# Collabora Online !!! important Development of this recipe is sponsored by [The Common Observatory](https://www.observe.global/). Thanks guys! [![Common Observatory](../images/common_observatory.png)](https://www.observe.global/) Collabora Online Development Edition (or "[CODE](https://www.collaboraoffice.com/code/#what_is_code)"), is the lightweight, or "home" edition of the commercially-supported [Collabora Online](https://www.collaboraoffice.com/collabora-online/) platform. It It's basically the [LibreOffice](https://www.libreoffice.org/) interface in a web-browser. CODE is not a standalone app, it's a backend intended to be accessed via "WOPI" from an existing interface (_in our case, [NextCloud](/recipes/nextcloud/)_) ![CODE Screenshot](../images/collabora-online-development-environment.png) ## Ingredients 1. [Docker swarm cluster](/ha-docker-swarm/design/) with [persistent shared storage](/ha-docker-swarm/shared-storage-ceph.md) 2. [Traefik](/ha-docker-swarm/traefik_public) configured per design 3. DNS entry for the hostname (_i.e. "collabora.your-domain.com"_) you intend to use for LDAP Account Manager, pointed to your [keepalived](ha-docker-swarm/keepalived/) IP 4. [NextCloud](/recipes/nextcloud/) installed and operational 5. [Docker-compose](https://docs.docker.com/compose/install/) installed on your node(s) - this is a special case which needs to run outside of Docker Swarm ## Preparation ### Explanation for complexity Due to the clever magic that Collabora does to present a "headless" LibreOffice UI to the browser, the CODE docker container requires system capabilities which cannot be granted under Docker Swarm (_specifically, MKNOD_). So we have to run Collabora itself in the next best thing to Docker swarm - a docker-compose stack. Using docker-compose will at least provide us with consistent and version-able configuration files. This presents another problem though - Docker Swarm with Traefik is superb at making all our stacks "just work" with ingress routing and LetsEncyrpt certificates. We don't want to have to do this manually (_like a cave-man_), so we engage in some trickery to allow us to still use our swarmed Traefik to terminate SSL. We run a single swarmed Nginx instance, which forwards all requests to an upstream, with the target IP of the docker0 interface, on port 9980 (the port exposed by the CODE container_) We attach the necessary labels to the Nginx container to instruct Trafeik to setup a front/backend for collabora.. Now incoming requests to https://collabora. will hit Traefik, be forwarded to nginx (wherever in the swarm it's running), and then to port 9980 on the same node that nginx is running on. What if we're running multiple nodes in our swarm, and nginx ends up on a different node to the one running Collabora via docker-compose? Well, either constrain nginx to the same node as Collabora, or just launch an instance of Collabora on _every_ node then. It's just a rendering / GUI engine after all, it doesn't hold any persistent data. Here's a diagram to illustrate: ![CODE traffic flow](../images/collabora-traffic-flow.png) ### Setup data locations We'll need a directory for holding config to bind-mount into our containers, so create ```/var/data/collabora```, and ```/var/data/config/collabora``` for holding the docker/swarm config ``` mkdir /var/data/collabora/ mkdir /var/data/config/collabora/ ``` ### Prepare environment Create /var/data/config/collabora/collabora.env, and populate with the following variables, customized for your installation. !!! warning Note the following: 1. Variables are in lower-case, unlike our standard convention. This is to align with the CODE container 2. Set domain to your [NextCloud](/recipes/nextcloud/) domain, and escape all the periods as per the example 3. Set your server_name to collabora.. Escaping periods is unnecessary 4. Your password cannot include triangular brackets - the entrypoint script will insert this password into an XML document, and triangular brackets will make bad(tm) things happen 🔥 ``` username=admin password=ilovemypassword domain=nextcloud\.batcave\.com server_name=collabora.batcave.com termination=true ``` ### Create docker-compose.yml Create ```/var/data/config/collabora/docker-compose.yml``` as follows: ``` version: "3.0" services: local-collabora: image: funkypenguin/collabora # the funkypenguin version has a patch to include "termination" behind SSL-terminating reverse proxy (traefik), see CODE PR #50. # Once merged, the official container can be used again. #image: collabora/code env_file: /var/data/config/collabora/collabora.env volumes: - /var/data/collabora/loolwsd.xml:/etc/loolwsd/loolwsd.xml cap_add: - MKNOD ports: - 9980:9980 ``` ### Create nginx.conf Create ```/var/data/config/collabora/nginx.conf``` as follows, changing the ```server_name``` value to match the environment variable you established above. ``` upstream collabora-upstream { # Run collabora under docker-compose, since it needs MKNOD cap, which can't be provided by Docker Swarm. # The IP here is the typical IP of docker0 - change if yours is different. server 172.17.0.1:9980; } server { listen 80; server_name collabora.batcave.com; # static files location ^~ /loleaflet { proxy_pass http://collabora-upstream; proxy_set_header Host $http_host; } # WOPI discovery URL location ^~ /hosting/discovery { proxy_pass http://collabora-upstream; proxy_set_header Host $http_host; } # Main websocket location ~ /lool/(.*)/ws$ { proxy_pass http://collabora-upstream; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; proxy_set_header Host $http_host; proxy_read_timeout 36000s; } # Admin Console websocket location ^~ /lool/adminws { proxy_buffering off; proxy_pass http://collabora-upstream; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; proxy_set_header Host $http_host; proxy_read_timeout 36000s; } # download, presentation and image upload location ~ /lool { proxy_pass https://collabora-upstream; proxy_set_header Host $http_host; } } ``` # FIXME ``` wsd-00030-00031 2018-12-15 07:52:49.973053 [ prisoner_poll ] INF Have 1 spare child after adding [36].| wsd/LOOLWSD.cpp:431 wsd-00030-00030 2018-12-15 07:52:49.978874 [ loolwsd ] TRC Have 1 new children.| wsd/LOOLWSD.cpp:2987 wsd-00030-00030 2018-12-15 07:52:49.978940 [ loolwsd ] INF WSD initialization complete: setting log-level to [warning] as configured.| wsd/LOOLWSD.cpp:2994 wsd-00030-00051 2018-12-15 07:55:06.385786 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.20.0.1| wsd/LOOLWSD.cpp:1851 ``` ### Setup Docker Swarm Create ```/var/data/config/collabora/collabora.yml``` as follows, changing the traefik frontend_rule as necessary: !!! tip I share (_with my [patreon patrons](https://www.patreon.com/funkypenguin)_) a private "_premix_" git repository, which includes necessary docker-compose and env files for all published recipes. This means that patrons can launch any recipe with just a ```git pull``` and a ```docker stack deploy``` 👍 ``` version: "3.0" services: nginx: image: nginx:latest networks: - traefik_public deploy: labels: - traefik.frontend.rule=Host:collabora.observe.global - traefik.docker.network=traefik_public - traefik.port=80 - traefik.frontend.passHostHeader=true # uncomment this line if you want to force nginx to always run on one node (i.e., the one running collabora) #placement: # constraints: # - node.hostname == ds1 volumes: - /var/data/collabora/nginx.conf:/etc/nginx/conf.d/default.conf:ro networks: traefik_public: external: true ``` ### Obtain loolwsd.xml Where do we find this? Do we still need it given we patched it? ## Serving ### Launch Collabora Launching Collabora is a 2-step process. First we launch collabora itself, by running: ``` cd /var/data/config/collabora/ docker-compose -d up ``` Output looks something like this: ``` root@ds1:/var/data/config/collabora# docker-compose up -d WARNING: The Docker Engine you're using is running in swarm mode. Compose does not use swarm mode to deploy services to multiple nodes in a swarm. All containers will be scheduled on the current node. To deploy your application across the swarm, use `docker stack deploy`. Pulling local-collabora (funkypenguin/collabora:latest)... latest: Pulling from funkypenguin/collabora 7b8b6451c85f: Pull complete ab4d1096d9ba: Pull complete e6797d1788ac: Pull complete e25c5c290bde: Pull complete 4b8e1b074e06: Pull complete f51a3d1fb75e: Pull complete 8b826e2ae5ad: Pull complete Digest: sha256:6cd38cb5cbd170da0e3f0af85cecf07a6bc366e44555c236f81d5b433421a39d Status: Downloaded newer image for funkypenguin/collabora:latest Creating collabora_local-collabora_1 ... Creating collabora_local-collabora_1 ... done root@ds1:/var/data/config/collabora# ``` Once collabora is up, we launch the swarm stack, by running: ``` docker stack deploy collabora -c /var/data/config/collabora/collabora.yml ``` Visit https://collabora. and confirm you can login with the user/password you specified in collabora.env ### Integrate into NextCloud Create the auth_internal overlay network, by running ```docker stack deploy auth -c /var/data/config/openldap/auth.yml`, then launch the OpenLDAP stack by running ```docker stack deploy openldap -c /var/data/config/openldap/openldap.yml``` PR is https://github.com/CollaboraOnline/Docker-CODE/pull/50