mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2025-10-31 10:19:09 +00:00

Files

Kevin Veen-Birkenbach 79e702a3ab web-svc-collabora: localize vars, adjust CSP, fix systemd perms; refactor role composition

- sys-service:
  - Set explicit ownership and permissions for generated unit files:
    owner=root, group=root, mode=0644. Prevents drift and makes idempotence
    predictable when handlers reload/refresh systemd.

- web-svc-collabora:
  - Move cmp-docker-proxy include into tasks/01_core.yml and run it
    before Nginx config generation. Use public: true only to initialize the
    proxy/compose context and docker_compose_flush_handlers: true to ensure
    timely handler execution.
  - Define role-local variables domain and http_port in vars/main.yml
    and use {{ domain }} for the Nginx server file path. These values MUST
    be defined locally because they cannot be reliably imported via
    public: true — other roles may override them later in the play, leading
    to leakage and nondeterministic behavior. Localizing avoids precedence
    conflicts without resorting to host-wide set_fact.
  - CSP adjusted: add server.security.flags.style-src.unsafe-inline: true
    to accommodate Collabora’s inline styles (requested as “csr” in notes).
  - Minor variable alignment/cleanup and TODO note for future refactor.

- Housekeeping:
  - Rename task title to reflect {{ domain }} usage.

Refs:
- Discussion and rationale in this chat https://chatgpt.com/share/68a731aa-d394-800f-9eb4-2499f45ed54b (2025-08-21, Europe/Berlin).

2025-08-21 16:48:37 +02:00

config

web-svc-collabora: localize vars, adjust CSP, fix systemd perms; refactor role composition

2025-08-21 16:48:37 +02:00

README.md

Docker Collabora (DRAFT)

Description

This Ansible role deploys Collabora Online (CODE) in Docker to enable real-time, in-browser document editing for Nextcloud. It automates the setup of the Collabora CODE container, Nginx reverse proxy configuration, network isolation via Docker networks, and environment variable management.

Overview

Dockerized Collabora CODE: Uses the official collabora/code image.
Nginx Reverse Proxy: Configures a public-facing proxy with TLS termination and WebSocket support for /cool/ paths.
Docker Network Management: Creates an isolated /28 subnet for Collabora and connects containers securely.
Environment Configuration: Generates a .env file with domain, credentials, and extra parameters for Collabora's WOPI server.

Features

Automatic creation of a dedicated Docker network for Collabora.
Proxy configuration template for Nginx with long timeouts and WebSocket upgrades.
Customizable domain names and ports via Ansible variables.
Support for SSL termination at the proxy level.
Integration hooks to restart Nginx and recreate Docker Compose stacks on changes.

Documentation

See the role’s README.md, task files, and Jinja2 templates in the roles/web-svc-collabora directory for usage examples and variable definitions.

README.md Unescape Escape