Add complete docker-compose.yml example for collabora office

[aaronSkar]

This example give a full example to deploy Nextcloud with Mariadb, Nginx, lets encrypt and Collabora office.

#55 #223

[kromsam]

Thanks for making the installation much easier for a lot of people!

Although, after using this docker-compose file I still have not been able to finally fix it.

When I start the Collabora Integration app and fill in the collabora url [https://office.DOMAIN.TLD], I get the following error:

Collabora Online should use the same protocol as the server installation

When I try to open a document I get:

Failed to load Collabora Online - please try again later

Maybe you know what would be a quick fix for this problem? Thanks a lot in advance!

I also made a topic on the Nextcloud forum

[aaronSkar]

Hi @kromsam, I'll post this response in both places.

Here is a snippet from my /app/config/config.php, my assumption is you need to add the lines for overwritehost and overwriteprotocol. This is necessary if you wish to use the passwords app as well. Be sure to use your actual hostname for your nextcloud where I have used cloud.example.com below.

$CONFIG = array (
  'htaccess.RewriteBase' => '/',
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'trusted_proxies' => 
  array (
    0 => '172.30.0.3',
  ),
  'overwritehost' => 'cloud.example.com',
  'overwriteprotocol' => 'https',
  'apps_paths' => 
  array (
...

[aaronSkar]

@kromsam , looks like the NC conversation site is undergoing some maintenance. I will update there at a later date when replying is enabled again.

[kromsam]

I used the following Docker Ansible playbook: https://github.com/ReinerNippes/nextcloud_on_docker (testing branch has collabora). Which got me much closer to a solution, I think. I'm stiil stuck though.

This isn't really of your business of course. So I put the issue here: ReinerNippes/nextcloud_on_docker#5

[aaronSkar]

@kromsam, ok looks like you issue was solved by a pass proxy option in the other thread. Glad to see you are up and running!

[alecbcs]

Hi everyone I'm having a similar issue, I've gotten the Collabora server to start up successfully and when navigating to office.MY-DOMAIN.COM I see the OK message. I'm also able to go to the /hosting/discovery path and see the XML configuration. However, when I attempt to open a document through Nextcloud I get a Failed to load Collabora Online - please try again later error. From @kromsam's experience I think this could be because of a miss-configured nginx proxy. Does anyone know of a fix?

Below is my default.conf file for nginx,

# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
# scheme used to connect to this server
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
  default $http_x_forwarded_proto;
  ''      $scheme;
}
# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
# server port the client connected to
map $http_x_forwarded_port $proxy_x_forwarded_port {
  default $http_x_forwarded_port;
  ''      $server_port;
}
# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
# Connection header that may have been passed to this server
map $http_upgrade $proxy_connection {
  default upgrade;
  '' close;
}
# Apply fix for very long server names
server_names_hash_bucket_size 128;
# Default dhparam
ssl_dhparam /etc/nginx/dhparam/dhparam.pem;
# Set appropriate X-Forwarded-Ssl header
map $scheme $proxy_x_forwarded_ssl {
  default off;
  https on;
}
gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
log_format vhost '$host $remote_addr - $remote_user [$time_local] '
                 '"$request" $status $body_bytes_sent '
                 '"$http_referer" "$http_user_agent"';
access_log off;
resolver 127.0.0.11;
# HTTP 1.1 support
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
# Mitigate httpoxy attack (see README for details)
proxy_set_header Proxy "";
server {
	server_name _; # This is just an invalid value which will never trigger on a real hostname.
	listen 80;
	access_log /var/log/nginx/access.log vhost;
	return 503;
}
server {
	server_name _; # This is just an invalid value which will never trigger on a real hostname.
	listen 443 ssl http2;
	access_log /var/log/nginx/access.log vhost;
	return 503;
	ssl_session_tickets off;
	ssl_certificate /etc/nginx/certs/default.crt;
	ssl_certificate_key /etc/nginx/certs/default.key;
}
# drive.DOMAIN.COM
upstream drive.DOMAIN.COM {
				# Cannot connect to network of this container
				server 127.0.0.1 down;
				## Can be connected with "fpm_proxy-tier" network
			# fpm_web_1
			server 172.19.0.5:80;
}
server {
	server_name drive.DOMAIN.COM;
	listen 80 ;
	access_log /var/log/nginx/access.log vhost;
	return 301 https://$host$request_uri;
}
server {
	server_name drive.DOMAIN.COM;
	listen 443 ssl http2 ;
	access_log /var/log/nginx/access.log vhost;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
	ssl_ciphers {REMOVED};
	ssl_prefer_server_ciphers on;
	ssl_session_timeout 5m;
	ssl_session_cache shared:SSL:50m;
	ssl_session_tickets off;
	ssl_certificate /etc/nginx/certs/drive.DOMAIN.COM.crt;
	ssl_certificate_key /etc/nginx/certs/drive.DOMAIN.COM.key;
	ssl_dhparam /etc/nginx/certs/drive.DOMAIN.COM.dhparam.pem;
	ssl_stapling on;
	ssl_stapling_verify on;
	ssl_trusted_certificate /etc/nginx/certs/drive.DOMAIN.COM.chain.pem;
	add_header Strict-Transport-Security "max-age=31536000" always;
	include /etc/nginx/vhost.d/default;
	location / {
		proxy_pass http://drive.DOMAIN.COM;
	}
}
# office.DOMAIN.COM
upstream office.DOMAIN.COM {
				## Can be connected with "fpm_proxy-tier" network
			# nextcloud-collab
			server 172.19.0.4:9980;
}
server {
	server_name office.DOMAIN.COM;
	listen 80 ;
	access_log /var/log/nginx/access.log vhost;
	return 301 https://$host$request_uri;
}
server {
	server_name office.DOMAIN.COM;
	listen 443 ssl http2 ;
	access_log /var/log/nginx/access.log vhost;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
	ssl_ciphers {REMOVED};
	ssl_prefer_server_ciphers on;
	ssl_session_timeout 5m;
	ssl_session_cache shared:SSL:50m;
	ssl_session_tickets off;
	ssl_certificate /etc/nginx/certs/office.DOMAIN.COM.crt;
	ssl_certificate_key /etc/nginx/certs/office.DOMAIN.COM.key;
	ssl_dhparam /etc/nginx/certs/office.DOMAIN.COM.dhparam.pem;
	ssl_stapling on;
	ssl_stapling_verify on;
	ssl_trusted_certificate /etc/nginx/certs/office.DOMAIN.COM.chain.pem;
	add_header Strict-Transport-Security "max-age=31536000" always;
	include /etc/nginx/vhost.d/default;
	location / {
		proxy_pass https://office.DOMAIN.COM;

and here is my docker-compose.yml

version: '3'

services:
  db:
    image: mariadb
    container_name: nextcloud-database
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    restart: always
    volumes:
      - /drive/nextcloud/db:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=PASSWORD-EXAMPLE
    env_file:
      - db.env

  app:
    image: nextcloud:fpm-alpine
    restart: always
    volumes:
      - /drive/nextcloud/data:/var/www/html
    environment:
      - MYSQL_HOST=db
    env_file:
      - db.env
    depends_on:
      - db

  web:
    build: ./web
    restart: always
    volumes:
      - /drive/nextcloud/data:/var/www/html:ro
    environment:
      - VIRTUAL_HOST=drive.DOMAIN.COM
      - LETSENCRYPT_HOST=drive.DOMAIN.COM
      - [email protected]
    depends_on:
      - app
    networks:
      - proxy-tier
      - default

  proxy:
    container_name: nextcloud-proxy
    image: jwilder/nginx-proxy:alpine
    restart: always
    ports:
      - 80:80
      - 443:443
    labels:
      com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
    volumes:
      - /drive/nextcloud/nginx/conf:/etc/nginx/conf.d:rw
      - /drive/nextcloud/certs:/etc/nginx/certs:ro
      - /drive/nextcloud/vhost:/etc/nginx/vhost.d
      - /drive/nextcloud/html:/usr/share/nginx/html
      - /var/run/docker.sock:/tmp/docker.sock:ro
    networks:
      - proxy-tier

  letsencrypt-companion:
    image: jrcs/letsencrypt-nginx-proxy-companion
    container_name: nextcloud-letsencrypt
    restart: always
    volumes:
      - /drive/nextcloud/certs:/etc/nginx/certs
      - /drive/nextcloud/vhost:/etc/nginx/vhost.d
      - /drive/nextcloud/html:/usr/share/nginx/html
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - proxy-tier
    depends_on:
      - proxy

  collab:
    image: collabora/code
    container_name: nextcloud-collab
    networks:
      - proxy-tier
    depends_on:
      - proxy
      - letsencrypt-companion
    cap_add:
     - MKNOD
    ports:
      - 127.0.0.1:9980:9980
    environment:
      - domain=drive\\.DOMAIN\\.COM
      - username=admin
      - password=PASSWORD-EXAMPLE
      - VIRTUAL_PROTO=https
      - VIRTUAL_PORT=443
      - VIRTUAL_HOST=office.DOMAIN.COM
      - LETSENCRYPT_HOST=office.DOMAIN.COM
      - [email protected]
    restart: always

volumes:
  db:
  nextcloud:
  certs:
  vhost.d:
  html:

networks:
  proxy-tier:

[dpcee30]

Hi everyone I'm having a similar issue, I've gotten the Collabora server to start up successfully and when navigating to office.MY-DOMAIN.COM I see the OK message. I'm also able to go to the /hosting/discovery path and see the XML configuration. However, when I attempt to open a document through Nextcloud I get a Failed to load Collabora Online - please try again later error. From @kromsam's experience I think this could be because of a miss-configured nginx proxy. Does anyone know of a fix?

Below is my default.conf file for nginx,

# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
# scheme used to connect to this server
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
  default $http_x_forwarded_proto;
  ''      $scheme;
}
# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
# server port the client connected to
map $http_x_forwarded_port $proxy_x_forwarded_port {
  default $http_x_forwarded_port;
  ''      $server_port;
}
# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
# Connection header that may have been passed to this server
map $http_upgrade $proxy_connection {
  default upgrade;
  '' close;
}
# Apply fix for very long server names
server_names_hash_bucket_size 128;
# Default dhparam
ssl_dhparam /etc/nginx/dhparam/dhparam.pem;
# Set appropriate X-Forwarded-Ssl header
map $scheme $proxy_x_forwarded_ssl {
  default off;
  https on;
}
gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
log_format vhost '$host $remote_addr - $remote_user [$time_local] '
                 '"$request" $status $body_bytes_sent '
                 '"$http_referer" "$http_user_agent"';
access_log off;
resolver 127.0.0.11;
# HTTP 1.1 support
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
# Mitigate httpoxy attack (see README for details)
proxy_set_header Proxy "";
server {
	server_name _; # This is just an invalid value which will never trigger on a real hostname.
	listen 80;
	access_log /var/log/nginx/access.log vhost;
	return 503;
}
server {
	server_name _; # This is just an invalid value which will never trigger on a real hostname.
	listen 443 ssl http2;
	access_log /var/log/nginx/access.log vhost;
	return 503;
	ssl_session_tickets off;
	ssl_certificate /etc/nginx/certs/default.crt;
	ssl_certificate_key /etc/nginx/certs/default.key;
}
# drive.DOMAIN.COM
upstream drive.DOMAIN.COM {
				# Cannot connect to network of this container
				server 127.0.0.1 down;
				## Can be connected with "fpm_proxy-tier" network
			# fpm_web_1
			server 172.19.0.5:80;
}
server {
	server_name drive.DOMAIN.COM;
	listen 80 ;
	access_log /var/log/nginx/access.log vhost;
	return 301 https://$host$request_uri;
}
server {
	server_name drive.DOMAIN.COM;
	listen 443 ssl http2 ;
	access_log /var/log/nginx/access.log vhost;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
	ssl_ciphers {REMOVED};
	ssl_prefer_server_ciphers on;
	ssl_session_timeout 5m;
	ssl_session_cache shared:SSL:50m;
	ssl_session_tickets off;
	ssl_certificate /etc/nginx/certs/drive.DOMAIN.COM.crt;
	ssl_certificate_key /etc/nginx/certs/drive.DOMAIN.COM.key;
	ssl_dhparam /etc/nginx/certs/drive.DOMAIN.COM.dhparam.pem;
	ssl_stapling on;
	ssl_stapling_verify on;
	ssl_trusted_certificate /etc/nginx/certs/drive.DOMAIN.COM.chain.pem;
	add_header Strict-Transport-Security "max-age=31536000" always;
	include /etc/nginx/vhost.d/default;
	location / {
		proxy_pass http://drive.DOMAIN.COM;
	}
}
# office.DOMAIN.COM
upstream office.DOMAIN.COM {
				## Can be connected with "fpm_proxy-tier" network
			# nextcloud-collab
			server 172.19.0.4:9980;
}
server {
	server_name office.DOMAIN.COM;
	listen 80 ;
	access_log /var/log/nginx/access.log vhost;
	return 301 https://$host$request_uri;
}
server {
	server_name office.DOMAIN.COM;
	listen 443 ssl http2 ;
	access_log /var/log/nginx/access.log vhost;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
	ssl_ciphers {REMOVED};
	ssl_prefer_server_ciphers on;
	ssl_session_timeout 5m;
	ssl_session_cache shared:SSL:50m;
	ssl_session_tickets off;
	ssl_certificate /etc/nginx/certs/office.DOMAIN.COM.crt;
	ssl_certificate_key /etc/nginx/certs/office.DOMAIN.COM.key;
	ssl_dhparam /etc/nginx/certs/office.DOMAIN.COM.dhparam.pem;
	ssl_stapling on;
	ssl_stapling_verify on;
	ssl_trusted_certificate /etc/nginx/certs/office.DOMAIN.COM.chain.pem;
	add_header Strict-Transport-Security "max-age=31536000" always;
	include /etc/nginx/vhost.d/default;
	location / {
		proxy_pass https://office.DOMAIN.COM;

and here is my docker-compose.yml

version: '3'

services:
  db:
    image: mariadb
    container_name: nextcloud-database
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    restart: always
    volumes:
      - /drive/nextcloud/db:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=PASSWORD-EXAMPLE
    env_file:
      - db.env

  app:
    image: nextcloud:fpm-alpine
    restart: always
    volumes:
      - /drive/nextcloud/data:/var/www/html
    environment:
      - MYSQL_HOST=db
    env_file:
      - db.env
    depends_on:
      - db

  web:
    build: ./web
    restart: always
    volumes:
      - /drive/nextcloud/data:/var/www/html:ro
    environment:
      - VIRTUAL_HOST=drive.DOMAIN.COM
      - LETSENCRYPT_HOST=drive.DOMAIN.COM
      - [email protected]
    depends_on:
      - app
    networks:
      - proxy-tier
      - default

  proxy:
    container_name: nextcloud-proxy
    image: jwilder/nginx-proxy:alpine
    restart: always
    ports:
      - 80:80
      - 443:443
    labels:
      com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
    volumes:
      - /drive/nextcloud/nginx/conf:/etc/nginx/conf.d:rw
      - /drive/nextcloud/certs:/etc/nginx/certs:ro
      - /drive/nextcloud/vhost:/etc/nginx/vhost.d
      - /drive/nextcloud/html:/usr/share/nginx/html
      - /var/run/docker.sock:/tmp/docker.sock:ro
    networks:
      - proxy-tier

  letsencrypt-companion:
    image: jrcs/letsencrypt-nginx-proxy-companion
    container_name: nextcloud-letsencrypt
    restart: always
    volumes:
      - /drive/nextcloud/certs:/etc/nginx/certs
      - /drive/nextcloud/vhost:/etc/nginx/vhost.d
      - /drive/nextcloud/html:/usr/share/nginx/html
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - proxy-tier
    depends_on:
      - proxy

  collab:
    image: collabora/code
    container_name: nextcloud-collab
    networks:
      - proxy-tier
    depends_on:
      - proxy
      - letsencrypt-companion
    cap_add:
     - MKNOD
    ports:
      - 127.0.0.1:9980:9980
    environment:
      - domain=drive\\.DOMAIN\\.COM
      - username=admin
      - password=PASSWORD-EXAMPLE
      - VIRTUAL_PROTO=https
      - VIRTUAL_PORT=443
      - VIRTUAL_HOST=office.DOMAIN.COM
      - LETSENCRYPT_HOST=office.DOMAIN.COM
      - [email protected]
    restart: always

volumes:
  db:
  nextcloud:
  certs:
  vhost.d:
  html:

networks:
  proxy-tier:

Same as here

[aaronSkar]

Hi @dpcee30 have you put this configuration in your /app/config/config.php? You may need to add 2 lines into this config file. (I'm not aware of any reason to modify your nginx config file manually. If you want to do large file uploads you may need to add an additional file but that is a separate issue.)

'overwritehost' => 'cloud.example.com',
'overwriteprotocol' => 'https',

After adding these lines you may need to restart your nextcloud docker container.

Here is a snippet from my /app/config/config.php, my assumption is you need to add the lines for overwritehost and overwriteprotocol. This is necessary if you wish to use the passwords app as well. Be sure to use your actual hostname for your nextcloud where I have used cloud.example.com below.

$CONFIG = array (
  'htaccess.RewriteBase' => '/',
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'trusted_proxies' => 
  array (
    0 => '172.30.0.3',
  ),
  'overwritehost' => 'cloud.example.com',
  'overwriteprotocol' => 'https',
  'apps_paths' => 
  array (
...

[palto42]

Just want to note that it can take a few minutes until the docker container with collabora is fully up an running, on my server it takes ~8 minutes!
Initially I was also thinking that something is wrong with my config, but then I found that I just needed to wait a bit longer.

[alecbcs]

@aaronSkar applying both overwritehost and overwriteprotocol fixed the error about different protocols when saving the Collabora domain (office.DOMAIN.COM) in the Nextcloud settings. However, I'm still unable to open any documents in Collabora.

[alecbcs]

@palto42 thanks for the note about waiting a few minutes for the container to boot. Unfortunately, my container appears to be fully online (getting the OK message from Collabora and able to access the admin settings) however, I'm still unable to load documents from Nextcloud.

[aaronSkar]

@alecbcs I don't see anything jumping out as wrong when looking at your config. I'll comb through it more this afternoon. Good to hear the errors are gone. The wait period mention is a real thing but once your are getting the OK message it should be ready to use in my experience.

Can you describe the documents you are opening a bit more for me? Are they newly created in nextcloud? Are they existing? What is the extension?

Also can you give the version of collabora you are on?

[aaronSkar]

@alecbcs so looking at your default.conf file things look ok assuming there is actually a list of ssl_ciphers where you have {removed} and the last 2 } are present in the actual file and just cut off in the copy/paste.

Otherwise is basically identical to what I have on my servers.

[aaronSkar]

@alecbcs can you also share how you entered the url into the collabora settings field (URL (and Port) of Collabora Online-server)?

[alecbcs]

@aaronSkar I have entered the domain as https://office.DOMAIN.COM without a port as I believe the system is forwarding the data correctly through 443.

[alecbcs]

@aaronSkar currently I'm curious if the problem is using the fpm-alpine container rather than the apache based server. The fpm system effectively runs another web server on top of Nextcloud and I wonder if that is the issue.

[thomas-mc-work]

TDL => TLD

[thomas-mc-work]

TDL => TLD

[thomas-mc-work]

Double backslash is only required when invoked from a shell. Here a single backslash would suffice.

[lazka]

Use http here because the reverse proxy handles SSL:

      - VIRTUAL_PORT=9980
      - extra_params=--o:ssl.enable=false --o:ssl.termination=true

(and remove VIRTUAL_PROTO)

[tenhishadow]

why don't you use just

expose:
  - '9980'

and then connect nextcloud via nextcloud_network using container name nextcloud-collab
??

Also you need to specify domain=container_name

[CGDoctor8]

I have been unable to connect via local host if you have done this please let me know otherwise you can use the expose if you add

- VIRTUAL_NETWORK=proxy-ssl

and change your networks to look like this

  nextcloud_network:
    external:
      name: proxy-ssl

With a working version looking like this

  collabora:
    image: collabora/code
    container_name: nextcloud-collab
    networks:
      - nextcloud_network
    depends_on:
      - reverse-proxy
    cap_add:
     - MKNOD
    expose:
      - 9980
    environment:
      - domain=${HOST}
      - VIRTUAL_HOST=cloud\.DOMAIN\.TLD
      - VIRTUAL_NETWORK=proxy-ssl
      - VIRTUAL_PORT=9980
      - extra_params=--o:ssl.enable=false --o:ssl.termination=true
      - LETSENCRYPT_HOST=collabora\.DOMAIN\.TDL
    restart: unless-stopped 

networks:
  nextcloud_network:
    external:
      name: proxy-ssl

you do have to run docker network create proxy-ssl Before it works

Edit:
you also must set your settings to something like this

[aliceinwire]

same here. cannot connect at all, the only thing is using the docker instance ip address as collabora online-server ip address but also that is not working with I think the ws connection.
I can only access the admin panel and to /hosting/discovery

  collabora:
    image: collabora/code
    container_name: collabora
    networks:
      - proxy-tier
    depends_on:
      - proxy
    restart: always
    expose:
      - 9980
    cap_add:
      - MKNOD
    environment:
      - username=admin
      - password=password
      - domain=ntc.example.tld
      - VIRTUAL_HOST=collabora.example.tld
      - VIRTUAL_NETWORK=nginx-proxy
      - VIRTUAL_PORT=9980
      - VIRTUAL_PROTO=https
      - LETSENCRYPT_HOST=collabora.example.tld
      - LETSENCRYPT_EMAIL=my-email

and the nextcloud script is here:
https://github.com/nextcloud/docker/blob/master/.examples/docker-compose/with-nginx-proxy/mariadb-cron-redis/fpm/docker-compose.yml

[aliceinwire]

I have been unable to connect via local host if you have done this please let me know otherwise you can use the expose if you add

about reverse proxy you can look here.
https://www.collaboraoffice.com/code/nginx-reverse-proxy/

[aliceinwire]

my was a firewall related issue.
So is ok for me to merge this.

[bentolor]

I had some issues to get everything working. I wanted a home-production-ready docker-based deployment of Nextcloud with:

• PostgreSQ backend based on NextCloud PostgreSQL Apache example
• Letsencrypt support with nginx
• Cron-based background Tasks using supervisord
• The Collabora Online myoffice (CODE) integration of this MR.

It seems I was able to get a working version running. Please see: https://github.com/bentolor/docker-nextcloud-collabora-postgresql-letsencrypt. Maybe it is helpful to others.

[rriemann]

What is the current status of this pull request?

[estan]

This example was working fine for us, except we had to add

        'overwritehost' => 'cloud.example.com',
        'overwriteprotocol' => 'https',

to our nextcloud/config/config.php.

However, this was back when we were using Nextcloud 15 and version 4.0.3 of the collabora/code image.

Today I did an upgrade to Nextcloud 18 and 4.2 of the collabora/code image, and it's no longer working :/ Nothing happens when clicking an ODT file, and the docker-compose logs are not showing any error that I can see. Neither does the JS console when clicking the ODT file.

Is anyone running this example successfully with Nextcloud 18, Collabora 4.2?

[estan]

This example was working fine for us, except we had to add

        'overwritehost' => 'cloud.example.com',
        'overwriteprotocol' => 'https',

to our nextcloud/config/config.php.

However, this was back when we were using Nextcloud 15 and version 4.0.3 of the collabora/code image.

Today I did an upgrade to Nextcloud 18 and 4.2 of the collabora/code image, and it's no longer working :/ Nothing happens when clicking an ODT file, and the docker-compose logs are not showing any error that I can see. Neither does the JS console when clicking the ODT file.

I was curious and tried in Chromium instead of Firefox, and then I get a popup Failed to load Collabora Online Development Edition - Please try again later, and a Failed to load resource: the server responded with a status of 404 () error in the JS console when it tried to fetch https://nextcloud.ourdomain.com/ocs/v2.php/apps/text/workspace?path=%2F.

[estan]

This example was working fine for us, except we had to add

        'overwritehost' => 'cloud.example.com',
        'overwriteprotocol' => 'https',

to our nextcloud/config/config.php.
However, this was back when we were using Nextcloud 15 and version 4.0.3 of the collabora/code image.
Today I did an upgrade to Nextcloud 18 and 4.2 of the collabora/code image, and it's no longer working :/ Nothing happens when clicking an ODT file, and the docker-compose logs are not showing any error that I can see. Neither does the JS console when clicking the ODT file.

I was curious and tried in Chromium instead of Firefox, and then I get a popup Failed to load Collabora Online Development Edition - Please try again later, and a Failed to load resource: the server responded with a status of 404 () error in the JS console when it tried to fetch https://nextcloud.ourdomain.com/ocs/v2.php/apps/text/workspace?path=%2F.

Nevermind, that JS console printout was from when loading the file listing page, not from when clicking the ODT file.

[bentolor]

Is anyone running this example successfully with Nextcloud 18, Collabora 4.2?

Yes: https://github.com/bentolor/docker-nextcloud-collabora-postgresql-letsencrypt

[estan]

Is anyone running this example successfully with Nextcloud 18, Collabora 4.2?

Yes: https://github.com/bentolor/docker-nextcloud-collabora-postgresql-letsencrypt

Thanks @bentolor, I will study the differences between our configs.

[estan]

Is anyone running this example successfully with Nextcloud 18, Collabora 4.2?

Yes: https://github.com/bentolor/docker-nextcloud-collabora-postgresql-letsencrypt

Thanks @bentolor, I will study the differences between our configs.

Turns out I had ran into nextcloud/richdocuments#917 , but was able to solve it using the workaround posted by the richdocuments app author.

[robinmetral]

Suggested change

	
	

[alexpovel]

Suggested change

	There is no need to specify a port, simply the pubilc domain used to create your certs for the office instance. Ports, 443 and 80 should be forwarded to the server.
	There is no need to specify a port, simply the public domain used to create your certs for the office instance. Ports 443 and 80 should be forwarded to the server.

[alexpovel]

In the nginx-proxy docs it reads:

If your container exposes multiple ports, nginx-proxy will default to the service running on port 80. If you need to specify a different port, you can set a VIRTUAL_PORT env var to select a different one. If your container only exposes one port and it has a VIRTUAL_HOST env var set, that port will be selected.

So I got this up and running setting only VIRTUAL_HOST. The container exposes 9980 per default, and nginx-proxy will pick up on that automatically. So we can stay DRY and not specify 9980 multiple times, or at all for that matter.

My setup is a bit different (reverse proxy is one docker-compose, Nextcloud instance another), but I can confirm this works:

  collabora:
    image: collabora/code
    networks:
      # Just the default network of this docker-compose (no need to declare, exists per default):
      - default
      # Outside access through `external` reverse-proxy network:
      - proxy_default
    depends_on:
      # NOT the reverse proxy, but nginx webserver for nextcloud-fpm image:
      - web
    cap_add:
     - MKNOD
    environment:
      - username=admin
      - password=password
      # Domain the service should be accessed from:
      - domain=${VIRTUAL_HOST}
      #
      - VIRTUAL_HOST=${COLLABORA_VIRTUAL_HOST}
      - LETSENCRYPT_HOST=${COLLABORA_VIRTUAL_HOST}
      #
      # Extra parameters to Collabora, see also
      # https://www.collaboraoffice.com/code/nginx-reverse-proxy/:
      # SSL terminates at the proxy
      - extra_params=--o:ssl.enable=false --o:ssl.termination=true

Note no ports were specified at all. nginx-proxy has created this entry in /etc/nginx/conf.d/default automatically:

# <office.domain.tld>
upstream <office.domain.tld> {
                                # Cannot connect to network of this container
                                server 127.0.0.1 down;
                                ## Can be connected with "proxy_default" network
                        # nextcloud_collabora_1
                        server 192.168.16.5:9980;
}

where nextcloud_collabora_1 is the automatic container name, generated from the above collabora service in a docker-compose.yaml in a nextcloud directory. I redacted my domain for <office.domain.tld>.

Very simple this way!

[warren-ru]

I confirm. Works great

[estan]

Could this be merged? It would be sad if it was just left here. We've been successfully running our instance off of this example (or well, what it looked like in April last year) for over a year now.

[Markus-Beier]

Suggested change

	- LETSENCRYPT_EMAIL=YOUR-EMAIL@DOMAIN.TDL
	- LETSENCRYPT_EMAIL=YOUR-EMAIL@DOMAIN.TLD

[Markus-Beier]

Suggested change

	- LETSENCRYPT_EMAIL=YOUR-EMAIL@DOMAIN.TDL
	- LETSENCRYPT_EMAIL=YOUR-EMAIL@DOMAIN.TLD

[Markus-Beier]

Suggested change

	# Create a root password for the maraiadb instance.
	# Create a root password for the mariadb instance.

[Markus-Beier]

Suggested change

	# Create a password for the nextcloud users. If you have to manually connect your database you would use the nextcloud user and this password.
	# Create a password for the nextcloud user. If you have to manually connect your database you would use the nextcloud user and this password.

[Markus-Beier]

Suggested change

	# This nees to be the same as what you set your app domain too (ex: cloud.domain.tld).
	# This needs to be the same as what you set your app domain to (ex: cloud.domain.tld).

[Draluy]

Hi, I'm also interested in this pull request.
I'm also struggling to make collabora work. I have an old docker compose file that hosts my 21.0.5-apache version of nextcloud, but cant figure how to add collabora and make it work. A working example would be wonderful.

[Draluy]

Just made it work with @alexpovel solution above. Thx!

[jayhill]

This is now out of date, as the domain environment variable is no longer supported, and one must use alias groups instead.

[greenbourne277]

Has anyone a running setup for this with a current nextcloud version (>= 24) and might share it? Or is this approach out of date?

[bentolor]

@greenbourne277 Still running https://github.com/bentolor/docker-nextcloud-collabora-postgresql-letsencrypt with current Nextcloud; currently v26.

[greenbourne277]

@bentolor Thx. Good to know that it works for some people. My setup is almost identical (mariadb instead of postgres) and when i try to open documents using NextCloud Office, nothing happens and the browser displays a Content Security Policy error (media-src was blocked). Does your setup include some changes in the config.php file?

[bentolor]

@greenbourne277 No. Literally as documented in my README.adoc .

• You did Step 7 & 8?
• https://yourinstance.foo.bar/settings/admin/overview does show up any actionable items?
• "What is config.php?"

[greenbourne277]

@bentolor I did Step 7 & 8.
I had one warning in this overview:

The reverse proxy header configuration is incorrect, or you are accessing Nextcloud from a trusted proxy. If not, this is a security issue and can allow an attacker to spoof their IP address as visible to the Nextcloud. Further information can be found in the [documentation ↗](https://docs.nextcloud.com/server/25/go.php?to=admin-reverse-proxy).

and added therefore the trusted_proxies option to my config.php which is nextclouds configuration file:

  'trusted_proxies' =>
  array (
    0 => 'localhost',
    1 => 'MYDOMAIN.de',
    2 => 'office.MYDOMAIN.de',
    3 => '::1',
  ),
);

[thomas-mc-work]

This PR has an age of four years now, and it has gained a lot of devotion and contributions. Is there something that is holding it back to be merged? I think this is a valuable addition for a lot of users. We can bring it to perfection after being merged.

[upsidedownsweetfood]

bumpp? how has this been open for 5 years?