Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

make apps availble on deSEC #2422

Open
wants to merge 26 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 15 commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
694e063
make apps availble on deSEC
enoch85 Dec 28, 2022
3461bb4
Rename apps/collabora_docker_desec.sh to addons/deSEC/collabora_docke…
enoch85 Dec 28, 2022
1ef7641
add new function
enoch85 Dec 28, 2022
aa3111a
update menu
enoch85 Dec 28, 2022
0305773
talk
enoch85 Dec 28, 2022
af3c677
add onlyoffice
enoch85 Dec 28, 2022
febe625
Rename onlyoffice_docker._desec.sh to onlyoffice_docker_desec.sh
enoch85 Dec 28, 2022
298dbeb
Create onlyoffice_docker.sh
enoch85 Dec 28, 2022
6955314
Update collabora_docker_desec.sh
enoch85 Dec 28, 2022
9098598
Create talk_desec.sh
enoch85 Dec 28, 2022
fb5331f
Update onlyoffice_docker_desec.sh
enoch85 Dec 28, 2022
c7c73ca
typo
enoch85 Dec 28, 2022
d243cdf
typo
enoch85 Dec 28, 2022
282b6b6
Merge branch 'master' into desec-apps
enoch85 Dec 28, 2022
27c6035
fix comment
enoch85 Dec 28, 2022
0293172
change order
enoch85 Dec 29, 2022
617cb8e
collabora now generates as it should
enoch85 Dec 29, 2022
b72446d
onlyffice same as collabora
enoch85 Dec 29, 2022
1ce5053
stop at first occurance
enoch85 Dec 29, 2022
589f0e3
same changes as collabora and onlyoffice
enoch85 Dec 29, 2022
2669632
Merge branch 'master' into desec-apps
enoch85 Jan 5, 2023
cc92db9
Merge branch 'master' into desec-apps
enoch85 Jan 20, 2023
839d9e0
Merge branch 'master' into desec-apps
enoch85 Feb 6, 2023
22551e6
Merge branch 'master' into desec-apps
enoch85 Mar 17, 2023
1d61047
Merge branch 'master' into desec-apps
enoch85 Apr 2, 2023
3792d1d
Merge branch 'master' into desec-apps
enoch85 Apr 8, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
237 changes: 237 additions & 0 deletions addons/deSEC/collabora_docker_desec.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,237 @@
#!/bin/bash

# T&M Hansson IT AB © - 2022, https://www.hanssonit.se/

true
SCRIPT_NAME="Collabora (Docker)"
SCRIPT_EXPLAINER="This script will install the Collabora Office Server bundled with Docker"
# shellcheck source=lib.sh
source /var/scripts/fetch_lib.sh || source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh)
# To work with https://github.com/nextcloud/richdocuments/pull/2235

# Check for errors + debug code and abort if something isn't right
# 1 = ON
# 0 = OFF
DEBUG=0
debug_mode

# Check if root
root_check

# Check if Collabora is already installed
print_text_in_color "$ICyan" "Checking if Collabora is already installed..."
if ! does_this_docker_exist 'collabora/code'
then
# Ask for installing
install_popup "$SCRIPT_NAME"
else
# Ask for removal or reinstallation
reinstall_remove_menu "$SCRIPT_NAME"
# Removal
remove_collabora_docker
# Remove config.php value set when install was successful
nextcloud_occ config:system:delete allow_local_remote_servers
# Show successful uninstall if applicable
removal_popup "$SCRIPT_NAME"
fi

# Check if OnlyOffice is previously installed
# If yes, then stop and prune the docker container
if does_this_docker_exist 'onlyoffice/documentserver'
then
# Removal
remove_onlyoffice_docker
fi

# Remove all office apps
remove_all_office_apps

# Install certbot (Let's Encrypt)
install_certbot

# Generate certs and auto-configure if successful
export SUBDOMAIN=collabora
if run_script DESEC desec_subdomain
then
SUBDOMAIN="$(grep collabora $SCRIPTS/deSEC/.subdomain | cut -d '=' -f2)"
# Generate DHparams cipher
if [ ! -f "$DHPARAMS_SUB" ]
then
openssl dhparam -out "$DHPARAMS_SUB" 2048
fi
print_text_in_color "$IGreen" "Certs are generated!"
a2ensite "$SUBDOMAIN.conf"
restart_webserver
# Install Collabora App
install_and_enable_app richdocuments
else
last_fail_tls "$SCRIPTS"/apps/collabora.sh
exit 1
fi

# Nextcloud Main Domain
NCDOMAIN=$(nextcloud_occ_no_check config:system:get overwrite.cli.url | sed 's|https://||;s|/||')

# Curl the library another time to get the correct https_conf
# shellcheck source=lib.sh
source /var/scripts/fetch_lib.sh || source <(curl -sL https://raw.githubusercontent.com/nextcloud/vm/master/lib.sh)

# Get all needed variables from the library
nc_update

# Get the latest packages
apt-get update -q4 & spinner_loading

# Check if Nextcloud is installed
print_text_in_color "$ICyan" "Checking if Nextcloud is installed..."
if ! curl -s https://"$NCDOMAIN"/status.php | grep -q 'installed":true'
then
msg_box "It seems like Nextcloud is not installed or that you don't use https on:
$NCDOMAIN.
Please install Nextcloud and make sure your domain is reachable, or activate TLS
on your domain to be able to run this script.

If you use the Nextcloud VM you can use the Let's Encrypt script to get TLS and activate your Nextcloud domain.
When TLS is activated, run these commands from your CLI:
sudo curl -sLO $APP/collabora.sh
sudo bash collabora.sh"
exit 1
fi

# Test RAM size (2GB min) + CPUs (min 2)
ram_check 2 Collabora
cpu_check 2 Collabora

# Check if Nextcloud is installed with TLS
check_nextcloud_https "Collabora (Docker)"

# Install Docker
install_docker

# Install Collabora docker
docker pull collabora/code:latest
docker run -t -d -p 127.0.0.1:9980:9980 -e "aliasgroup1=https://$NCDOMAIN:443" --restart always --name code --cap-add MKNOD collabora/code

# Install Apache2
install_if_not apache2

# Enable Apache2 module's
a2enmod proxy
a2enmod proxy_wstunnel
a2enmod proxy_http
a2enmod ssl
a2enmod headers

# Only add TLS 1.3 on Ubuntu later than 20.04
if version 20.04 "$DISTRO" 22.04.10
then
TLS13="+TLSv1.3"
fi

if [ -f "$HTTPS_CONF" ]
then
a2dissite "$SUBDOMAIN.conf"
rm -f "$HTTPS_CONF"
fi

# Create Vhost for Collabora online in Apache2
if [ ! -f "$HTTPS_CONF" ];
then
cat << HTTPS_CREATE > "$HTTPS_CONF"
<VirtualHost *:443>
ServerName $SUBDOMAIN:443

<Directory /var/www>
Options -Indexes
</Directory>

# TLS configuration, you may want to take the easy route instead and use Lets Encrypt!
SSLCertificateChainFile $CERTFILES/$SUBDOMAIN/chain.pem
SSLCertificateFile $CERTFILES/$SUBDOMAIN/cert.pem
SSLCertificateKeyFile $CERTFILES/$SUBDOMAIN/privkey.pem
SSLOpenSSLConfCmd DHParameters $DHPARAMS_SUB

# Intermediate configuration
SSLEngine on
SSLCompression off
SSLProtocol -all +TLSv1.2 $TLS13
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder off
SSLSessionTickets off
ServerSignature off

# Logs
LogLevel warn
CustomLog \${APACHE_LOG_DIR}/access.log combined
ErrorLog \${APACHE_LOG_DIR}/error.log

# Encoded slashes need to be allowed
AllowEncodedSlashes NoDecode

# Container uses a unique non-signed certificate
SSLProxyEngine On
SSLProxyVerify None
SSLProxyCheckPeerCN Off
SSLProxyCheckPeerName Off

# Improve security settings
Header set X-XSS-Protection "1; mode=block"
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header set X-Content-Type-Options nosniff
Header set Content-Security-Policy "frame-ancestors 'self' $NCDOMAIN"

# keep the host
ProxyPreserveHost On

# static html, js, images, etc. served from coolwsd
# browser is the client part of LibreOffice Online
ProxyPass /browser https://127.0.0.1:9980/browser retry=0
ProxyPassReverse /browser https://127.0.0.1:9980/browser

# WOPI discovery URL
ProxyPass /hosting/discovery https://127.0.0.1:9980/hosting/discovery retry=0
ProxyPassReverse /hosting/discovery https://127.0.0.1:9980/hosting/discovery

# Endpoint with information about availability of various features
ProxyPass /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities retry=0
ProxyPassReverse /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities

# Main websocket
ProxyPassMatch "/cool/(.*)/ws$" wss://127.0.0.1:9980/cool/\$1/ws nocanon

# Admin Console websocket
ProxyPass /cool/adminws wss://127.0.0.1:9980/cool/adminws

# Download as, Fullscreen presentation and Image upload operations
ProxyPass /cool https://127.0.0.1:9980/cool
ProxyPassReverse /cool https://127.0.0.1:9980/cool
</VirtualHost>
HTTPS_CREATE

if [ -f "$HTTPS_CONF" ];
then
print_text_in_color "$IGreen" "$HTTPS_CONF was successfully created."
sleep 1
else
print_text_in_color "$IRed" "Unable to create vhost, exiting..."
print_text_in_color "$IRed" "Please report this issue here $ISSUES"
exit 1
fi
fi

# Set config for RichDocuments (Collabora App)
if is_app_installed richdocuments
then
nextcloud_occ config:app:set richdocuments wopi_url --value=https://"$SUBDOMAIN"
chown -R www-data:www-data "$NC_APPS_PATH"
# Appending the new domain to trusted domains
add_to_trusted_domains "$SUBDOMAIN"
# Allow remote servers with local addresses e.g. in federated shares, webcal services and more
nextcloud_occ config:system:set allow_local_remote_servers --value="true"
# Add prune command
add_dockerprune
print_text_in_color "$ICyan" "Restarting Docker..."
docker restart code
msg_box "Collabora Docker is now successfully installed.
Please be aware that the container is currently starting which can take a few minutes."
fi
Loading