Merge pull request #356 from opencloud-eu/renovate/stable-7.2-opencloudeu-opencloud-7.x

chore(deps): update opencloudeu/opencloud docker tag to v7.2.3 (stable-7.2)

.env.example

@@ -87,7 +87,7 @@ TRAEFIK_LOG_LEVEL=
 # For production releases: "opencloudeu/opencloud"
 # For rolling releases:    "opencloudeu/opencloud-rolling"
 # Defaults to production if not set otherwise
-OC_DOCKER_IMAGE=opencloudeu/opencloud-rolling
+OC_DOCKER_IMAGE=opencloudeu/opencloud
 # The openCloud container version.
 # Defaults to the latest version-tag. Use git pull to update.
 OC_DOCKER_TAG=

README.md

@@ -319,12 +319,12 @@ OpenCloud Compose supports adding SSL certificates for public domains and develo
 ### Use Let's Encrypt with ACME Challenge
 
 1. **Enable Let's Encrypt**:
-   - Set `TRAEFIK_ACME_MAIL` to your email address for the ACME challenge
+   - Set `TRAEFIK_LETSENCRYPT_EMAIL` to your email address for the ACME challenge
    - Set `TRAEFIK_SERVICES_TLS_CONFIG="tls.certresolver=letsencrypt"` to use Let's Encrypt (default value)
 
    ```bash
    # In your .env file
-   TRAEFIK_ACME_MAIL=devops@your-domain.tld
+   TRAEFIK_LETSENCRYPT_EMAIL=devops@your-domain.tld
    TRAEFIK_SERVICES_TLS_CONFIG="tls.certresolver=letsencrypt"
    ```
 
@@ -412,7 +412,7 @@ Key variables:
 | `LDAP_BIND_PASSWORD`          | LDAP password for the bind user                       | admin                        |
 | `KC_DB_USERNAME`              | Database user for keycloak                            | keycloak                     |
 | `KC_DB_PASSWORD`              | Database password for keycloak                        | keycloak                     |
-| `TRAEFIK_ACME_MAIL`           | Email Address for the Let's Encrypt ACME challenge    | example@example.org          |
+| `TRAEFIK_LETSENCRYPT_EMAIL`   | Email Address for the Let's Encrypt ACME challenge    | example@example.org          |
 | `TRAEFIK_SERVICES_TLS_CONFIG` | Tell traefik and the services which TLS config to use | tls.certresolver=letsencrypt |
 | `TRAEFIK_CERTS_DIR`           | Directory for custom certificates.                    | ./certs                      |
 

config/keycloak/themes/opencloud/login/resources/css/theme.css

@@ -1,9 +1,8 @@
 :root {
-    --pf-v5-global--primary-color--100: #e2baff;
+    --pf-global--primary-color--100: #e2baff;
-    --pf-v5-global--primary-color--200: #e2baff;
+    --pf-global--primary-color--200: #e2baff;
-    --pf-v5-global--primary-color--dark-100: #e2baff;
+    --pf-global--primary-color--dark-100: #e2baff;
-    --pf-v5-c-button--m-secondary--Color: #e2baff;
+    --pf-global--Color--light-100: #20434f;
-    --pf-v5-global--Color--light-100: #20434f;
 }
 
 @font-face {
@@ -22,36 +21,18 @@
 
 body {
     font-family: "OpenCloud", "Open Sans", Helvetica, Arial, sans-serif;
-    background: url(../img/background.png) no-repeat center fixed !important;
+    background: url(../img/background.png) no-repeat center !important;
     background-size: cover !important;
 }
 
 .kc-logo-text {
-    display: block;
+    background-image: url(../img/logo.svg) !important;
-    width: 300px;
-    height: 63px;
-    background: url('../img/logo.svg') no-repeat center;
     background-size: contain;
+    width: 400px;
+    margin: 0 !important;
 }
 
-.kc-logo-text span {
+#kc-header-wrapper{
-    display: none;
-}
-
-#kc-header-wrapper {
     display: flex;
     justify-content: center;
-}
+}
-
-.pf-v5-c-login__main-header {
-    border-top: 4px solid var(--pf-v5-global--primary-color--100);
-}
-
-@media (min-width: 1200px) {
-    .pf-v5-c-login__container {
-        grid-template-columns: 34rem;
-        grid-template-areas:
-        "header"
-        "main";
-    }
-}

config/keycloak/themes/opencloud/login/resources/js/script.js

@@ -16,4 +16,4 @@ document.addEventListener("DOMContentLoaded", function () {
     }
 
     setLogoUrl('https://opencloud.eu')
-});
+});

config/keycloak/themes/opencloud/login/theme.properties

@@ -1,5 +1,5 @@
-parent=keycloak.v2
+parent=keycloak
 import=common/keycloak
 
 styles=css/login.css css/theme.css
-scripts=js/script.js
+scripts=js/script.js

config/opencloud/csp.yaml

@@ -25,7 +25,6 @@ directives:
     - 'https://${EURO_OFFICE_DOMAIN|euro-office.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
     # This is needed for the external-sites web extension when embedding sites
     - 'https://docs.opencloud.eu'
-    - 'https://${IDP_DOMAIN|keycloak.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
   img-src:
     - '''self'''
     - 'data:'

docker-compose.yml

@@ -1,8 +1,8 @@
 ---
 services:
   opencloud:
-    # renovate: depName=opencloudeu/opencloud-rolling
+    # renovate: depName=opencloudeu/opencloud
-    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-7.2.0}
+    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud}:${OC_DOCKER_TAG:-7.2.3}
     # changelog: https://github.com/opencloud-eu/opencloud/tree/main/changelog
     # release notes: https://docs.opencloud.eu/opencloud_release_notes.html
     user: ${OC_CONTAINER_UID_GID:-1000:1000}

external-proxy/opencloud.yml

@@ -1,9 +1,9 @@
 ---
 services:
   opencloud:
-    environment:
+      environment:
-      # bind to all interfaces
+        # bind to all interfaces
-      PROXY_HTTP_ADDR: "0.0.0.0:9200"
+        PROXY_HTTP_ADDR: "0.0.0.0:9200"
-    ports:
+      ports:
-      # expose the opencloud server on localhost
+        # expose the opencloud server on localhost
-      - "127.0.0.1:9200:9200"
+        - "127.0.0.1:9200:9200"

renovate.json

@@ -1,43 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "platformAutomerge": true,
-  "enabledManagers": ["docker-compose", "custom.regex"],
-  "baseBranchPatterns": ["main", "stable-4.0"],
-  "packageRules": [
-    {
-      "matchManagers": ["docker-compose", "custom.regex"],
-      "labels": ["Type:Dependencies", "Bot:Renovate"]
-    },
-    {
-      "matchManagers": ["docker-compose"],
-      "matchUpdateTypes": ["patch"],
-      "automerge": true
-    },
-    {
-      "matchBaseBranches": ["stable-4.0"],
-      "matchUpdateTypes": ["major", "minor"],
-      "enabled": false
-    },
-    {
-      "matchPackageNames": ["postgres"],
-      "matchManagers": ["docker-compose"],
-      "allowedVersions": "/^17\\.\\d+-alpine$/"
-    }
-  ],
-  "docker-compose": {
-    "managerFilePatterns": ["/.+\\.ya?ml$/"]
-  },
-  "customManagers": [
-    {
-      "customType": "regex",
-      "managerFilePatterns": [
-        "/^docker-compose\\.yml$/",
-        "/^weboffice\\/collabora\\.yml$/"
-      ],
-      "matchStrings": [
-        "# renovate: depName=(?<depName>[^\\s]+)\\n\\s+image: \\$\\{[^}]+\\}:\\$\\{[^}]+-(?<currentValue>[0-9]+\\.[0-9]+\\.[0-9]+)\\}"
-      ],
-      "datasourceTemplate": "docker"
-    }
-  ]
-}

search/opensearch.yml

@@ -1,59 +0,0 @@
----
-services:
-  opencloud:
-    environment:
-      # Point the search service at OpenSearch instead of the embedded bleve index.
-      SEARCH_ENGINE_TYPE: open-search
-      SEARCH_ENGINE_OPEN_SEARCH_CLIENT_ADDRESSES: http://opensearch:9200
-      SEARCH_ENGINE_OPEN_SEARCH_CLIENT_INSECURE: "true"
-      SEARCH_ENGINE_OPEN_SEARCH_RESOURCE_INDEX_NAME: ${OPENSEARCH_RESOURCE_INDEX:-opencloud-resources}
-    depends_on:
-      opensearch:
-        condition: service_healthy
-
-  opensearch:
-    image: ${OPENSEARCH_DOCKER_IMAGE:-opensearchproject/opensearch}:${OPENSEARCH_DOCKER_TAG:-2.19.5}
-    environment:
-      discovery.type: single-node
-      bootstrap.memory_lock: "true"
-      OPENSEARCH_JAVA_OPTS: ${OPENSEARCH_JAVA_OPTS:--Xms512m -Xmx512m}
-      # Security plugin is disabled: OpenSearch is only reachable on the
-      # internal opencloud-net bridge and no port is published to the host.
-      # Do NOT enable a published port or expose this via the reverse proxy
-      # without first enabling and configuring the security plugin.
-      DISABLE_SECURITY_PLUGIN: "true"
-      DISABLE_INSTALL_DEMO_CONFIG: "true"
-      # Disable the disk-based shard allocation watermarks. By default OpenSearch
-      # marks indices read-only when the host disk is <5% free, which silently
-      # turns bulk upserts into no-ops. Fine to disable on a single-node dev box.
-      cluster.routing.allocation.disk.threshold_enabled: "false"
-    ulimits:
-      memlock:
-        soft: -1
-        hard: -1
-      nofile:
-        soft: 65536
-        hard: 65536
-    networks:
-      opencloud-net:
-    volumes:
-      - ${OPENSEARCH_DATA_DIR:-opensearch-data}:/usr/share/opensearch/data
-    healthcheck:
-      # Single-node clusters can't go green (replicas have nowhere to land), so
-      # yellow is the healthy state. Still gates opencloud until opensearch accepts
-      # requests.
-      test:
-        [
-          "CMD-SHELL",
-          "curl -sf 'http://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=5s' > /dev/null || exit 1"
-        ]
-      interval: 5s
-      timeout: 10s
-      retries: 24
-      start_period: 60s
-    logging:
-      driver: ${LOG_DRIVER:-local}
-    restart: always
-
-volumes:
-  opensearch-data:

search/tika.yml

@@ -11,18 +11,6 @@ services:
     restart: always
     logging:
       driver: ${LOG_DRIVER:-local}
-    healthcheck:
-      test:
-        [
-          "CMD",
-          "bash",
-          "-c",
-          "exec 3<>/dev/tcp/127.0.0.1/9998 && printf 'GET /tika HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 && grep '200 OK' <&3",
-        ]
-      interval: 5s
-      timeout: 5s
-      retries: 10
-      start_period: 5s
 
   opencloud:
     environment:
@@ -30,6 +18,3 @@ services:
       SEARCH_EXTRACTOR_TYPE: tika
       SEARCH_EXTRACTOR_TIKA_TIKA_URL: http://tika:9998
       FRONTEND_FULL_TEXT_SEARCH_ENABLED: "true"
-    depends_on:
-      tika:
-        condition: service_healthy

weboffice/collabora.yml

@@ -23,22 +23,50 @@ services:
       COLLABORATION_APP_INSECURE: "${INSECURE:-true}"
       COLLABORATION_CS3API_DATAGATEWAY_INSECURE: "${INSECURE:-true}"
 
+  # One-shot service that generates the WOPI proof key on first start and
+  # keeps it in a named volume, like the proofKeyGeneration feature of the
+  # collabora-online helm chart.
+  # To rotate the key, remove the volume and start again:
+  #   docker compose down collabora && docker volume rm <project>_collabora-proof-key
+  collabora-proof-key:
+    image: alpine/openssl:3.5.7
+    entrypoint: ["/bin/sh"]
+    command:
+      - -ec
+      - |
+        if [ ! -s /proof/proof_key ]; then
+          openssl genrsa -traditional -out /proof/proof_key.tmp 4096
+          chown 1001:1001 /proof/proof_key.tmp
+          chmod 400 /proof/proof_key.tmp
+          mv /proof/proof_key.tmp /proof/proof_key
+          echo "WOPI proof key generated"
+        else
+          echo "WOPI proof key already exists"
+        fi
+    volumes:
+      - collabora-proof-key:/proof
+    logging:
+      driver: ${LOG_DRIVER:-local}
+    restart: "no"
+
   collabora:
-    image: collabora/code:26.04.1.4.1
+    image: collabora/code:26.04.2.4.1
     # release notes: https://www.collaboraonline.com/release-notes/
     networks:
       opencloud-net:
+    depends_on:
+      collabora-proof-key:
+        condition: service_completed_successfully
     environment:
       # WOPI host allowlist; the WOPI endpoint is served by the opencloud proxy on the opencloud domain
       aliasgroup1: https://${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
-      DONT_GEN_SSL_CERT: "YES"
+      extra_params: >
-      extra_params: |
+        --o:ssl.enable=${COLLABORA_SSL_ENABLE:-true}
-        --o:ssl.enable=${COLLABORA_SSL_ENABLE:-true} \
+        --o:ssl.ssl_verification=${COLLABORA_SSL_VERIFICATION:-true}
-        --o:ssl.ssl_verification=${COLLABORA_SSL_VERIFICATION:-true} \
+        --o:ssl.termination=true
-        --o:ssl.termination=true \
+        --o:welcome.enable=false
-        --o:welcome.enable=false \
+        --o:net.frame_ancestors=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
-        --o:net.frame_ancestors=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} \
+        --o:net.lok_allow.host[14]=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
-        --o:net.lok_allow.host[14]=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} \
         --o:home_mode.enable=${COLLABORA_HOME_MODE:-false}
       username: ${COLLABORA_ADMIN_USER:-admin}
       password: ${COLLABORA_ADMIN_PASSWORD:-admin}
@@ -52,19 +80,24 @@ services:
       # (e.g. Microsoft fonts like Arial, Calibri, Cambria by installing the `ttf-mscorefonts-installer` package).
       - /usr/share/fonts/truetype:/usr/share/fonts/truetype/more:ro
       - /usr/share/fonts/truetype:/opt/cool/systemplate/usr/share/fonts/truetype/more:ro
+      # WOPI proof key generated by the collabora-proof-key service.
+      - type: volume
+        source: collabora-proof-key
+        target: /etc/coolwsd/proof_key
+        read_only: true
+        volume:
+          subpath: proof_key
     logging:
       driver: ${LOG_DRIVER:-local}
     restart: always
-    entrypoint: [ '/bin/bash', '-c' ]
-    command: [ 'coolconfig generate-proof-key && /start-collabora-online.sh' ]
     healthcheck:
-      test:
+      # --use-env-vars makes the probe read extra_params, so it probes with
-        [
+      # the same http/https scheme the server actually runs with; without it
-          "CMD",
+      # the probe falls back to coolwsd.xml where ssl.enable defaults to true
-          "bash",
+      test: ["CMD", "/usr/bin/coolwsd", "--probe", "--use-env-vars"]
-          "-c",
-          "exec 3<>/dev/tcp/127.0.0.1/9980 && printf 'GET /hosting/discovery HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 && cat <&3 | head -1 | grep -q '200 OK'"
-        ]
       interval: 15s
       timeout: 10s
       retries: 5
+
+volumes:
+  collabora-proof-key: