n3wk/nextcloud-collabora-nodered
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Defaults matchar servern: intern CODE över HTTPS (ssl.enable=true)

Browse Source 
- collaboraUrl -> https://code:9980 överallt (config-node, example-flows,
  .env.example, docker-compose.yml, install.sh, resolve_collabora_url);
  http://code:9980 failar när CODE kör SSL
- verifyTls=false är nu ett krav (self-signed internt) i hjälptext/dok
- integrate: connect_nodered_bridge efter container-up (docker network
  connect bridge, ignorerar already connected) + verifiering via
  docker exec curl -sk https://code:9980/hosting/capabilities (HTTP 200)
- Publik URL förblir https://docs.domain.name i docs
This commit is contained in:
dev
2026-08-22 21:55:28 +02:00
parent 6e02c2d31e
commit 5ca7b4d4e0
9 changed files with 58 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+6 -5
View File
@@ -6,17 +6,18 @@ NEXTCLOUD_URL=https://cloud.domain.name
NEXTCLOUD_PUBLIC_URL=https://cloud.domain.name
# Collabora CODE
# COLLABORA_URL: intern CODE kör HTTP — http://code:9980 när CODE delar
# Docker-nätverk med Node-RED (integrate-into-nodered.sh connectar CODE
# till nodernätet automatiskt; annars: docker network connect bridge nextcloud-node-red).
# Fallback om 'code' inte kan resolvas: http://<CODE-IP>:9980 (t.ex. 172.17.0.x).
# COLLABORA_URL: intern CODE kör HTTPS (ssl.enable=true, self-signed) —
# https://code:9980 när CODE delar Docker-nätverk med Node-RED.
# http://code:9980 failar när CODE har SSL påslaget.
# Fallback om 'code' inte kan resolvas: https://<CODE-IP>:9980 (t.ex. 172.17.0.x).
# ALDRIG http://127.0.0.1:9980 eller http://host.docker.internal:9980 —
# CODE kör inte på Node-RED-värden.
# verifyTls=false i nc-collab-config (self-signed internt).
# Publik URL (browser/WOPI) styrs av collaboraPublicUrl i nc-collab-config,
# t.ex. https://docs.domain.name.
CODE_CONTAINER=code
COLLABORA_IP=
COLLABORA_URL=http://code:9980
COLLABORA_URL=https://code:9980
# Existing Node-RED install (integrate mode)
NODERED_DIR=
README.md
+1 -1
View File
@@ -52,7 +52,7 @@ Palette: **nextcloud collabora** — six nodes in the same purple, all wired to
## Collabora URLs — intern vs publik
- **Intern `collaboraUrl`** (Node-RED → CODE): plain **HTTP** — `http://code:9980` när CODE delar nätverk med Node-RED, eller fallback `http://<bridge-ip>:9980` (t.ex. `172.17.0.x`) efter `docker network connect bridge nextcloud-node-red`. Aldrig HTTPS mot bridge-IP.
- **Intern `collaboraUrl`** (Node-RED → CODE): **HTTPS**, self-signed — `https://code:9980` när CODE delar nätverk med Node-RED (`ssl.enable=true`; `http://code:9980` failar), eller fallback `https://<bridge-ip>:9980` (t.ex. `172.17.0.x`) efter `docker network connect bridge nextcloud-node-red`. Sätt `verifyTls=false` i config-noden (self-signed internt).
- **Publik `collaboraPublicUrl`** (browser/WOPI): `https://docs.domain.name` — CODE via reverse proxy.
Full guide and examples: **[docs/NODES.md](docs/NODES.md)** · import **[flows/example-flows.json](flows/example-flows.json)**
docker-compose.yml
+1 -1
View File
@@ -13,7 +13,7 @@ services:
PORT: "1881"
TZ: ${TZ:-Europe/Stockholm}
NEXTCLOUD_URL: ${NEXTCLOUD_URL:-https://cloud.domain.name}
COLLABORA_URL: ${COLLABORA_URL:-http://code:9980}
COLLABORA_URL: ${COLLABORA_URL:-https://code:9980}
extra_hosts:
- "host.docker.internal:host-gateway"
- "cloud.domain.name:${NC_HOST_IP:-192.168.1.10}"
docs/INFRASTRUCTURE.md
+2 -2
View File
@@ -35,10 +35,10 @@ Sidecar `nextcloud-collabora-nodered` on :1881 is **not used** — integrate mod
| Use | URL |
|-----|-----|
| Nextcloud API / WebDAV | `https://cloud.example.com` |
| CODE from Node-RED container (intern) | `http://code:9980` — plain **HTTP**; fallback `http://<bridge-ip>:9980` efter `docker network connect bridge nextcloud-node-red` |
| CODE from Node-RED container (intern) | `https://code:9980` — intern **HTTPS** (self-signed, `ssl.enable=true`), `verifyTls=false`; `http://code:9980` failar. Fallback `https://<bridge-ip>:9980` efter `docker network connect bridge nextcloud-node-red` |
| Browser editor / WOPI (publik) | `collaboraPublicUrl` — t.ex. `https://docs.domain.name` (CODE via reverse proxy) |
Intern CODE lyssnar på HTTP — aldrig HTTPS mot bridge-IP. Publik åtkomst via reverse proxy.
Intern CODE lyssnar på HTTPS med self-signed-cert — Node-RED-noderna använder därför `https://code:9980` med `verifyTls=false`. Publik åtkomst via reverse proxy.
## Gitea (optional)
docs/NODES.md
+3 -3
View File
@@ -7,7 +7,7 @@ Six flow nodes in the palette plus one config node. All six point at the same **
| Backend | Typical URL | Role |
|---------|-------------|------|
| Nextcloud | `https://cloud.example.com` | Files (WebDAV) + Office API (OCS) |
| Collabora CODE | `http://code:9980` (intern HTTP; fallback `http://<bridge-ip>:9980`) | Conversion (`/cool/...`) on Docker bridge |
| Collabora CODE | `https://code:9980` (intern HTTPS, self-signed; `verifyTls=false`; fallback `https://<bridge-ip>:9980`) | Conversion (`/cool/...`) on Docker bridge |
Auth: **username + app password**. Not your account password.
@@ -167,11 +167,11 @@ Create under the gear icon in Node-RED. All six flow nodes pick the same config
| Field | Example |
|-------|---------|
| nextcloudUrl | `https://cloud.example.com` |
| collaboraUrl | `http://code:9980` — intern CODE är **HTTP**; fallback `http://<bridge-ip>:9980` efter `docker network connect bridge nextcloud-node-red` |
| collaboraUrl | `https://code:9980` — intern CODE kör **HTTPS** (self-signed); `verifyTls=false`. Fallback `https://<bridge-ip>:9980` efter `docker network connect bridge nextcloud-node-red`. `http://code:9980` failar när CODE har `ssl.enable=true` |
| collaboraPublicUrl | `https://docs.domain.name` (publik, browser/WOPI) |
| username + app password | Nextcloud login |
Intern CODE körs utan TLS (`http://`) — publik åtkomst går via reverse proxy (HTTPS).
Intern CODE körs med TLS och self-signed-cert (`ssl.enable=true`) — därför `https://` + `verifyTls=false` internt; publik åtkomst går via reverse proxy (giltigt cert).
### createAssetLink (assets)
flows/example-flows.json
+1 -1
View File
@@ -11,7 +11,7 @@
"type": "nc-collab-config",
"name": "cloud.domain.name",
"nextcloudUrl": "https://cloud.domain.name",
"collaboraUrl": "http://code:9980",
"collaboraUrl": "https://code:9980",
"collaboraPublicUrl": "https://cloud.domain.name",
"username": "FILL_IN_USER",
"verifyTls": false
install.sh
+4 -3
View File
@@ -35,11 +35,12 @@ NODERED_CONTAINER="${NODERED_CONTAINER:-nextcloud-node-red}"
NODERED_PORT="${NODERED_PORT:-1880}"
CODE_CONTAINER="${CODE_CONTAINER:-code}"
COLLABORA_IP="${COLLABORA_IP:-}"
# Intern CODE är HTTP. Aldrig http://127.0.0.1:9980 eller http://host.docker.internal:9980
case "${COLLABORA_URL:-http://code:9980}" in
# Intern CODE kör HTTPS (ssl.enable=true, self-signed). http://code:9980 failar.
# Aldrig 127.0.0.1/host.docker.internal — CODE kör inte på Node-RED-värden.
case "${COLLABORA_URL:-https://code:9980}" in
http://127.0.0.1:*|http://localhost:*|http://host.docker.internal:*|\
https://127.0.0.1:*|https://localhost:*|https://host.docker.internal:*|"")
COLLABORA_URL="http://code:9980" ;;
COLLABORA_URL="https://code:9980" ;;
*) COLLABORA_URL="${COLLABORA_URL}" ;;
esac
NEXTCLOUD_URL="${NEXTCLOUD_URL:-https://cloud.domain.name}"
nodes/nc-collab-config.html
+3 -3
View File
@@ -4,7 +4,7 @@
defaults: {
name: { value: '' },
nextcloudUrl: { value: 'https://cloud.domain.name', required: true },
collaboraUrl: { value: 'http://code:9980', required: true },
collaboraUrl: { value: 'https://code:9980', required: true },
collaboraPublicUrl: { value: 'https://cloud.domain.name' },
username: { value: '', required: true },
verifyTls: { value: false }
@@ -56,11 +56,11 @@
<h4>Two backends</h4>
<ul>
<li><strong>Nextcloud</strong> (<code>nextcloudUrl</code>) — files via WebDAV + Office API (OCS richdocuments)</li>
<li><strong>Collabora CODE</strong> (<code>collaboraUrl</code>) — conversion engine (<code>/cool/...</code>). Internal CODE is plain <strong>HTTP</strong>: <code>http://code:9980</code> (shared Docker network) or fallback <code>http://&lt;bridge-ip&gt;:9980</code>, e.g. <code>http://172.17.0.2:9980</code> after <code>docker network connect bridge nextcloud-node-red</code>. Never HTTPS against the internal bridge.</li>
<li><strong>Collabora CODE</strong> (<code>collaboraUrl</code>) — conversion engine (<code>/cool/...</code>). Internal CODE runs <strong>HTTPS</strong> (self-signed, <code>ssl.enable=true</code>): <code>https://code:9980</code> (shared Docker network) or fallback <code>https://&lt;bridge-ip&gt;:9980</code>, e.g. <code>https://172.17.0.2:9980</code>, after <code>docker network connect bridge nextcloud-node-red</code>. Plain HTTP (<code>http://code:9980</code>) fails — CODE refuses it when SSL is enabled.</li>
</ul>
<p><strong>Auth:</strong> username + <em>app password</em>. Not your normal account password.</p>
<p><code>collaboraPublicUrl</code> — what the browser sees for WOPI/editor links, e.g. <code>https://docs.domain.name</code> (CODE proxied via Nextcloud/reverse proxy). Internal HTTP URLs won't work in an iframe.</p>
<p><code>verifyTls</code> — only relevant if you point <code>collaboraUrl</code> at an HTTPS endpoint; the default internal HTTP needs no TLS at all.</p>
<p><code>verifyTls</code> — must stay <strong>unchecked (false)</strong>: internal CODE uses a self-signed cert, so TLS verification would fail. Only enable it if <code>collaboraUrl</code> points at an endpoint with a trusted certificate.</p>
<p>Default output folder in bridge if you omit a destination: <code>/Dokument/OfficeOut/</code></p>
</script>
scripts/integrate-into-nodered.sh
+37 -14
View File
@@ -409,16 +409,17 @@ recreate_nodered_service() {
log "ExtraHosts (${extra}): $(docker inspect -f '{{json .HostConfig.ExtraHosts}}' "${NODERED_CONTAINER}")"
}
# COLLABORA_URL: intern CODE är HTTP — http://code:9980 primärt,
# fallback http://<CODE-IP>:9980.
# Aldrig http://127.0.0.1:9980 eller http://host.docker.internal:9980.
# COLLABORA_URL: intern CODE kör HTTPS (ssl.enable=true, self-signed) —
# https://code:9980 primärt, fallback https://<CODE-IP>:9980.
# http://code:9980 failar när CODE har SSL påslaget.
# Aldrig 127.0.0.1/host.docker.internal — CODE kör inte på Node-RED-värden.
resolve_collabora_url() {
local url="${COLLABORA_URL:-http://code:9980}"
local url="${COLLABORA_URL:-https://code:9980}"
case "${url}" in
http://127.0.0.1:*|http://localhost:*|http://host.docker.internal:*|\
https://127.0.0.1:*|https://localhost:*|https://host.docker.internal:*)
warn "Otillåten COLLABORA_URL '${url}' — tvingar http://code:9980"
url="http://code:9980"
http://*|http://127.0.0.1:*|http://localhost:*|http://host.docker.internal:*|\
https://127.0.0.1:*|https://localhost:*|https://host.docker.internal:*|"")
warn "Otillåten COLLABORA_URL '${url}' — tvingar https://code:9980"
url="https://code:9980"
;;
esac
@@ -428,8 +429,8 @@ resolve_collabora_url() {
ip="$(docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$v.IPAddress}} {{end}}' "${CODE_CONTAINER}" 2>/dev/null | awk '{print $1}')"
[ -n "${ip}" ] || ip="${COLLABORA_IP:-}"
if [ -n "${ip}" ]; then
warn "'code' inte resolvbart från ${NODERED_CONTAINER} — fallback http://${ip}:9980"
url="http://${ip}:9980"
warn "'code' inte resolvbart från ${NODERED_CONTAINER} — fallback https://${ip}:9980"
url="https://${ip}:9980"
else
die "Varken 'code'-DNS eller CODE-IP tillgänglig — kan inte sätta COLLABORA_URL"
fi
@@ -439,6 +440,22 @@ resolve_collabora_url() {
log "COLLABORA_URL=${COLLABORA_URL}"
}
# Node-RED-containern på default bridge — krävs för att nå https://code:9980.
# Körs EFTER container-up: recreate nollställer manuella network connect.
# Ignorerar "already connected".
connect_nodered_bridge() {
log "Connecting ${NODERED_CONTAINER} → bridge"
local out rc=0
out="$(docker network connect bridge "${NODERED_CONTAINER}" 2>&1)" || rc=$?
if [ "${rc}" -eq 0 ]; then
log "Connected: ${NODERED_CONTAINER} on bridge"
elif printf '%s' "${out}" | grep -qi 'already exists\|already connected'; then
log "Already connected: ${NODERED_CONTAINER} on bridge"
else
warn "docker network connect bridge ${NODERED_CONTAINER} misslyckades: ${out}"
fi
}
rebuild_nodered() {
log "Rebuilding ${NODERED_CONTAINER} (same instance, port ${NODERED_PORT})..."
fix_nodered_build_permissions
@@ -477,11 +494,16 @@ verify_code_from_nodered() {
fi
done
if docker exec "${NODERED_CONTAINER}" curl -sfk "${COLLABORA_URL}/hosting/capabilities" >/dev/null 2>&1; then
log "OK: CODE nås från Node-RED: ${COLLABORA_URL}/hosting/capabilities"
# Verifiera enligt serverns verklighet: CODE kör HTTPS internt,
# https://code:9980 ska ge HTTP 200 från Node-RED på bridge.
local code_status
code_status="$(docker exec "${NODERED_CONTAINER}" \
curl -sk -o /dev/null -w '%{http_code}' https://code:9980/hosting/capabilities 2>/dev/null || echo 000)"
if [ "${code_status}" = "200" ]; then
log "OK: CODE nås från Node-RED: https://code:9980/hosting/capabilities (HTTP 200)"
else
warn "CODE inte nåbar: ${COLLABORA_URL}/hosting/capabilities"
warn "Kör: docker network connect \$(docker inspect -f '{{range \$k,\$_ := .NetworkSettings.Networks}}{{printf \"%s\\n\" \$k}}{{end}}' ${NODERED_CONTAINER} | head -n1) ${CODE_CONTAINER}"
warn "CODE inte nåbar: https://code:9980/hosting/capabilities (HTTP ${code_status})"
warn "Kör: docker network connect bridge ${NODERED_CONTAINER} — http://code:9980 failar, CODE kräver HTTPS"
fail=1
fi
@@ -507,6 +529,7 @@ main() {
patch_dockerfile
patch_entrypoint
rebuild_nodered
connect_nodered_bridge
connect_code_network
resolve_collabora_url
wait_nodered