mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5.5
8dce5b3caa
The role restricted the WOPI hosts with `domain` and with `--o:net.wopi_allowed_hosts`. The distroless image that #775 brought in applies neither. `domain` was translated by the start script of the older image, which this one does not have, and coolwsd knows no setting called `net.wopi_allowed_hosts`. Its startup log listed that key among the overrides and no trusted WOPI host, so the server ran with the policy the image ships instead of the one the role declares. The allowlist now goes through `aliasgroup1`, the variable coolwsd reads itself. It carries the origin of the Nextcloud domain as the deployment resolves it, with scheme and port, so it also holds in a Tor variant. The old expression was built from DOMAIN_PRIMARY and would not have matched an onion address. No spec opened a document, which is why this went unnoticed. The richdocuments spec now uploads a document, opens it and waits for the `status:` frame on the editor websocket. Its first run on the Tor variant found a second defect. `ssl.termination` was fixed to true, so coolwsd advertised https URLs in its discovery while an onion vhost only serves http, and the browser never reached the editor. The setting now follows the TLS state of the Collabora vhost. Closes #802 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
5 lines
287 B
Django/Jinja
5 lines
287 B
Django/Jinja
{% include 'roles/sys-svc-container/templates/env.j2' %}
|
|
|
|
aliasgroup1={{ COLLABORA_WOPI_HOST }}
|
|
extra_params=--o:ssl.enable=false --o:ssl.termination={{ lookup('tls', application_id, 'enabled') | lower }} --o:net.service_root=/ --o:net.post_allow.host[99]={{ networks.internet.ip4 }}/32
|