From 6a27361cefdd9527d5ac003b95826b71df850ab7 Mon Sep 17 00:00:00 2001 From: alexbelgium Date: Sun, 26 Jul 2026 17:26:24 +0200 Subject: [PATCH] fix(collabora): pass server_name to Collabora, fix aliasgroup escaping and version numbering Reported in #2768: several users could not get Collabora to talk to Nextcloud, and the two options meant to configure it had no effect. - 99-run.sh read a `domain` option that does not exist in the schema (the option is `domain1`), and recent Collabora releases dropped the `domain` environment variable entirely, so `domain1` was inert. It now maps to `server_name` with a deprecation warning. - `server_name` and `cert_domain` were in the schema but never passed to Collabora. `server_name` is what fixes "Your browser has been unable to connect to the Collabora server" behind a reverse proxy. - `aliasgroup*` entries are matched by Collabora as regular expressions, so a dot needs a single backslash. The README asked for two, which can never match a real hostname. Values are now normalised (unescaped, escaped and double-escaped all give the same correct pattern) and logged at startup. Values containing other regex metacharacters are left untouched. - Added `ssl_termination`, needed when `ssl` is false but Collabora is reached over https through a reverse proxy, and `aliasgroup2`/`aliasgroup3`. - `cert_domain` is a certificate common name, so it is a string, not a bool. - Releases on CollaboraOnline/online are now Helm charts only, which had renumbered the addon from 25.4.9.2 down to 1.3.0 and hid updates from the Supervisor. Version tracking moves back to the collabora/code Docker Hub tags. Co-Authored-By: Claude --- collabora/CHANGELOG.md | 10 +++ collabora/README.md | 65 ++++++++++++++++-- collabora/config.yaml | 9 ++- collabora/rootfs/etc/cont-init.d/99-run.sh | 78 +++++++++++++++++++--- collabora/updater.json | 9 +-- 5 files changed, 148 insertions(+), 23 deletions(-) diff --git a/collabora/CHANGELOG.md b/collabora/CHANGELOG.md index 116a541546..d5851e8d77 100644 --- a/collabora/CHANGELOG.md +++ b/collabora/CHANGELOG.md @@ -1,4 +1,14 @@ +## 26.04.2.4.1 (2026-07-26) +- Fix version numbering: releases on CollaboraOnline/online are now Helm charts only, which had renumbered the addon from 25.4.9.2 down to 1.3.0 and hid updates. The version is tracked from the collabora/code Docker Hub tags again +- `server_name` is now passed to Collabora, fixing `Your browser has been unable to connect to the Collabora server` behind a reverse proxy +- `domain1` was never passed to Collabora at all (the script read a `domain` option that does not exist, and recent Collabora releases dropped that variable). It is now deprecated and applied as `server_name` +- `aliasgroup*` values are normalised: unescaped, escaped and double-escaped dots all produce the correct regex, and the value handed to Collabora is printed in the log +- Added `ssl_termination`, needed when `ssl` is false but Collabora is reached over https through a reverse proxy +- Added `aliasgroup2` and `aliasgroup3` for additional Nextcloud servers +- `cert_domain` is now a string (it is a certificate common name) and is passed to Collabora +- Documented the above, and corrected the README which asked for two backslashes where Collabora expects one + ## 1.3.0 (2026-07-16) - Update to latest version from CollaboraOnline/online (changelog : https://github.com/CollaboraOnline/online/releases) diff --git a/collabora/README.md b/collabora/README.md index 51c96cf83f..c6f04f87eb 100644 --- a/collabora/README.md +++ b/collabora/README.md @@ -52,22 +52,63 @@ Webui can be found at `https://homeassistant:9980/browser/dist/admin/admin.html` | Option | Type | Default | Description | |--------|------|---------|-------------| -| `aliasgroup1` | str | | Nextcloud external domain with escaped dots using two \ (e.g. `nextcloud_domain\\.com`) | -| `domain1` | str | | Collabora external domain with escaped dots using two \ (e.g. `code_domain\\.com`) | +| `aliasgroup1` | str | | External address of the **Nextcloud** server allowed to use this Collabora (e.g. `https://nextcloud_domain\.com:443`) | +| `aliasgroup2` | str | | A second Nextcloud server, same format as `aliasgroup1` | +| `aliasgroup3` | str | | A third Nextcloud server, same format as `aliasgroup1` | +| `server_name` | str | | External hostname (and port) of **this Collabora** server, as the browser reaches it (e.g. `code_domain.com:9980`). Set it when Collabora sits behind a reverse proxy | +| `ssl_termination` | bool | `false` | Set to `true` when `ssl` is `false` but the browser reaches Collabora over `https` through a reverse proxy | | `extra_params` | str | | Extra parameters passed to the Collabora start script | | `ssl` | bool | `false` | Enable SSL using certificates from /ssl | | `certfile` | str | `fullchain.pem` | Certificate file name located in /ssl | | `keyfile` | str | `privkey.pem` | Private key file name located in /ssl | +| `cert_domain` | str | | Common name of the self-signed certificate generated when `ssl` is `false` | | `username` | str | | Username for the Collabora admin console | | `password` | str | | Password for the Collabora admin console | | `dictionaries` | str | | Space-separated list of dictionary languages to install | +| `domain1` | str | | **Deprecated**, use `server_name` instead | + +#### About the escaped dots in `aliasgroup*` + +Collabora matches the `aliasgroup*` addresses as **regular expressions**, so a dot +has to be escaped with a **single** backslash: `next\.duckdns\.org`, not +`next\\.duckdns\\.org`. A doubled backslash means "a literal backslash followed by +any character", which never matches a real hostname, and Collabora then rejects the +Nextcloud server. + +Earlier versions of this page asked for two backslashes, which was wrong. The add-on +now normalises whatever you type, so `next.duckdns.org`, `next\.duckdns\.org` and +`next\\.duckdns\\.org` all end up as the same correct pattern. The value that is +really handed to Collabora is printed in the add-on log at startup: + +```text +Allowed Nextcloud host aliasgroup1: https://next\.duckdns\.org:443 +``` + +Values containing other regex characters (`*`, `|`, `(`, `[`, …) are left untouched, +so hand-written patterns keep working. + +`server_name` is **not** a regular expression: write it as a plain hostname, without +backslashes. ### Example configuration +Nextcloud on `https://next.duckdns.org` and Collabora reachable on +`https://code.duckdns.org:9980`, with a reverse proxy handling the certificates: + ```yaml -aliasgroup1: nextcloud_domain\\.com -domain1: code_domain\\.com -extra_params: "" +aliasgroup1: https://next\.duckdns\.org:443 +server_name: code.duckdns.org:9980 +ssl_termination: true +ssl: false +username: admin +password: changeme +``` + +Same setup, but letting the add-on serve the certificates itself from `/ssl`: + +```yaml +aliasgroup1: https://next\.duckdns\.org:443 +server_name: code.duckdns.org:9980 ssl: true certfile: fullchain.pem keyfile: privkey.pem @@ -81,7 +122,19 @@ password: changeme 1. Start the add-on and expose the Collabora server to an external domain. 1. Install and configure the Nextcloud add-on. 1. Inside Nextcloud, install the **Nextcloud Office** app. -1. In Nextcloud **Administration Settings → Office**, set the Collabora server URL to `https://yourdomain:9980` and enable **Disable certificate validation**. +1. In Nextcloud **Administration Settings → Office**, set the Collabora server URL to + the **Collabora** address, not the Nextcloud one — with the example above that is + `https://code.duckdns.org:9980` — and enable **Disable certificate validation** if + the add-on serves a self-signed certificate. +1. Add both hostnames to the Nextcloud `trusted_domains`. + +The two hostnames have different roles, and swapping them is the most common cause of +`Could not establish connection to the Collabora Online server`: + +- `aliasgroup1` is the **Nextcloud** address, it tells Collabora which server is + allowed to ask it to open documents. +- `server_name` is the **Collabora** address, it tells Collabora which URL to hand + back to the browser. ### Custom Scripts and Environment Variables diff --git a/collabora/config.yaml b/collabora/config.yaml index a152277ecb..22ac07fc4d 100644 --- a/collabora/config.yaml +++ b/collabora/config.yaml @@ -15,7 +15,7 @@ options: env_vars: [] aliasgroup1: "" certfile: fullchain.pem - domain1: "" + server_name: "" extra_params: --o:ssl.enable=false --o:user_interface.use_integration_theme=false --o:net.proto=IPv4 @@ -33,7 +33,9 @@ schema: value: str? TZ: str? aliasgroup1: str - cert_domain: bool? + aliasgroup2: str? + aliasgroup3: str? + cert_domain: str? certfile: str dictionaries: str? domain1: str? @@ -42,8 +44,9 @@ schema: password: password server_name: str? ssl: bool + ssl_termination: bool? username: str slug: collabora url: https://github.com/alexbelgium/hassio-addons -version: "1.3.0" +version: "26.04.2.4.1" webui: "[PROTO:ssl]://[HOST]:[PORT:9980]/browser/dist/admin/admin.html" diff --git a/collabora/rootfs/etc/cont-init.d/99-run.sh b/collabora/rootfs/etc/cont-init.d/99-run.sh index c09ba1f182..952e6fceb1 100755 --- a/collabora/rootfs/etc/cont-init.d/99-run.sh +++ b/collabora/rootfs/etc/cont-init.d/99-run.sh @@ -2,9 +2,58 @@ # shellcheck shell=bash set -e -if bashio::config.has_value 'domain'; then - domain="$(bashio::config 'domain')" - export domain +# coolwsd matches storage.wopi.alias_groups host/alias entries as regular +# expressions, so every dot has to be escaped with a single backslash. The value +# is typed by hand in the add-on options, where it is easy to end up with no +# escaping at all or with doubled backslashes, and a wrong pattern silently +# never matches: Collabora then refuses the Nextcloud host. Accept all three +# spellings and always hand coolwsd the canonical single-escaped form. +REGEX_METACHARACTERS='][(){}|*+?^$' +normalise_wopi_host() { + local value="$1" + + # A value containing regex metacharacters was written by someone who knows + # what they are doing, leave it exactly as-is. + if [[ "$value" == *["$REGEX_METACHARACTERS"]* ]]; then + printf '%s' "$value" + return + fi + + value="${value//\\/}" # drop whatever escaping was typed, at any depth + value="${value//./\\.}" # re-escape every dot exactly once + printf '%s' "$value" +} + +# server_name is a literal "hostname[:port]", not a regex and not a URL +normalise_server_name() { + local value="$1" + value="${value//\\/}" # never escaped, drop backslashes if any were copied over + value="${value#*://}" # strip the scheme + value="${value%%/*}" # strip any path + printf '%s' "$value" +} + +for index in 1 2 3; do + if bashio::config.has_value "aliasgroup${index}"; then + aliasgroup="$(normalise_wopi_host "$(bashio::config "aliasgroup${index}")")" + export "aliasgroup${index}=${aliasgroup}" + bashio::log.info "Allowed Nextcloud host aliasgroup${index}: ${aliasgroup}" + fi +done + +if bashio::config.has_value 'server_name'; then + server_name="$(normalise_server_name "$(bashio::config 'server_name')")" + export server_name +elif bashio::config.has_value 'domain1'; then + # domain1 predates server_name and was documented as "the Collabora external + # domain", which is what server_name means to coolwsd. It was never actually + # passed to Collabora, so honour it here rather than keep ignoring it. + server_name="$(normalise_server_name "$(bashio::config 'domain1')")" + export server_name + bashio::log.warning "domain1 is deprecated, please use server_name instead" +fi +if bashio::config.has_value 'server_name' || bashio::config.has_value 'domain1'; then + bashio::log.info "Collabora public hostname (server_name): ${server_name}" fi if bashio::config.has_value 'username'; then @@ -17,9 +66,9 @@ if bashio::config.has_value 'password'; then export password fi -if bashio::config.has_value 'aliasgroup1'; then - aliasgroup1="$(bashio::config 'aliasgroup1')" - export aliasgroup1 +if bashio::config.has_value 'cert_domain'; then + cert_domain="$(bashio::config 'cert_domain')" + export cert_domain fi if bashio::config.has_value 'dictionaries'; then @@ -45,16 +94,25 @@ if bashio::config.true 'ssl'; then bashio::log.error "Key file /ssl/${keyfile} not found" exit 1 fi - cp -f /ssl/${keyfile} /etc/coolwsd/key.pem - cp -f /ssl/${certfile} /etc/coolwsd/cert.pem - cp -f /ssl/${certfile} /etc/coolwsd/ca-chain.cert.pem + cp -f "/ssl/${keyfile}" /etc/coolwsd/key.pem + cp -f "/ssl/${certfile}" /etc/coolwsd/cert.pem + cp -f "/ssl/${certfile}" /etc/coolwsd/ca-chain.cert.pem extra_params="${extra_params/--o:ssl.enable=false/}" extra_params="${extra_params} \ - --o:ssl.enable=true + --o:ssl.enable=true \ --o:ssl.termination=false \ --o:ssl.cert_file_path=/ssl/${certfile} \ --o:ssl.key_file_path=/ssl/${keyfile} \ --o:ssl.ca_file_path=/ssl/${certfile}" +elif [[ "$extra_params" != *ssl.termination* ]]; then + # coolwsd defaults ssl.termination to false, so with ssl disabled it builds + # http:// and ws:// URLs even when the browser reached it over https through + # a reverse proxy, and the browser then refuses the connection. + if bashio::config.true 'ssl_termination'; then + extra_params="${extra_params} --o:ssl.termination=true" + elif ! bashio::config.has_value 'ssl_termination'; then + bashio::log.notice "If Collabora is reached over https through a reverse proxy, set ssl_termination to true" + fi fi export extra_params diff --git a/collabora/updater.json b/collabora/updater.json index 35f757568b..c8f8b13ede 100644 --- a/collabora/updater.json +++ b/collabora/updater.json @@ -1,8 +1,9 @@ { - "last_update": "2026-07-16", + "github_exclude": "sha256", + "last_update": "2026-07-26", "repository": "alexbelgium/hassio-addons", "slug": "collabora", - "source": "github", - "upstream_repo": "CollaboraOnline/online", - "upstream_version": "1.3.0" + "source": "dockerhub", + "upstream_repo": "collabora/code", + "upstream_version": "26.04.2.4.1" }