chore(deps): update quay.io/keycloak/keycloak docker tag to v26.6.4

config/keycloak/themes/opencloud/login/resources/css/theme.css

@@ -4,18 +4,24 @@
     --pf-v5-global--primary-color--dark-100: #e2baff;
     --pf-v5-c-button--m-secondary--Color: #e2baff;
     --pf-v5-global--Color--light-100: #20434f;
-    --pf-v5-global--FontFamily--text: "Inter", "RedHatText", helvetica, arial, sans-serif;
-    --pf-v5-global--FontFamily--heading: "Inter", "RedHatDisplay", helvetica, arial, sans-serif;
 }
 
 @font-face {
-    font-family: Inter;
+    font-family: OpenCloud;
-    src: url('../fonts/Inter-Variable.woff2') format('woff2');
+    src: url('../fonts/OpenCloud500-Regular.woff2') format('woff2');
-    font-weight: 100 900;
+    font-weight: normal;
+    font-style: normal;
+}
+
+@font-face {
+    font-family: OpenCloud;
+    src: url('../fonts/OpenCloud750-Bold.woff2') format('woff2');
+    font-weight: bold;
     font-style: normal;
 }
 
 body {
+    font-family: "OpenCloud", "Open Sans", Helvetica, Arial, sans-serif;
     background: url(../img/background.png) no-repeat center fixed !important;
     background-size: cover !important;
 }

config/opencloud/apps.yaml

@@ -1,3 +0,0 @@
-maps:
-  config:
-    folderViewEnabled: false

docker-compose.yml

@@ -2,7 +2,7 @@
 services:
   opencloud:
     # renovate: depName=opencloudeu/opencloud-rolling
-    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-7.4.0}
+    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-7.2.0}
     # changelog: https://github.com/opencloud-eu/opencloud/tree/main/changelog
     # release notes: https://docs.opencloud.eu/opencloud_release_notes.html
     user: ${OC_CONTAINER_UID_GID:-1000:1000}
@@ -58,7 +58,6 @@ services:
       OC_DEFAULT_LANGUAGE: ${DEFAULT_LANGUAGE}
     volumes:
       - ./config/opencloud/csp.yaml:/etc/opencloud/csp.yaml
-      - ./config/opencloud/apps.yaml:/etc/opencloud/apps.yaml
       - ./config/opencloud/banned-password-list.txt:/etc/opencloud/banned-password-list.txt
       # configure the .env file to use own paths instead of docker internal volumes
       - ${OC_CONFIG_DIR:-opencloud-config}:/etc/opencloud

idm/ldap-keycloak.yml

@@ -78,7 +78,7 @@ services:
     restart: always
 
   keycloak:
-    image: quay.io/keycloak/keycloak:26.7.1
+    image: quay.io/keycloak/keycloak:26.6.4
     networks:
       opencloud-net:
     command: [ "start", "--spi-connections-http-client-default-disable-trust-manager=${INSECURE:-false}", "--import-realm" ]

renovate.json

@@ -2,7 +2,7 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "platformAutomerge": true,
   "enabledManagers": ["docker-compose", "custom.regex"],
-  "baseBranchPatterns": ["main", "stable-4.0", "stable-7.2"],
+  "baseBranchPatterns": ["main", "stable-4.0"],
   "packageRules": [
     {
       "matchManagers": ["docker-compose", "custom.regex"],
@@ -14,7 +14,7 @@
       "automerge": true
     },
     {
-      "matchBaseBranches": ["stable-4.0", "stable-7.2"],
+      "matchBaseBranches": ["stable-4.0"],
       "matchUpdateTypes": ["major", "minor"],
       "enabled": false
     },

testing/external-keycloak.yml

@@ -15,7 +15,7 @@ services:
     restart: always
 
   keycloak:
-    image: quay.io/keycloak/keycloak:26.7.1
+    image: quay.io/keycloak/keycloak:26.6.4
     networks:
       opencloud-net:
     command: [ "start", "--spi-connections-http-client-default-disable-trust-manager=${INSECURE:-false}", "--import-realm" ]

traefik/opencloud.yml

@@ -16,7 +16,7 @@ services:
       - "traefik.http.services.opencloud.loadbalancer.server.port=9200"
       - "traefik.http.routers.opencloud.${TRAEFIK_SERVICES_TLS_CONFIG}"
   traefik:
-    image: traefik:v3.7.10
+    image: traefik:v3.6.14
     # release notes: https://github.com/traefik/traefik/releases
     user: ${TRAEFIK_CONTAINER_UID_GID:-0:0}
     networks:

weboffice/collabora.yml

@@ -23,50 +23,22 @@ services:
       COLLABORATION_APP_INSECURE: "${INSECURE:-true}"
       COLLABORATION_CS3API_DATAGATEWAY_INSECURE: "${INSECURE:-true}"
 
-  # One-shot service that generates the WOPI proof key on first start and
-  # keeps it in a named volume, like the proofKeyGeneration feature of the
-  # collabora-online helm chart.
-  # To rotate the key, remove the volume and start again:
-  #   docker compose down collabora && docker volume rm <project>_collabora-proof-key
-  collabora-proof-key:
-    image: alpine/openssl:3.5.7
-    entrypoint: ["/bin/sh"]
-    command:
-      - -ec
-      - |
-        if [ ! -s /proof/proof_key ]; then
-          openssl genrsa -traditional -out /proof/proof_key.tmp 4096
-          chown 1001:1001 /proof/proof_key.tmp
-          chmod 400 /proof/proof_key.tmp
-          mv /proof/proof_key.tmp /proof/proof_key
-          echo "WOPI proof key generated"
-        else
-          echo "WOPI proof key already exists"
-        fi
-    volumes:
-      - collabora-proof-key:/proof
-    logging:
-      driver: ${LOG_DRIVER:-local}
-    restart: "no"
-
   collabora:
-    image: collabora/code:26.04.2.4.1
+    image: collabora/code:26.04.1.4.1
     # release notes: https://www.collaboraonline.com/release-notes/
     networks:
       opencloud-net:
-    depends_on:
-      collabora-proof-key:
-        condition: service_completed_successfully
     environment:
       # WOPI host allowlist; the WOPI endpoint is served by the opencloud proxy on the opencloud domain
       aliasgroup1: https://${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
-      extra_params: >
+      DONT_GEN_SSL_CERT: "YES"
-        --o:ssl.enable=${COLLABORA_SSL_ENABLE:-true}
+      extra_params: |
-        --o:ssl.ssl_verification=${COLLABORA_SSL_VERIFICATION:-true}
+        --o:ssl.enable=${COLLABORA_SSL_ENABLE:-true} \
-        --o:ssl.termination=true
+        --o:ssl.ssl_verification=${COLLABORA_SSL_VERIFICATION:-true} \
-        --o:welcome.enable=false
+        --o:ssl.termination=true \
-        --o:net.frame_ancestors=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
+        --o:welcome.enable=false \
-        --o:net.lok_allow.host[14]=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
+        --o:net.frame_ancestors=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} \
+        --o:net.lok_allow.host[14]=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} \
         --o:home_mode.enable=${COLLABORA_HOME_MODE:-false}
       username: ${COLLABORA_ADMIN_USER:-admin}
       password: ${COLLABORA_ADMIN_PASSWORD:-admin}
@@ -80,24 +52,19 @@ services:
       # (e.g. Microsoft fonts like Arial, Calibri, Cambria by installing the `ttf-mscorefonts-installer` package).
       - /usr/share/fonts/truetype:/usr/share/fonts/truetype/more:ro
       - /usr/share/fonts/truetype:/opt/cool/systemplate/usr/share/fonts/truetype/more:ro
-      # WOPI proof key generated by the collabora-proof-key service.
-      - type: volume
-        source: collabora-proof-key
-        target: /etc/coolwsd/proof_key
-        read_only: true
-        volume:
-          subpath: proof_key
     logging:
       driver: ${LOG_DRIVER:-local}
     restart: always
+    entrypoint: [ '/bin/bash', '-c' ]
+    command: [ 'coolconfig generate-proof-key && /start-collabora-online.sh' ]
     healthcheck:
-      # --use-env-vars makes the probe read extra_params, so it probes with
+      test:
-      # the same http/https scheme the server actually runs with; without it
+        [
-      # the probe falls back to coolwsd.xml where ssl.enable defaults to true
+          "CMD",
-      test: ["CMD", "/usr/bin/coolwsd", "--probe", "--use-env-vars"]
+          "bash",
+          "-c",
+          "exec 3<>/dev/tcp/127.0.0.1/9980 && printf 'GET /hosting/discovery HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 && cat <&3 | head -1 | grep -q '200 OK'"
+        ]
       interval: 15s
       timeout: 10s
       retries: 5
-
-volumes:
-  collabora-proof-key: