diff --git a/.env.example b/.env.example index 91af283..e7bb4e7 100644 --- a/.env.example +++ b/.env.example @@ -6,17 +6,18 @@ NEXTCLOUD_URL=https://cloud.domain.name NEXTCLOUD_PUBLIC_URL=https://cloud.domain.name # Collabora CODE -# COLLABORA_URL: intern CODE kör HTTP — http://code:9980 när CODE delar -# Docker-nätverk med Node-RED (integrate-into-nodered.sh connectar CODE -# till nodernätet automatiskt; annars: docker network connect bridge nextcloud-node-red). -# Fallback om 'code' inte kan resolvas: http://:9980 (t.ex. 172.17.0.x). +# COLLABORA_URL: intern CODE kör HTTPS (ssl.enable=true, self-signed) — +# https://code:9980 när CODE delar Docker-nätverk med Node-RED. +# http://code:9980 failar när CODE har SSL påslaget. +# Fallback om 'code' inte kan resolvas: https://:9980 (t.ex. 172.17.0.x). # ALDRIG http://127.0.0.1:9980 eller http://host.docker.internal:9980 — # CODE kör inte på Node-RED-värden. +# verifyTls=false i nc-collab-config (self-signed internt). # Publik URL (browser/WOPI) styrs av collaboraPublicUrl i nc-collab-config, # t.ex. https://docs.domain.name. CODE_CONTAINER=code COLLABORA_IP= -COLLABORA_URL=http://code:9980 +COLLABORA_URL=https://code:9980 # Existing Node-RED install (integrate mode) NODERED_DIR= diff --git a/README.md b/README.md index 9c94a9b..a906cc0 100644 --- a/README.md +++ b/README.md @@ -52,7 +52,7 @@ Palette: **nextcloud collabora** — six nodes in the same purple, all wired to ## Collabora URLs — intern vs publik -- **Intern `collaboraUrl`** (Node-RED → CODE): plain **HTTP** — `http://code:9980` när CODE delar nätverk med Node-RED, eller fallback `http://:9980` (t.ex. `172.17.0.x`) efter `docker network connect bridge nextcloud-node-red`. Aldrig HTTPS mot bridge-IP. +- **Intern `collaboraUrl`** (Node-RED → CODE): **HTTPS**, self-signed — `https://code:9980` när CODE delar nätverk med Node-RED (`ssl.enable=true`; `http://code:9980` failar), eller fallback `https://:9980` (t.ex. `172.17.0.x`) efter `docker network connect bridge nextcloud-node-red`. Sätt `verifyTls=false` i config-noden (self-signed internt). - **Publik `collaboraPublicUrl`** (browser/WOPI): `https://docs.domain.name` — CODE via reverse proxy. Full guide and examples: **[docs/NODES.md](docs/NODES.md)** · import **[flows/example-flows.json](flows/example-flows.json)** diff --git a/docker-compose.yml b/docker-compose.yml index 972d73b..306e8c6 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -13,7 +13,7 @@ services: PORT: "1881" TZ: ${TZ:-Europe/Stockholm} NEXTCLOUD_URL: ${NEXTCLOUD_URL:-https://cloud.domain.name} - COLLABORA_URL: ${COLLABORA_URL:-http://code:9980} + COLLABORA_URL: ${COLLABORA_URL:-https://code:9980} extra_hosts: - "host.docker.internal:host-gateway" - "cloud.domain.name:${NC_HOST_IP:-192.168.1.10}" diff --git a/docs/INFRASTRUCTURE.md b/docs/INFRASTRUCTURE.md index fb8ed8f..b5e1bb9 100644 --- a/docs/INFRASTRUCTURE.md +++ b/docs/INFRASTRUCTURE.md @@ -35,10 +35,10 @@ Sidecar `nextcloud-collabora-nodered` on :1881 is **not used** — integrate mod | Use | URL | |-----|-----| | Nextcloud API / WebDAV | `https://cloud.example.com` | -| CODE from Node-RED container (intern) | `http://code:9980` — plain **HTTP**; fallback `http://:9980` efter `docker network connect bridge nextcloud-node-red` | +| CODE from Node-RED container (intern) | `https://code:9980` — intern **HTTPS** (self-signed, `ssl.enable=true`), `verifyTls=false`; `http://code:9980` failar. Fallback `https://:9980` efter `docker network connect bridge nextcloud-node-red` | | Browser editor / WOPI (publik) | `collaboraPublicUrl` — t.ex. `https://docs.domain.name` (CODE via reverse proxy) | -Intern CODE lyssnar på HTTP — aldrig HTTPS mot bridge-IP. Publik åtkomst via reverse proxy. +Intern CODE lyssnar på HTTPS med self-signed-cert — Node-RED-noderna använder därför `https://code:9980` med `verifyTls=false`. Publik åtkomst via reverse proxy. ## Gitea (optional) diff --git a/docs/NODES.md b/docs/NODES.md index cc05523..ca8da23 100644 --- a/docs/NODES.md +++ b/docs/NODES.md @@ -7,7 +7,7 @@ Six flow nodes in the palette plus one config node. All six point at the same ** | Backend | Typical URL | Role | |---------|-------------|------| | Nextcloud | `https://cloud.example.com` | Files (WebDAV) + Office API (OCS) | -| Collabora CODE | `http://code:9980` (intern HTTP; fallback `http://:9980`) | Conversion (`/cool/...`) on Docker bridge | +| Collabora CODE | `https://code:9980` (intern HTTPS, self-signed; `verifyTls=false`; fallback `https://:9980`) | Conversion (`/cool/...`) on Docker bridge | Auth: **username + app password**. Not your account password. @@ -167,11 +167,11 @@ Create under the gear icon in Node-RED. All six flow nodes pick the same config | Field | Example | |-------|---------| | nextcloudUrl | `https://cloud.example.com` | -| collaboraUrl | `http://code:9980` — intern CODE är **HTTP**; fallback `http://:9980` efter `docker network connect bridge nextcloud-node-red` | +| collaboraUrl | `https://code:9980` — intern CODE kör **HTTPS** (self-signed); `verifyTls=false`. Fallback `https://:9980` efter `docker network connect bridge nextcloud-node-red`. `http://code:9980` failar när CODE har `ssl.enable=true` | | collaboraPublicUrl | `https://docs.domain.name` (publik, browser/WOPI) | | username + app password | Nextcloud login | -Intern CODE körs utan TLS (`http://`) — publik åtkomst går via reverse proxy (HTTPS). +Intern CODE körs med TLS och self-signed-cert (`ssl.enable=true`) — därför `https://` + `verifyTls=false` internt; publik åtkomst går via reverse proxy (giltigt cert). ### createAssetLink (assets) diff --git a/flows/example-flows.json b/flows/example-flows.json index 0cfe365..f45439b 100644 --- a/flows/example-flows.json +++ b/flows/example-flows.json @@ -11,7 +11,7 @@ "type": "nc-collab-config", "name": "cloud.domain.name", "nextcloudUrl": "https://cloud.domain.name", - "collaboraUrl": "http://code:9980", + "collaboraUrl": "https://code:9980", "collaboraPublicUrl": "https://cloud.domain.name", "username": "FILL_IN_USER", "verifyTls": false diff --git a/install.sh b/install.sh index 035c560..f5eff0a 100755 --- a/install.sh +++ b/install.sh @@ -35,11 +35,12 @@ NODERED_CONTAINER="${NODERED_CONTAINER:-nextcloud-node-red}" NODERED_PORT="${NODERED_PORT:-1880}" CODE_CONTAINER="${CODE_CONTAINER:-code}" COLLABORA_IP="${COLLABORA_IP:-}" -# Intern CODE är HTTP. Aldrig http://127.0.0.1:9980 eller http://host.docker.internal:9980 -case "${COLLABORA_URL:-http://code:9980}" in +# Intern CODE kör HTTPS (ssl.enable=true, self-signed). http://code:9980 failar. +# Aldrig 127.0.0.1/host.docker.internal — CODE kör inte på Node-RED-värden. +case "${COLLABORA_URL:-https://code:9980}" in http://127.0.0.1:*|http://localhost:*|http://host.docker.internal:*|\ https://127.0.0.1:*|https://localhost:*|https://host.docker.internal:*|"") - COLLABORA_URL="http://code:9980" ;; + COLLABORA_URL="https://code:9980" ;; *) COLLABORA_URL="${COLLABORA_URL}" ;; esac NEXTCLOUD_URL="${NEXTCLOUD_URL:-https://cloud.domain.name}" diff --git a/nodes/nc-collab-config.html b/nodes/nc-collab-config.html index 6c8347a..8f34406 100644 --- a/nodes/nc-collab-config.html +++ b/nodes/nc-collab-config.html @@ -4,7 +4,7 @@ defaults: { name: { value: '' }, nextcloudUrl: { value: 'https://cloud.domain.name', required: true }, - collaboraUrl: { value: 'http://code:9980', required: true }, + collaboraUrl: { value: 'https://code:9980', required: true }, collaboraPublicUrl: { value: 'https://cloud.domain.name' }, username: { value: '', required: true }, verifyTls: { value: false } @@ -56,11 +56,11 @@

Two backends

  • Nextcloud (nextcloudUrl) — files via WebDAV + Office API (OCS richdocuments)
    • -
  • Collabora CODE (collaboraUrl) — conversion engine (/cool/...). Internal CODE is plain HTTP: http://code:9980 (shared Docker network) or fallback http://<bridge-ip>:9980, e.g. http://172.17.0.2:9980 after docker network connect bridge nextcloud-node-red. Never HTTPS against the internal bridge.
    • +
  • Collabora CODE (collaboraUrl) — conversion engine (/cool/...). Internal CODE runs HTTPS (self-signed, ssl.enable=true): https://code:9980 (shared Docker network) or fallback https://<bridge-ip>:9980, e.g. https://172.17.0.2:9980, after docker network connect bridge nextcloud-node-red. Plain HTTP (http://code:9980) fails — CODE refuses it when SSL is enabled.

Auth: username + app password. Not your normal account password.

collaboraPublicUrl — what the browser sees for WOPI/editor links, e.g. https://docs.domain.name (CODE proxied via Nextcloud/reverse proxy). Internal HTTP URLs won't work in an iframe.

-

verifyTls — only relevant if you point collaboraUrl at an HTTPS endpoint; the default internal HTTP needs no TLS at all.

+

verifyTls — must stay unchecked (false): internal CODE uses a self-signed cert, so TLS verification would fail. Only enable it if collaboraUrl points at an endpoint with a trusted certificate.

Default output folder in bridge if you omit a destination: /Dokument/OfficeOut/

diff --git a/scripts/integrate-into-nodered.sh b/scripts/integrate-into-nodered.sh index 8ec7477..3d5863d 100755 --- a/scripts/integrate-into-nodered.sh +++ b/scripts/integrate-into-nodered.sh @@ -409,16 +409,17 @@ recreate_nodered_service() { log "ExtraHosts (${extra}): $(docker inspect -f '{{json .HostConfig.ExtraHosts}}' "${NODERED_CONTAINER}")" } -# COLLABORA_URL: intern CODE är HTTP — http://code:9980 primärt, -# fallback http://:9980. -# Aldrig http://127.0.0.1:9980 eller http://host.docker.internal:9980. +# COLLABORA_URL: intern CODE kör HTTPS (ssl.enable=true, self-signed) — +# https://code:9980 primärt, fallback https://:9980. +# http://code:9980 failar när CODE har SSL påslaget. +# Aldrig 127.0.0.1/host.docker.internal — CODE kör inte på Node-RED-värden. resolve_collabora_url() { - local url="${COLLABORA_URL:-http://code:9980}" + local url="${COLLABORA_URL:-https://code:9980}" case "${url}" in - http://127.0.0.1:*|http://localhost:*|http://host.docker.internal:*|\ - https://127.0.0.1:*|https://localhost:*|https://host.docker.internal:*) - warn "Otillåten COLLABORA_URL '${url}' — tvingar http://code:9980" - url="http://code:9980" + http://*|http://127.0.0.1:*|http://localhost:*|http://host.docker.internal:*|\ + https://127.0.0.1:*|https://localhost:*|https://host.docker.internal:*|"") + warn "Otillåten COLLABORA_URL '${url}' — tvingar https://code:9980" + url="https://code:9980" ;; esac @@ -428,8 +429,8 @@ resolve_collabora_url() { ip="$(docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$v.IPAddress}} {{end}}' "${CODE_CONTAINER}" 2>/dev/null | awk '{print $1}')" [ -n "${ip}" ] || ip="${COLLABORA_IP:-}" if [ -n "${ip}" ]; then - warn "'code' inte resolvbart från ${NODERED_CONTAINER} — fallback http://${ip}:9980" - url="http://${ip}:9980" + warn "'code' inte resolvbart från ${NODERED_CONTAINER} — fallback https://${ip}:9980" + url="https://${ip}:9980" else die "Varken 'code'-DNS eller CODE-IP tillgänglig — kan inte sätta COLLABORA_URL" fi @@ -439,6 +440,22 @@ resolve_collabora_url() { log "COLLABORA_URL=${COLLABORA_URL}" } +# Node-RED-containern på default bridge — krävs för att nå https://code:9980. +# Körs EFTER container-up: recreate nollställer manuella network connect. +# Ignorerar "already connected". +connect_nodered_bridge() { + log "Connecting ${NODERED_CONTAINER} → bridge" + local out rc=0 + out="$(docker network connect bridge "${NODERED_CONTAINER}" 2>&1)" || rc=$? + if [ "${rc}" -eq 0 ]; then + log "Connected: ${NODERED_CONTAINER} on bridge" + elif printf '%s' "${out}" | grep -qi 'already exists\|already connected'; then + log "Already connected: ${NODERED_CONTAINER} on bridge" + else + warn "docker network connect bridge ${NODERED_CONTAINER} misslyckades: ${out}" + fi +} + rebuild_nodered() { log "Rebuilding ${NODERED_CONTAINER} (same instance, port ${NODERED_PORT})..." fix_nodered_build_permissions @@ -477,11 +494,16 @@ verify_code_from_nodered() { fi done - if docker exec "${NODERED_CONTAINER}" curl -sfk "${COLLABORA_URL}/hosting/capabilities" >/dev/null 2>&1; then - log "OK: CODE nås från Node-RED: ${COLLABORA_URL}/hosting/capabilities" + # Verifiera enligt serverns verklighet: CODE kör HTTPS internt, + # https://code:9980 ska ge HTTP 200 från Node-RED på bridge. + local code_status + code_status="$(docker exec "${NODERED_CONTAINER}" \ + curl -sk -o /dev/null -w '%{http_code}' https://code:9980/hosting/capabilities 2>/dev/null || echo 000)" + if [ "${code_status}" = "200" ]; then + log "OK: CODE nås från Node-RED: https://code:9980/hosting/capabilities (HTTP 200)" else - warn "CODE inte nåbar: ${COLLABORA_URL}/hosting/capabilities" - warn "Kör: docker network connect \$(docker inspect -f '{{range \$k,\$_ := .NetworkSettings.Networks}}{{printf \"%s\\n\" \$k}}{{end}}' ${NODERED_CONTAINER} | head -n1) ${CODE_CONTAINER}" + warn "CODE inte nåbar: https://code:9980/hosting/capabilities (HTTP ${code_status})" + warn "Kör: docker network connect bridge ${NODERED_CONTAINER} — http://code:9980 failar, CODE kräver HTTPS" fail=1 fi @@ -507,6 +529,7 @@ main() { patch_dockerfile patch_entrypoint rebuild_nodered + connect_nodered_bridge connect_code_network resolve_collabora_url wait_nodered