mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2025-11-26 22:56:46 +00:00

Files

Kevin Veen-Birkenbach 57d5269b07 CSP (Safari-safe): merge -elem/-attr into base; respect explicit disables; no mirror-back; header only for documents/workers

- Add CSP3 support for style/script: include -elem and -attr directives
- Base (style-src, script-src) now unions elem/attr (CSP2/Safari fallback)
- Respect explicit base disables (e.g. style-src.unsafe-inline: false)
- Hashes only when 'unsafe-inline' absent in the final base tokens
- Nginx: set CSP only for HTML/worker via header_filter_by_lua_block; drop for subresources
- Remove per-location header_filter; keep body_filter only
- Update app role flags to *-attr where appropriate; extend desktop CSS sources
- Add comprehensive unit tests for union/explicit-disable/no-mirror-back

Ref: https://chatgpt.com/share/68f87a0a-cebc-800f-bb3e-8c8ab4dee8ee

2025-10-22 13:53:06 +02:00

config

CSP (Safari-safe): merge -elem/-attr into base; respect explicit disables; no mirror-back; header only for documents/workers

2025-10-22 13:53:06 +02:00

README.md

Docker Collabora (DRAFT)

Description

This Ansible role deploys Collabora Online (CODE) in Docker to enable real-time, in-browser document editing for Nextcloud. It automates the setup of the Collabora CODE container, Nginx reverse proxy configuration, network isolation via Docker networks, and environment variable management.

Overview

Dockerized Collabora CODE: Uses the official collabora/code image.
Nginx Reverse Proxy: Configures a public-facing proxy with TLS termination and WebSocket support for /cool/ paths.
Docker Network Management: Creates an isolated /28 subnet for Collabora and connects containers securely.
Environment Configuration: Generates a .env file with domain, credentials, and extra parameters for Collabora's WOPI server.

Features

Automatic creation of a dedicated Docker network for Collabora.
Proxy configuration template for Nginx with long timeouts and WebSocket upgrades.
Customizable domain names and ports via Ansible variables.
Support for SSL termination at the proxy level.
Integration hooks to restart Nginx and recreate Docker Compose stacks on changes.

Documentation

See the role’s README.md, task files, and Jinja2 templates in the roles/web-svc-collabora directory for usage examples and variable definitions.

README.md Unescape Escape