Defaults matchar servern: intern CODE över HTTPS (ssl.enable=true)
- collaboraUrl -> https://code:9980 överallt (config-node, example-flows, .env.example, docker-compose.yml, install.sh, resolve_collabora_url); http://code:9980 failar när CODE kör SSL - verifyTls=false är nu ett krav (self-signed internt) i hjälptext/dok - integrate: connect_nodered_bridge efter container-up (docker network connect bridge, ignorerar already connected) + verifiering via docker exec curl -sk https://code:9980/hosting/capabilities (HTTP 200) - Publik URL förblir https://docs.domain.name i docs
This commit is contained in:
dev
+6
-5
@@ -6,17 +6,18 @@ NEXTCLOUD_URL=https://cloud.domain.name
|
||||
NEXTCLOUD_PUBLIC_URL=https://cloud.domain.name
|
||||
|
||||
# Collabora CODE
|
||||
# COLLABORA_URL: intern CODE kör HTTP — http://code:9980 när CODE delar
|
||||
# Docker-nätverk med Node-RED (integrate-into-nodered.sh connectar CODE
|
||||
# till nodernätet automatiskt; annars: docker network connect bridge nextcloud-node-red).
|
||||
# Fallback om 'code' inte kan resolvas: http://<CODE-IP>:9980 (t.ex. 172.17.0.x).
|
||||
# COLLABORA_URL: intern CODE kör HTTPS (ssl.enable=true, self-signed) —
|
||||
# https://code:9980 när CODE delar Docker-nätverk med Node-RED.
|
||||
# http://code:9980 failar när CODE har SSL påslaget.
|
||||
# Fallback om 'code' inte kan resolvas: https://<CODE-IP>:9980 (t.ex. 172.17.0.x).
|
||||
# ALDRIG http://127.0.0.1:9980 eller http://host.docker.internal:9980 —
|
||||
# CODE kör inte på Node-RED-värden.
|
||||
# verifyTls=false i nc-collab-config (self-signed internt).
|
||||
# Publik URL (browser/WOPI) styrs av collaboraPublicUrl i nc-collab-config,
|
||||
# t.ex. https://docs.domain.name.
|
||||
CODE_CONTAINER=code
|
||||
COLLABORA_IP=
|
||||
COLLABORA_URL=http://code:9980
|
||||
COLLABORA_URL=https://code:9980
|
||||
|
||||
# Existing Node-RED install (integrate mode)
|
||||
NODERED_DIR=
|
||||
|
||||
@@ -52,7 +52,7 @@ Palette: **nextcloud collabora** — six nodes in the same purple, all wired to
|
||||
|
||||
## Collabora URLs — intern vs publik
|
||||
|
||||
- **Intern `collaboraUrl`** (Node-RED → CODE): plain **HTTP** — `http://code:9980` när CODE delar nätverk med Node-RED, eller fallback `http://<bridge-ip>:9980` (t.ex. `172.17.0.x`) efter `docker network connect bridge nextcloud-node-red`. Aldrig HTTPS mot bridge-IP.
|
||||
- **Intern `collaboraUrl`** (Node-RED → CODE): **HTTPS**, self-signed — `https://code:9980` när CODE delar nätverk med Node-RED (`ssl.enable=true`; `http://code:9980` failar), eller fallback `https://<bridge-ip>:9980` (t.ex. `172.17.0.x`) efter `docker network connect bridge nextcloud-node-red`. Sätt `verifyTls=false` i config-noden (self-signed internt).
|
||||
- **Publik `collaboraPublicUrl`** (browser/WOPI): `https://docs.domain.name` — CODE via reverse proxy.
|
||||
|
||||
Full guide and examples: **[docs/NODES.md](docs/NODES.md)** · import **[flows/example-flows.json](flows/example-flows.json)**
|
||||
|
||||
+1
-1
@@ -13,7 +13,7 @@ services:
|
||||
PORT: "1881"
|
||||
TZ: ${TZ:-Europe/Stockholm}
|
||||
NEXTCLOUD_URL: ${NEXTCLOUD_URL:-https://cloud.domain.name}
|
||||
COLLABORA_URL: ${COLLABORA_URL:-http://code:9980}
|
||||
COLLABORA_URL: ${COLLABORA_URL:-https://code:9980}
|
||||
extra_hosts:
|
||||
- "host.docker.internal:host-gateway"
|
||||
- "cloud.domain.name:${NC_HOST_IP:-192.168.1.10}"
|
||||
|
||||
@@ -35,10 +35,10 @@ Sidecar `nextcloud-collabora-nodered` on :1881 is **not used** — integrate mod
|
||||
| Use | URL |
|
||||
|-----|-----|
|
||||
| Nextcloud API / WebDAV | `https://cloud.example.com` |
|
||||
| CODE from Node-RED container (intern) | `http://code:9980` — plain **HTTP**; fallback `http://<bridge-ip>:9980` efter `docker network connect bridge nextcloud-node-red` |
|
||||
| CODE from Node-RED container (intern) | `https://code:9980` — intern **HTTPS** (self-signed, `ssl.enable=true`), `verifyTls=false`; `http://code:9980` failar. Fallback `https://<bridge-ip>:9980` efter `docker network connect bridge nextcloud-node-red` |
|
||||
| Browser editor / WOPI (publik) | `collaboraPublicUrl` — t.ex. `https://docs.domain.name` (CODE via reverse proxy) |
|
||||
|
||||
Intern CODE lyssnar på HTTP — aldrig HTTPS mot bridge-IP. Publik åtkomst via reverse proxy.
|
||||
Intern CODE lyssnar på HTTPS med self-signed-cert — Node-RED-noderna använder därför `https://code:9980` med `verifyTls=false`. Publik åtkomst via reverse proxy.
|
||||
|
||||
## Gitea (optional)
|
||||
|
||||
|
||||
+3
-3
@@ -7,7 +7,7 @@ Six flow nodes in the palette plus one config node. All six point at the same **
|
||||
| Backend | Typical URL | Role |
|
||||
|---------|-------------|------|
|
||||
| Nextcloud | `https://cloud.example.com` | Files (WebDAV) + Office API (OCS) |
|
||||
| Collabora CODE | `http://code:9980` (intern HTTP; fallback `http://<bridge-ip>:9980`) | Conversion (`/cool/...`) on Docker bridge |
|
||||
| Collabora CODE | `https://code:9980` (intern HTTPS, self-signed; `verifyTls=false`; fallback `https://<bridge-ip>:9980`) | Conversion (`/cool/...`) on Docker bridge |
|
||||
|
||||
Auth: **username + app password**. Not your account password.
|
||||
|
||||
@@ -167,11 +167,11 @@ Create under the gear icon in Node-RED. All six flow nodes pick the same config
|
||||
| Field | Example |
|
||||
|-------|---------|
|
||||
| nextcloudUrl | `https://cloud.example.com` |
|
||||
| collaboraUrl | `http://code:9980` — intern CODE är **HTTP**; fallback `http://<bridge-ip>:9980` efter `docker network connect bridge nextcloud-node-red` |
|
||||
| collaboraUrl | `https://code:9980` — intern CODE kör **HTTPS** (self-signed); `verifyTls=false`. Fallback `https://<bridge-ip>:9980` efter `docker network connect bridge nextcloud-node-red`. `http://code:9980` failar när CODE har `ssl.enable=true` |
|
||||
| collaboraPublicUrl | `https://docs.domain.name` (publik, browser/WOPI) |
|
||||
| username + app password | Nextcloud login |
|
||||
|
||||
Intern CODE körs utan TLS (`http://`) — publik åtkomst går via reverse proxy (HTTPS).
|
||||
Intern CODE körs med TLS och self-signed-cert (`ssl.enable=true`) — därför `https://` + `verifyTls=false` internt; publik åtkomst går via reverse proxy (giltigt cert).
|
||||
|
||||
### createAssetLink (assets)
|
||||
|
||||
|
||||
@@ -11,7 +11,7 @@
|
||||
"type": "nc-collab-config",
|
||||
"name": "cloud.domain.name",
|
||||
"nextcloudUrl": "https://cloud.domain.name",
|
||||
"collaboraUrl": "http://code:9980",
|
||||
"collaboraUrl": "https://code:9980",
|
||||
"collaboraPublicUrl": "https://cloud.domain.name",
|
||||
"username": "FILL_IN_USER",
|
||||
"verifyTls": false
|
||||
|
||||
+4
-3
@@ -35,11 +35,12 @@ NODERED_CONTAINER="${NODERED_CONTAINER:-nextcloud-node-red}"
|
||||
NODERED_PORT="${NODERED_PORT:-1880}"
|
||||
CODE_CONTAINER="${CODE_CONTAINER:-code}"
|
||||
COLLABORA_IP="${COLLABORA_IP:-}"
|
||||
# Intern CODE är HTTP. Aldrig http://127.0.0.1:9980 eller http://host.docker.internal:9980
|
||||
case "${COLLABORA_URL:-http://code:9980}" in
|
||||
# Intern CODE kör HTTPS (ssl.enable=true, self-signed). http://code:9980 failar.
|
||||
# Aldrig 127.0.0.1/host.docker.internal — CODE kör inte på Node-RED-värden.
|
||||
case "${COLLABORA_URL:-https://code:9980}" in
|
||||
http://127.0.0.1:*|http://localhost:*|http://host.docker.internal:*|\
|
||||
https://127.0.0.1:*|https://localhost:*|https://host.docker.internal:*|"")
|
||||
COLLABORA_URL="http://code:9980" ;;
|
||||
COLLABORA_URL="https://code:9980" ;;
|
||||
*) COLLABORA_URL="${COLLABORA_URL}" ;;
|
||||
esac
|
||||
NEXTCLOUD_URL="${NEXTCLOUD_URL:-https://cloud.domain.name}"
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
defaults: {
|
||||
name: { value: '' },
|
||||
nextcloudUrl: { value: 'https://cloud.domain.name', required: true },
|
||||
collaboraUrl: { value: 'http://code:9980', required: true },
|
||||
collaboraUrl: { value: 'https://code:9980', required: true },
|
||||
collaboraPublicUrl: { value: 'https://cloud.domain.name' },
|
||||
username: { value: '', required: true },
|
||||
verifyTls: { value: false }
|
||||
@@ -56,11 +56,11 @@
|
||||
<h4>Two backends</h4>
|
||||
<ul>
|
||||
<li><strong>Nextcloud</strong> (<code>nextcloudUrl</code>) — files via WebDAV + Office API (OCS richdocuments)</li>
|
||||
<li><strong>Collabora CODE</strong> (<code>collaboraUrl</code>) — conversion engine (<code>/cool/...</code>). Internal CODE is plain <strong>HTTP</strong>: <code>http://code:9980</code> (shared Docker network) or fallback <code>http://<bridge-ip>:9980</code>, e.g. <code>http://172.17.0.2:9980</code> after <code>docker network connect bridge nextcloud-node-red</code>. Never HTTPS against the internal bridge.</li>
|
||||
<li><strong>Collabora CODE</strong> (<code>collaboraUrl</code>) — conversion engine (<code>/cool/...</code>). Internal CODE runs <strong>HTTPS</strong> (self-signed, <code>ssl.enable=true</code>): <code>https://code:9980</code> (shared Docker network) or fallback <code>https://<bridge-ip>:9980</code>, e.g. <code>https://172.17.0.2:9980</code>, after <code>docker network connect bridge nextcloud-node-red</code>. Plain HTTP (<code>http://code:9980</code>) fails — CODE refuses it when SSL is enabled.</li>
|
||||
</ul>
|
||||
|
||||
<p><strong>Auth:</strong> username + <em>app password</em>. Not your normal account password.</p>
|
||||
<p><code>collaboraPublicUrl</code> — what the browser sees for WOPI/editor links, e.g. <code>https://docs.domain.name</code> (CODE proxied via Nextcloud/reverse proxy). Internal HTTP URLs won't work in an iframe.</p>
|
||||
<p><code>verifyTls</code> — only relevant if you point <code>collaboraUrl</code> at an HTTPS endpoint; the default internal HTTP needs no TLS at all.</p>
|
||||
<p><code>verifyTls</code> — must stay <strong>unchecked (false)</strong>: internal CODE uses a self-signed cert, so TLS verification would fail. Only enable it if <code>collaboraUrl</code> points at an endpoint with a trusted certificate.</p>
|
||||
<p>Default output folder in bridge if you omit a destination: <code>/Dokument/OfficeOut/</code></p>
|
||||
</script>
|
||||
|
||||
@@ -409,16 +409,17 @@ recreate_nodered_service() {
|
||||
log "ExtraHosts (${extra}): $(docker inspect -f '{{json .HostConfig.ExtraHosts}}' "${NODERED_CONTAINER}")"
|
||||
}
|
||||
|
||||
# COLLABORA_URL: intern CODE är HTTP — http://code:9980 primärt,
|
||||
# fallback http://<CODE-IP>:9980.
|
||||
# Aldrig http://127.0.0.1:9980 eller http://host.docker.internal:9980.
|
||||
# COLLABORA_URL: intern CODE kör HTTPS (ssl.enable=true, self-signed) —
|
||||
# https://code:9980 primärt, fallback https://<CODE-IP>:9980.
|
||||
# http://code:9980 failar när CODE har SSL påslaget.
|
||||
# Aldrig 127.0.0.1/host.docker.internal — CODE kör inte på Node-RED-värden.
|
||||
resolve_collabora_url() {
|
||||
local url="${COLLABORA_URL:-http://code:9980}"
|
||||
local url="${COLLABORA_URL:-https://code:9980}"
|
||||
case "${url}" in
|
||||
http://127.0.0.1:*|http://localhost:*|http://host.docker.internal:*|\
|
||||
https://127.0.0.1:*|https://localhost:*|https://host.docker.internal:*)
|
||||
warn "Otillåten COLLABORA_URL '${url}' — tvingar http://code:9980"
|
||||
url="http://code:9980"
|
||||
http://*|http://127.0.0.1:*|http://localhost:*|http://host.docker.internal:*|\
|
||||
https://127.0.0.1:*|https://localhost:*|https://host.docker.internal:*|"")
|
||||
warn "Otillåten COLLABORA_URL '${url}' — tvingar https://code:9980"
|
||||
url="https://code:9980"
|
||||
;;
|
||||
esac
|
||||
|
||||
@@ -428,8 +429,8 @@ resolve_collabora_url() {
|
||||
ip="$(docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$v.IPAddress}} {{end}}' "${CODE_CONTAINER}" 2>/dev/null | awk '{print $1}')"
|
||||
[ -n "${ip}" ] || ip="${COLLABORA_IP:-}"
|
||||
if [ -n "${ip}" ]; then
|
||||
warn "'code' inte resolvbart från ${NODERED_CONTAINER} — fallback http://${ip}:9980"
|
||||
url="http://${ip}:9980"
|
||||
warn "'code' inte resolvbart från ${NODERED_CONTAINER} — fallback https://${ip}:9980"
|
||||
url="https://${ip}:9980"
|
||||
else
|
||||
die "Varken 'code'-DNS eller CODE-IP tillgänglig — kan inte sätta COLLABORA_URL"
|
||||
fi
|
||||
@@ -439,6 +440,22 @@ resolve_collabora_url() {
|
||||
log "COLLABORA_URL=${COLLABORA_URL}"
|
||||
}
|
||||
|
||||
# Node-RED-containern på default bridge — krävs för att nå https://code:9980.
|
||||
# Körs EFTER container-up: recreate nollställer manuella network connect.
|
||||
# Ignorerar "already connected".
|
||||
connect_nodered_bridge() {
|
||||
log "Connecting ${NODERED_CONTAINER} → bridge"
|
||||
local out rc=0
|
||||
out="$(docker network connect bridge "${NODERED_CONTAINER}" 2>&1)" || rc=$?
|
||||
if [ "${rc}" -eq 0 ]; then
|
||||
log "Connected: ${NODERED_CONTAINER} on bridge"
|
||||
elif printf '%s' "${out}" | grep -qi 'already exists\|already connected'; then
|
||||
log "Already connected: ${NODERED_CONTAINER} on bridge"
|
||||
else
|
||||
warn "docker network connect bridge ${NODERED_CONTAINER} misslyckades: ${out}"
|
||||
fi
|
||||
}
|
||||
|
||||
rebuild_nodered() {
|
||||
log "Rebuilding ${NODERED_CONTAINER} (same instance, port ${NODERED_PORT})..."
|
||||
fix_nodered_build_permissions
|
||||
@@ -477,11 +494,16 @@ verify_code_from_nodered() {
|
||||
fi
|
||||
done
|
||||
|
||||
if docker exec "${NODERED_CONTAINER}" curl -sfk "${COLLABORA_URL}/hosting/capabilities" >/dev/null 2>&1; then
|
||||
log "OK: CODE nås från Node-RED: ${COLLABORA_URL}/hosting/capabilities"
|
||||
# Verifiera enligt serverns verklighet: CODE kör HTTPS internt,
|
||||
# https://code:9980 ska ge HTTP 200 från Node-RED på bridge.
|
||||
local code_status
|
||||
code_status="$(docker exec "${NODERED_CONTAINER}" \
|
||||
curl -sk -o /dev/null -w '%{http_code}' https://code:9980/hosting/capabilities 2>/dev/null || echo 000)"
|
||||
if [ "${code_status}" = "200" ]; then
|
||||
log "OK: CODE nås från Node-RED: https://code:9980/hosting/capabilities (HTTP 200)"
|
||||
else
|
||||
warn "CODE inte nåbar: ${COLLABORA_URL}/hosting/capabilities"
|
||||
warn "Kör: docker network connect \$(docker inspect -f '{{range \$k,\$_ := .NetworkSettings.Networks}}{{printf \"%s\\n\" \$k}}{{end}}' ${NODERED_CONTAINER} | head -n1) ${CODE_CONTAINER}"
|
||||
warn "CODE inte nåbar: https://code:9980/hosting/capabilities (HTTP ${code_status})"
|
||||
warn "Kör: docker network connect bridge ${NODERED_CONTAINER} — http://code:9980 failar, CODE kräver HTTPS"
|
||||
fail=1
|
||||
fi
|
||||
|
||||
@@ -507,6 +529,7 @@ main() {
|
||||
patch_dockerfile
|
||||
patch_entrypoint
|
||||
rebuild_nodered
|
||||
connect_nodered_bridge
|
||||
connect_code_network
|
||||
resolve_collabora_url
|
||||
wait_nodered
|
||||
|
||||
Reference in New Issue
Block a user