mirror of
https://github.com/funkypenguin/geek-cookbook/
synced 2026-11-05 14:58:18 +00:00
Add phpIPAM
This commit is contained in:
David Young committed
1 parent
b8aeb3dfd9
commit
2309e51bd1
10 files changed
+500
-111
No files matched your search
@@ -0,0 +1,245 @@
|
||||
# Collabora Online
|
||||
|
||||
!!! important
|
||||
Development of this recipe is sponsored by [The Common Observatory](https://www.observe.global/). Thanks guys!
|
||||
|
||||
[](https://www.observe.global/)
|
||||
|
||||
Collabora Online Development Edition (or "[CODE](https://www.collaboraoffice.com/code/#what_is_code)"), is the lightweight, or "home" edition of the commercially-supported [Collabora Online](https://www.collaboraoffice.com/collabora-online/) platform. It
|
||||
|
||||
It's basically the [LibreOffice](https://www.libreoffice.org/) interface in a web-browser. CODE is not a standalone app, it's a backend intended to be accessed via "WOPI" from an existing interface (_in our case, [NextCloud](/recipes/nextcloud/)_)
|
||||
|
||||
|
||||
|
||||
## Ingredients
|
||||
|
||||
1. [Docker swarm cluster](/ha-docker-swarm/design/) with [persistent shared storage](/ha-docker-swarm/shared-storage-ceph.md)
|
||||
2. [Traefik](/ha-docker-swarm/traefik_public) configured per design
|
||||
3. DNS entry for the hostname (_i.e. "collabora.your-domain.com"_) you intend to use for LDAP Account Manager, pointed to your [keepalived](ha-docker-swarm/keepalived/) IP
|
||||
4. [NextCloud](/recipes/nextcloud/) installed and operational
|
||||
5. [Docker-compose](https://docs.docker.com/compose/install/) installed on your node(s) - this is a special case which needs to run outside of Docker Swarm
|
||||
|
||||
## Preparation
|
||||
|
||||
### Explanation for complexity
|
||||
|
||||
Due to the clever magic that Collabora does to present a "headless" LibreOffice UI to the browser, the CODE docker container requires system capabilities which cannot be granted under Docker Swarm (_specifically, MKNOD_).
|
||||
|
||||
So we have to run Collabora itself in the next best thing to Docker swarm - a docker-compose stack. Using docker-compose will at least provide us with consistent and version-able configuration files.
|
||||
|
||||
This presents another problem though - Docker Swarm with Traefik is superb at making all our stacks "just work" with ingress routing and LetsEncyrpt certificates. We don't want to have to do this manually (_like a cave-man_), so we engage in some trickery to allow us to still use our swarmed Traefik to terminate SSL.
|
||||
|
||||
We run a single swarmed Nginx instance, which forwards all requests to an upstream, with the target IP of the docker0 interface, on port 9980 (the port exposed by the CODE container_)
|
||||
|
||||
We attach the necessary labels to the Nginx container to instruct Trafeik to setup a front/backend for collabora.<ourdomain\>. Now incoming requests to https://collabora.<ourdomain\> will hit Traefik, be forwarded to nginx (wherever in the swarm it's running), and then to port 9980 on the same node that nginx is running on.
|
||||
|
||||
What if we're running multiple nodes in our swarm, and nginx ends up on a different node to the one running Collabora via docker-compose? Well, either constrain nginx to the same node as Collabora, or just launch an instance of Collabora on _every_ node then. It's just a rendering / GUI engine after all, it doesn't hold any persistent data.
|
||||
|
||||
Here's a diagram to illustrate:
|
||||
|
||||
|
||||
|
||||
### Setup data locations
|
||||
|
||||
We'll need a directory for holding config to bind-mount into our containers, so create ```/var/data/collabora```, and ```/var/data/config/collabora``` for holding the docker/swarm config
|
||||
|
||||
```
|
||||
mkdir /var/data/collabora/
|
||||
mkdir /var/data/config/collabora/
|
||||
```
|
||||
|
||||
### Prepare environment
|
||||
|
||||
Create /var/data/config/collabora/collabora.env, and populate with the following variables, customized for your installation.
|
||||
|
||||
!!! warning
|
||||
Note the following:
|
||||
|
||||
1. Variables are in lower-case, unlike our standard convention. This is to align with the CODE container
|
||||
2. Set domain to your [NextCloud](/recipes/nextcloud/) domain, and escape all the periods as per the example
|
||||
3. Set your server_name to collabora.<yourdomain\>. Escaping periods is unnecessary
|
||||
4. Your password cannot include triangular brackets - the entrypoint script will insert this password into an XML document, and triangular brackets will make bad(tm) things happen 🔥
|
||||
|
||||
```
|
||||
username=admin
|
||||
password=ilovemypassword
|
||||
domain=nextcloud\.batcave\.com
|
||||
server_name=collabora.batcave.com
|
||||
termination=true
|
||||
```
|
||||
|
||||
### Create docker-compose.yml
|
||||
|
||||
Create ```/var/data/config/collabora/docker-compose.yml``` as follows:
|
||||
|
||||
```
|
||||
version: "3.0"
|
||||
|
||||
services:
|
||||
local-collabora:
|
||||
image: funkypenguin/collabora
|
||||
# the funkypenguin version has a patch to include "termination" behind SSL-terminating reverse proxy (traefik), see CODE PR #50.
|
||||
# Once merged, the official container can be used again.
|
||||
#image: collabora/code
|
||||
env_file: /var/data/config/collabora/collabora.env
|
||||
volumes:
|
||||
- /var/data/collabora/loolwsd.xml:/etc/loolwsd/loolwsd.xml
|
||||
cap_add:
|
||||
- MKNOD
|
||||
ports:
|
||||
- 9980:9980
|
||||
```
|
||||
|
||||
### Create nginx.conf
|
||||
|
||||
Create ```/var/data/config/collabora/nginx.conf``` as follows, changing the ```server_name``` value to match the environment variable you established above.
|
||||
|
||||
```
|
||||
upstream collabora-upstream {
|
||||
# Run collabora under docker-compose, since it needs MKNOD cap, which can't be provided by Docker Swarm.
|
||||
# The IP here is the typical IP of docker0 - change if yours is different.
|
||||
server 172.17.0.1:9980;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name collabora.batcave.com;
|
||||
|
||||
# static files
|
||||
location ^~ /loleaflet {
|
||||
proxy_pass http://collabora-upstream;
|
||||
proxy_set_header Host $http_host;
|
||||
}
|
||||
|
||||
# WOPI discovery URL
|
||||
location ^~ /hosting/discovery {
|
||||
proxy_pass http://collabora-upstream;
|
||||
proxy_set_header Host $http_host;
|
||||
}
|
||||
|
||||
# Main websocket
|
||||
location ~ /lool/(.*)/ws$ {
|
||||
proxy_pass http://collabora-upstream;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "Upgrade";
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_read_timeout 36000s;
|
||||
}
|
||||
|
||||
# Admin Console websocket
|
||||
location ^~ /lool/adminws {
|
||||
proxy_buffering off;
|
||||
proxy_pass http://collabora-upstream;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "Upgrade";
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_read_timeout 36000s;
|
||||
}
|
||||
|
||||
# download, presentation and image upload
|
||||
location ~ /lool {
|
||||
proxy_pass https://collabora-upstream;
|
||||
proxy_set_header Host $http_host;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
# FIXME
|
||||
|
||||
```
|
||||
wsd-00030-00031 2018-12-15 07:52:49.973053 [ prisoner_poll ] INF Have 1 spare child after adding [36].| wsd/LOOLWSD.cpp:431
|
||||
wsd-00030-00030 2018-12-15 07:52:49.978874 [ loolwsd ] TRC Have 1 new children.| wsd/LOOLWSD.cpp:2987
|
||||
wsd-00030-00030 2018-12-15 07:52:49.978940 [ loolwsd ] INF WSD initialization complete: setting log-level to [warning] as configured.| wsd/LOOLWSD.cpp:2994
|
||||
wsd-00030-00051 2018-12-15 07:55:06.385786 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.20.0.1| wsd/LOOLWSD.cpp:1851
|
||||
```
|
||||
|
||||
### Setup Docker Swarm
|
||||
|
||||
Create ```/var/data/config/collabora/collabora.yml``` as follows, changing the traefik frontend_rule as necessary:
|
||||
|
||||
!!! tip
|
||||
I share (_with my [patreon patrons](https://www.patreon.com/funkypenguin)_) a private "_premix_" git repository, which includes necessary docker-compose and env files for all published recipes. This means that patrons can launch any recipe with just a ```git pull``` and a ```docker stack deploy``` 👍
|
||||
|
||||
```
|
||||
version: "3.0"
|
||||
|
||||
services:
|
||||
|
||||
nginx:
|
||||
image: nginx:latest
|
||||
networks:
|
||||
- traefik_public
|
||||
deploy:
|
||||
labels:
|
||||
- traefik.frontend.rule=Host:collabora.observe.global
|
||||
- traefik.docker.network=traefik_public
|
||||
- traefik.port=80
|
||||
- traefik.frontend.passHostHeader=true
|
||||
# uncomment this line if you want to force nginx to always run on one node (i.e., the one running collabora)
|
||||
#placement:
|
||||
# constraints:
|
||||
# - node.hostname == ds1
|
||||
volumes:
|
||||
- /var/data/collabora/nginx.conf:/etc/nginx/conf.d/default.conf:ro
|
||||
|
||||
networks:
|
||||
traefik_public:
|
||||
external: true
|
||||
```
|
||||
|
||||
### Obtain loolwsd.xml
|
||||
|
||||
Where do we find this? Do we still need it given we patched it?
|
||||
|
||||
## Serving
|
||||
|
||||
### Launch Collabora
|
||||
|
||||
Launching Collabora is a 2-step process. First we launch collabora itself, by running:
|
||||
|
||||
```
|
||||
cd /var/data/config/collabora/
|
||||
docker-compose -d up
|
||||
```
|
||||
|
||||
Output looks something like this:
|
||||
|
||||
```
|
||||
root@ds1:/var/data/config/collabora# docker-compose up -d
|
||||
WARNING: The Docker Engine you're using is running in swarm mode.
|
||||
|
||||
Compose does not use swarm mode to deploy services to multiple nodes in a swarm. All containers will be scheduled on the current node.
|
||||
|
||||
To deploy your application across the swarm, use `docker stack deploy`.
|
||||
|
||||
Pulling local-collabora (funkypenguin/collabora:latest)...
|
||||
latest: Pulling from funkypenguin/collabora
|
||||
7b8b6451c85f: Pull complete
|
||||
ab4d1096d9ba: Pull complete
|
||||
e6797d1788ac: Pull complete
|
||||
e25c5c290bde: Pull complete
|
||||
4b8e1b074e06: Pull complete
|
||||
f51a3d1fb75e: Pull complete
|
||||
8b826e2ae5ad: Pull complete
|
||||
Digest: sha256:6cd38cb5cbd170da0e3f0af85cecf07a6bc366e44555c236f81d5b433421a39d
|
||||
Status: Downloaded newer image for funkypenguin/collabora:latest
|
||||
Creating collabora_local-collabora_1 ...
|
||||
Creating collabora_local-collabora_1 ... done
|
||||
root@ds1:/var/data/config/collabora#
|
||||
```
|
||||
|
||||
Once collabora is up, we launch the swarm stack, by running:
|
||||
|
||||
```
|
||||
docker stack deploy collabora -c /var/data/config/collabora/collabora.yml
|
||||
```
|
||||
|
||||
Visit https://collabora.<yourdomain\> and confirm you can login with the user/password you specified in collabora.env
|
||||
|
||||
### Integrate into NextCloud
|
||||
|
||||
Create the auth_internal overlay network, by running ```docker stack deploy auth -c /var/data/config/openldap/auth.yml`, then launch the OpenLDAP stack by running ```docker stack deploy openldap -c /var/data/config/openldap/openldap.yml```
|
||||
|
||||
|
||||
|
||||
PR is https://github.com/CollaboraOnline/Docker-CODE/pull/50
|
||||
Reference in new issue
Block a user