroup1: str
cert_domain: bool?
aliasgroup2: str?
aliasgroup3: str?
cert_domain: str?
certfile: str
dictionaries: str?
domain1: str?
@@ -42,8 +44,9 @@ schema:
password: password
server_name: str?
ssl: bool
ssl_termination: bool?
username: str
slug: collabora
url: https://github.com/alexbelgium/hassio-addons
version: "1.3.0"
version: "26.04.2.4.1"
webui: "[PROTO:ssl]://[HOST]:[PORT:9980]/browser/dist/admin/admin.html"

78
collabora/rootfs/etc/cont-init.d/99-run.sh
View File

@@ -2,9 +2,58 @@
# shellcheck shell=bash
set -e
if bashio::config.has_value 'domain'; then
domain="$(bashio::config 'domain')"
export domain
# coolwsd matches storage.wopi.alias_groups host/alias entries as regular
# expressions, so every dot has to be escaped with a single backslash. The value
# is typed by hand in the add-on options, where it is easy to end up with no
# escaping at all or with doubled backslashes, and a wrong pattern silently
# never matches: Collabora then refuses the Nextcloud host. Accept all three
# spellings and always hand coolwsd the canonical single-escaped form.
REGEX_METACHARACTERS='][(){}|*+?^$'
normalise_wopi_host() {
local value="$1"
# A value containing regex metacharacters was written by someone who knows
# what they are doing, leave it exactly as-is.
if [[ "$value" == *["$REGEX_METACHARACTERS"]* ]]; then
printf '%s' "$value"
return
fi
value="${value//\\/}" # drop whatever escaping was typed, at any depth
value="${value//./\\.}" # re-escape every dot exactly once
printf '%s' "$value"
}
# server_name is a literal "hostname[:port]", not a regex and not a URL
normalise_server_name() {
local value="$1"
value="${value//\\/}" # never escaped, drop backslashes if any were copied over
value="${value#*://}" # strip the scheme
value="${value%%/*}" # strip any path
printf '%s' "$value"
}
for index in 1 2 3; do
if bashio::config.has_value "aliasgroup${index}"; then
aliasgroup="$(normalise_wopi_host "$(bashio::config "aliasgroup${index}")")"
export "aliasgroup${index}=${aliasgroup}"
bashio::log.info "Allowed Nextcloud host aliasgroup${index}: ${aliasgroup}"
fi
done
if bashio::config.has_value 'server_name'; then
server_name="$(normalise_server_name "$(bashio::config 'server_name')")"
export server_name
elif bashio::config.has_value 'domain1'; then
# domain1 predates server_name and was documented as "the Collabora external
# domain", which is what server_name means to coolwsd. It was never actually
# passed to Collabora, so honour it here rather than keep ignoring it.
server_name="$(normalise_server_name "$(bashio::config 'domain1')")"
export server_name
bashio::log.warning "domain1 is deprecated, please use server_name instead"
fi
if bashio::config.has_value 'server_name' || bashio::config.has_value 'domain1'; then
bashio::log.info "Collabora public hostname (server_name): ${server_name}"
fi
if bashio::config.has_value 'username'; then
@@ -17,9 +66,9 @@ if bashio::config.has_value 'password'; then
export password
fi
if bashio::config.has_value 'aliasgroup1'; then
aliasgroup1="$(bashio::config 'aliasgroup1')"
export aliasgroup1
if bashio::config.has_value 'cert_domain'; then
cert_domain="$(bashio::config 'cert_domain')"
export cert_domain
fi
if bashio::config.has_value 'dictionaries'; then
@@ -45,16 +94,25 @@ if bashio::config.true 'ssl'; then
bashio::log.error "Key file /ssl/${keyfile} not found"
exit 1
fi
cp -f /ssl/${keyfile} /etc/coolwsd/key.pem
cp -f /ssl/${certfile} /etc/coolwsd/cert.pem
cp -f /ssl/${certfile} /etc/coolwsd/ca-chain.cert.pem
cp -f "/ssl/${keyfile}" /etc/coolwsd/key.pem
cp -f "/ssl/${certfile}" /etc/coolwsd/cert.pem
cp -f "/ssl/${certfile}" /etc/coolwsd/ca-chain.cert.pem
extra_params="${extra_params/--o:ssl.enable=false/}"
extra_params="${extra_params} \
--o:ssl.enable=true
--o:ssl.enable=true \
--o:ssl.termination=false \
--o:ssl.cert_file_path=/ssl/${certfile} \
--o:ssl.key_file_path=/ssl/${keyfile} \
--o:ssl.ca_file_path=/ssl/${certfile}"
elif [[ "$extra_params" != *ssl.termination* ]]; then
# coolwsd defaults ssl.termination to false, so with ssl disabled it builds
# http:// and ws:// URLs even when the browser reached it over https through
# a reverse proxy, and the browser then refuses the connection.
if bashio::config.true 'ssl_termination'; then
extra_params="${extra_params} --o:ssl.termination=true"
elif ! bashio::config.has_value 'ssl_termination'; then
bashio::log.notice "If Collabora is reached over https through a reverse proxy, set ssl_termination to true"
fi
fi
export extra_params

9
collabora/updater.json
View File

@@ -1,8 +1,9 @@
{
"last_update": "2026-07-16",
"github_exclude": "sha256",
"last_update": "2026-07-26",
"repository": "alexbelgium/hassio-addons",
"slug": "collabora",
"source": "github",
"upstream_repo": "CollaboraOnline/online",
"upstream_version": "1.3.0"
"source": "dockerhub",
"upstream_repo": "collabora/code",
"upstream_version": "26.04.2.4.1"
}