3

I am trying to install Collabora CODE alongside Nextcloud via docker-compose. Everything appeared to be up and running from this deployment, but whenever I try to access the Collabora CODE editor, I get the following "mixed content" error:

Blocked loading mixed active content “http://docs.example.com/loleaflet/44a46d7/loleaflet.html?WOPISrc=https%3A%2F%2Fnc.example.com%2Findex.php%2Fapps%2Frichdocuments%2Fwopi%2Ffiles%2F13_oceqjdia3g5g&title=Welcome%20to%20Nextcloud%20Hub.docx&lang=en&closebutton=1&revisionhistory=1”

I believe the issue is the "extra_params=--o:ssl.enable=false" environment variable that I'm passing to the Collabora image, but I can't get Collabora to work with its own SSL enabled.

Does anyone know if there's a way to force Collabora to respond with HTTPS at all times?

Any help would be appreciated. To be clear, I simply want to access Collabora CODE via HTTPS at docs.example.org within the framework of the following solution:

version: '3.3'

services:

  traefik:
    image: traefik:latest
    restart: always
    container_name: "traefik"
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.myresolver.acme.email=bandi@qodex.cc"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"

    networks:
      - web
      - internal
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    volumes:
      - "./letsencrypt:/letsencrypt"
      - /var/run/docker.sock:/var/run/docker.sock

  nc_db:
    image: mariadb
    restart: always
    container_name: "nextcloud-db"
    volumes:
      - nc_db:/var/lib/mysql
    env_file:
      - nc_secrets.env
    labels:
      - "traefik.enable=false"
    networks:
      - internal

  collabora:
    image: collabora/code
    restart: unless-stopped
    container_name: "collabora-app"
    expose:
      - "9980"
    environment:
      - domain=docs.example.com
      - username=admin
      - password=admin
      - "SLEEPFORDEBUGGER=0"
      - "extra_params=--o:ssl.enable=false"
    cap_add:
      - MKNOD
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.collabora.tls=true"
      - "traefik.http.routers.collabora.rule=Host(`docs.example.com`)"
      - "traefik.http.services.collabora.loadbalancer.server.port=9980"
      - "traefik.http.routers.collabora.tls.certresolver=myresolver"
    networks:
      - web

  nextcloud:
    image: nextcloud
    restart: always
    container_name: "nextcloud-app"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nextcloud.tls=true"
      - "traefik.http.routers.nextcloud.rule=Host(`nc.example.com`)"
      - "traefik.http.routers.nextcloud.tls.certresolver=myresolver"
    links:
      - nc_db
    volumes:
      - nextcloud:/var/www/html
    env_file:
      - nc_secrets.env
    networks:
      - web
      - internal

  wordpress:
    image: wordpress
    restart: always
    container_name: "wordpress-app"
    links:
      - wp_db
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.wordpress.tls=true"
      - "traefik.http.routers.wordpress.rule=Host(`example.com`)"
      - "traefik.http.routers.wordpress.tls.certresolver=myresolver"
    env_file:
      - wp_secrets.env
    volumes:
      - wordpress:/var/www/html
    networks:
      - web
      - internal

  wp_db:
    image: mysql:5.7
    restart: always
    container_name: "wordpress-db"
    env_file:
      - wp_secrets.env
    volumes:
      - wp_db:/var/lib/mysql
    labels:
      - "traefik.enable=false"
    networks:
      - internal

volumes:
  wp_db:
  wordpress:
  nextcloud:
  nc_db:

networks:
  internal:
    external: false
  web:
    external: true

Thanks in advance for any help / ideas.

Andrew Horváth
  • 83
  • 7

2 Answers2

5

Managed to solve my own issue. There is an undocumented option within Collabora's config file:

<termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>

I also had to read the loolwsl.xml parameters from a file on the host, as it turned out the parameters I passed as env variables weren't being processed in the container. The final docker-compose entry for Collabora:

  collabora:
    image: collabora/code
    restart: unless-stopped
    container_name: "collabora-app"
    expose:
      - "9980"
    environment:
      - domain=nc.example.com
      - server_name=docs.example.com
    cap_add:
      - MKNOD
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.collabora.tls=true"
      - "traefik.http.routers.collabora.rule=Host(`docs.example.com`)"
      - "traefik.http.services.collabora.loadbalancer.server.port=9980"
      - "traefik.http.routers.collabora.tls.certresolver=myresolver"
    volumes:
      - ./loolwsd.xml:/etc/loolwsd/loolwsd.xml
    networks:
      - web

The following two parameters need to be set in the loolwsd.xml file on the host:

    <ssl desc="SSL settings">
        <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>
        <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>

This will allow you to use Collabora with SSL provided by a reverse proxy (in this case Traefik).

Andrew Horváth
  • 83
  • 7
2

based on the answer by @Andrew I found a better way to set this config value.

add the following environment var to set this parameters instead of the config file volume.

  collabora:
    environment:
      - extra_params=--o:ssl.enable=false --o:ssl.termination=true
A. Binzxxxxxx
  • 2,812
  • 1
  • 21
  • 33