The role restricted the WOPI hosts with `domain` and with
`--o:net.wopi_allowed_hosts`. The distroless image that #775 brought in
applies neither. `domain` was translated by the start script of the older
image, which this one does not have, and coolwsd knows no setting called
`net.wopi_allowed_hosts`. Its startup log listed that key among the
overrides and no trusted WOPI host, so the server ran with the policy the
image ships instead of the one the role declares.
The allowlist now goes through `aliasgroup1`, the variable coolwsd reads
itself. It carries the origin of the Nextcloud domain as the deployment
resolves it, with scheme and port, so it also holds in a Tor variant. The
old expression was built from DOMAIN_PRIMARY and would not have matched an
onion address.
No spec opened a document, which is why this went unnoticed. The
richdocuments spec now uploads a document, opens it and waits for the
`status:` frame on the editor websocket.
Its first run on the Tor variant found a second defect. `ssl.termination`
was fixed to true, so coolwsd advertised https URLs in its discovery while
an onion vhost only serves http, and the browser never reached the editor.
The setting now follows the TLS state of the Collabora vhost.
Closes#802
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
collabora/code 26.04.4.2.1 is the distroless image: it ships neither a
shell nor coolconfig. The two `container exec ... coolconfig` tasks
therefore exited 127, and the `tcp` healthcheck flavour, which runs
`bash -c`, could not execute at all.
The healthcheck now runs the probe the image declares for itself,
`/usr/bin/coolwsd --probe --use-env-vars`. The net.post_allow entry for
the host address moves into extra_params as host[99]. An index far above
the five shipped defaults appends an entry; the container log lists all
five defaults plus the host address afterwards. The unindexed key is the
literal equivalent of the old `coolconfig set`, and it would replace the
first default, 192.168.0.0/16.
update-system-template has no replacement and needs none: the role
mounts no fonts and the image ships a prebuilt systemplate. With the
stack-host block gone, COLLABORA_CONTAINER_ADDRESS has no reader left.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
New roles/sys-svc-container/templates/env.j2 sets TZ={{ HOST_TIMEZONE }} and LANG=C.UTF-8. Every role env.j2 includes it at the top; it renders via stack_host_template, the same engine that resolves the includes in compose.yml.j2, so it works in both compose and swarm. TZ/LANG are removed from the individual role env.j2 so each value stays single-source.
New lint tests/lint/ansible/test_env_base_include.py verifies every role env.j2 includes the base and never re-sets a base-owned key (keys derived from the base file).
mattermost and gitea meta/volumes.yml drop the /etc/timezone host-path bind: swarm hard-rejects a task whose bind source is missing on the node (Debian-trixie nodes have no /etc/timezone). TZ now comes from the base env. /etc/localtime bind also dropped; the container timezone follows TZ.
Non-directive comments were removed from the touched env.j2 (banners, restatements, reference URLs, narration) so the changed files pass the comment-lint; only tool directives remain.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Grant cap_add SYS_ADMIN so the default docker seccomp profile (which swarm enforces, since it ignores security_opt) allows the jail's mount/unshare/clone/setns syscalls (they are CAP_SYS_ADMIN-gated in moby default.json). With the capability present the full bind-mount jail works in both modes, so remove the swarm-only --o:mount_jail_tree=false workaround, which forced the slow link/copy path and risked kit segfaults (online#5247). Matches Nextcloud AIO (default seccomp + SYS_ADMIN, no mount overrides).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
docker stack deploy drops cap_add/security_opt, so collabora's coolmount (CAP_SYS_ADMIN jail-mount) fails 'Operation not permitted' and the container never goes healthy -> the swarm task reschedules forever and never converges (bigbluebutton/nextcloud/listmonk). Append --o:mount_jail_tree=false in swarm so collabora copies/links the jail tree instead of mounting it. Compose keeps the caps and is byte-identical.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5.5