Docker-compose: (note I had to add sys_admin because on the latest version documents won’t load without it, not sure why)
configs:
Caddyfile:
content: |
{
tailscale {
state_dir /tailscale
}
}
https://nextcloud.wallaby-gopher.ts.net {
bind tailscale/nextcloud
reverse_proxy host.docker.internal:11000
}
https://collabora.wallaby-gopher.ts.net {
bind tailscale/collabora
reverse_proxy collabora:9980
}
volumes:
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer # This line is not allowed to be changed
#caddy/tailscale configs
caddy:
tailscale:
services:
caddy:
build:
dockerfile_inline: |
FROM caddy:2-builder AS builder
RUN xcaddy build latest \
--with github.com/tailscale/caddy-tailscale
FROM caddy:2
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
hostname: caddy
container_name: "caddy"
extra_hosts:
- "host.docker.internal:host-gateway"
ports:
- "80:80"
- "443:443"
- "443:443/udp"
volumes:
- caddy:/data
- tailscale:/tailscale
configs:
- source: Caddyfile
target: /etc/caddy/Caddyfile
restart: unless-stopped
#nextcloud
nextcloud:
image: nextcloud/all-in-one
restart: always
container_name: nextcloud-aio-mastercontainer # This line is not allowed to be changed as otherwise AIO will not work correctly
volumes:
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config # This line is not allowed to be changed as otherwise the built-in backup solution will not work
- /var/run/docker.sock:/var/run/docker.sock:ro # May be changed on macOS, Windows or docker rootless. See the applicable documentation. If adjusting, don't forget to also set 'WATCHTOWER_DOCKER_SOCKET_PATH'!
ports:
- 8080:8080
environment: # Is needed when using any of the options below
# - AIO_DISABLE_BACKUP_SECTION=false # Setting this to true allows to hide the backup section in the AIO interface. See https://github.com/nextcloud/all-in-one#how-to-disable-the-backup-section
#- SKIP_DOMAIN_VALIDATION=true #might not be helping?
- APACHE_PORT=11000 # Is needed when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
- APACHE_IP_BINDING=0.0.0.0 # Should be set when running behind a web server or reverse proxy (like Apache, Nginx, Cloudflare Tunnel and else) that is running on the same host. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
# - BORG_RETENTION_POLICY=--keep-within=7d --keep-weekly=4 --keep-monthly=6 # Allows to adjust borgs retention policy. See https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy
# - COLLABORA_SECCOMP_DISABLED=false # Setting this to true allows to disable Collabora's Seccomp feature. See https://github.com/nextcloud/all-in-one#how-to-disable-collaboras-seccomp-feature
# - NEXTCLOUD_MOUNT=/mnt/ # Allows the Nextcloud container to access the chosen directory on the host. See https://github.com/nextcloud/all-in-one#how-to-allow-the-nextcloud-container-to-access-directories-on-the-host
- NEXTCLOUD_UPLOAD_LIMIT=1G # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-upload-limit-for-nextcloud
- NEXTCLOUD_MAX_TIME=3600 # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-max-execution-time-for-nextcloud
- NEXTCLOUD_MEMORY_LIMIT=1024M # Can be adjusted if you need more. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-php-memory-limit-for-nextcloud
# - NEXTCLOUD_TRUSTED_CACERTS_DIR=/path/to/my/cacerts # CA certificates in this directory will be trusted by the OS of the nexcloud container (Useful e.g. for LDAPS) See See https://github.com/nextcloud/all-in-one#how-to-trust-user-defined-certification-authorities-ca
# - NEXTCLOUD_ADDITIONAL_APKS=imagemagick # This allows to add additional packages to the Nextcloud container permanently. Default is imagemagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-os-packages-permanently-to-the-nextcloud-container
# - NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS=imagick # This allows to add additional php extensions to the Nextcloud container permanently. Default is imagick but can be overwritten by modifying this value. See https://github.com/nextcloud/all-in-one#how-to-add-php-extensions-permanently-to-the-nextcloud-container
# - NEXTCLOUD_ENABLE_DRI_DEVICE=true # This allows to enable the /dev/dri device in the Nextcloud container. ⚠️⚠️⚠️ Warning: this only works if the '/dev/dri' device is present on the host! If it should not exist on your host, don't set this to true as otherwise the Nextcloud container will fail to start! See https://github.com/nextcloud/all-in-one#how-to-enable-hardware-transcoding-for-nextcloud
- TALK_PORT=3478 # This allows to adjust the port that the talk container is using. See https://github.com/nextcloud/all-in-one#how-to-adjust-the-talk-port
# - WATCHTOWER_DOCKER_SOCKET_PATH=/var/run/docker.sock # Needs to be specified if the docker socket on the host is not located in the default '/var/run/docker.sock'. Otherwise mastercontainer updates will fail. For macos it needs to be '/var/run/docker.sock'
depends_on:
- caddy
#for nextcloud office to work
collabora:
image: collabora/code
container_name: collaborac
restart: unless-stopped
ports:
- 9980:9980
environment: #--o:security.capabilities=false did not help with phone backspace either
- username=admin
- password=Secret.Password
- extra_params=--o:ssl.enable=false --o:ssl.termination=true
#- dictionaries=en
cap_add: #- SYS_ADMIN sometimes needed due to permission issue, - CHOWN no difference?
- MKNOD
- SYS_ADMIN
#tty: true
depends_on:
- nextcloud
The issue you are facing:
Hello, my Collabora server had been running just fine, (wwe had helped me get it running over on the nextcloud forum New AiO installation behind caddy and tailscale, Collabora not connecting? - #11 by rinkfaraway - 📦 Appliances (Docker, Snappy, VM, NCP, AIO) - Nextcloud community) but I went to edit a document in the nextcloud app for the first time and noticed something strange. Backspace doesn’t work on previously saved text. It’ll backspace one character and stop, continual tapping or holding backspace does nothing. If I tap on the screen where I am editing text the process can repeat, with one more character backspace. If I enter new text on the app, it backspaces just fine. It’s not a nextcloud issue because Collabora office does it as well. Nextcloud notes does not have this issue, I’m not sure if that uses Collabora though. A browser works fine with my phone, but I don’t like the layout so I’d prefer it if the app could function.
Collabora logs:
wsd-00001-00022 2024-09-26 01:58:35.176887 +0000 [ coolwsd ] WRN Waking up dead poll thread [main], started: false, finished: false| net/Socket.hpp:724
wsd-00001-00001 2024-09-26 01:58:35.176963 +0000 [ coolwsd ] WRN Waking up dead poll thread [main], started: false, finished: false| net/Socket.hpp:724
wsd-00001-00032 2024-09-26 02:01:23.126158 +0000 [ websrv_poll ] ERR #31: Error while handling poll at 0 in websrv_poll: #31 (read): unknown. BIO error: 167772454, rc: 0: error:0A000126:SSL routines::unexpected eof while reading:
C006E0578F730000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:ssl/record/rec_layer_s3.c:322:
| net/Socket.cpp:566
wsd-00001-00032 2024-09-26 02:14:44.858816 +0000 [ websrv_poll ] WRN convert-to: Requesting address is denied: 100.91.72.49| wsd/ClientRequestDispatcher.cpp:493
frk-00024-00024 2024-09-26 02:27:02.668464 +0000 [ forkit ] WRN The systemplate directory [/opt/cool/systemplate] is read-only, and at least [/opt/cool/systemplate//etc/hosts] is out-of-date. Will have to copy sysTemplate to jails. To restore optimal performance, make sure the files in [/opt/cool/systemplate/etc] are up-to-date.| common/JailUtil.cpp:557
kit-00051-00051 2024-09-26 02:27:02.673733 +0000 [ kit_spare_006 ] ERR Failed to stat or chown 65534:65534 /opt/cool/child-roots/1-238138a8//linkable/opt/cool/systemplate/lib64/ld-linux-x86-64.so.2: Invalid argument missing cap_chown?, disabling linkable| kit/Kit.cpp:378
kit-00051-00051 2024-09-26 02:27:02.673885 +0000 [ kit_spare_006 ] ERR link("/opt/cool/systemplate/lib64/ld-linux-x86-64.so.2", "/opt/cool/child-roots/1-238138a8/przIQk94HVBwMJHv/lib64/ld-linux-x86-64.so.2") failed: Invalid argument. Very slow copying path triggered.| kit/Kit.cpp:394
wsd-00001-00032 2024-09-26 02:27:03.557160 +0000 [ websrv_poll ] ERR FileServerRequestHandler: File not found: Invalid URI request (hash): [/browser/61cf2b4/images/dark/lc_zoteroeditbibliography.svg].| wsd/FileServer.cpp:751
wsd-00001-00032 2024-09-26 02:27:03.557247 +0000 [ websrv_poll ] ERR #71: Attempted to remove: 618 which is > size: 0 clamped to 0| net/Socket.hpp:1263
wsd-00001-00032 2024-09-26 02:27:03.812073 +0000 [ websrv_poll ] ERR FileServerRequestHandler: File not found: Invalid URI request (hash): [/browser/61cf2b4/images/lc_zoteroeditbibliography.svg].| wsd/FileServer.cpp:751
wsd-00001-00032 2024-09-26 02:27:03.812114 +0000 [ websrv_poll ] ERR #53: Attempted to remove: 613 which is > size: 0 clamped to 0| net/Socket.hpp:1263
Ensure that your Collabora CODE container is running the latest version. Sometimes, bugs like this get fixed in newer releases. Pull the latest image and restart the container:
docker pull collabora/code
docker-compose down
docker-compose up -d
2. Mobile App Compatibility
Verify if the issue persists across different devices or versions of the Nextcloud mobile app. It could be an app-specific issue that may require updates or bug fixes on the Nextcloud side. If it works on another device, it might be device-specific.
You might want to try using the web version of Nextcloud on your mobile browser as a temporary solution.
3. Caddy Configuration and SSL Handling
Your logs include some SSL-related errors (unexpected eof while reading). This might indicate issues with SSL termination or misconfiguration in your reverse proxy. Make sure your SSL settings in Caddy are configured correctly, and try using a fully-secure SSL setup (i.e., without ssl.termination=true in Collabora) to see if that changes the behavior.
If ssl.termination is set to true, ensure that Caddy is properly terminating SSL and passing through connections securely.
4. Seccomp and Capabilities
You mentioned adding SYS_ADMIN to the container. While this can sometimes help with permissions issues, it’s generally not ideal for security reasons. Consider setting COLLABORA_SECCOMP_DISABLED=true as an environment variable or adjusting other security parameters if you continue to face issues.
Test if removing SYS_ADMIN and ensuring CAP_CHOWN is enabled might fix the problem, as some errors in your logs (missing cap_chown?) hint at permission-related issues.
5. Debugging Logs and More Information
Enable more verbose logging in Collabora to get additional details on what might be happening when backspace fails. You can do this by adding --o:logging.level=debug to extra_params:
I tend to pull when I have issues, but did again, no change in behavior.
I don’t have access to another phone right now, but emulated with waydroid the behavior is the same.
Yes I am currently using the browser. It just feels cramped compared to the app.
Removing --o:ssl.termination=true caused the files to not open on desktop. Strangely, it continued to work on the app, but with the same issues. I did not see any errors in the wall of text.
Haha I wasn’t planning on tackling the sys_admin issue, but thanks for sorting that. Anyway with the compose updated to this:
collabora:
image: collabora/code
container_name: collaborac
restart: unless-stopped
ports:
- 9980:9980
environment: #--o:security.capabilities=false did not help with phone backspace either, --o:ssl.termination=true
- username=admin
- password=Secret.Password
- extra_params=--o:ssl.enable=false --o:ssl.termination=true --o:logging.level=debug
- COLLABORA_SECCOMP_DISABLED=true
#- dictionaries=en
cap_add: #- SYS_ADMIN sometimes needed due to permission issue, - CHOWN no difference?
- MKNOD
- CAP_CHOWN
#tty: true
depends_on:
- nextcloud
These are now the logs when I try to backspace on the app (A great big wall of text! I see an error about enterMountingNS, unshare failed and creating usernamespace for mount user failed:
Thanks for sharing the logs! Based on what you’ve posted, I agree with assessment that there might be file permission issues. Additionally, there could be a misconfiguration in your Caddy setup, which can cause issues with Collabora connecting to Nextcloud.
Apart from that, I noticed you’re using Docker, which can sometimes have subtle issues if the volume permissions aren’t set correctly, especially when sharing data between containers. Make sure your nextcloud and collabora services have the correct permissions set for shared directories.
Here’s a quick checklist you might find useful:
Ensure file permissions are set correctly on directories shared by Docker containers. Both Nextcloud and Collabora should be able to read/write as needed.
Check Caddy configuration for handling reverse proxying. Ensure it’s routing correctly to the Collabora container without conflicting rules.
Verify Collabora’s coolwsd.xml file. Sometimes, mismatches in allowed hostnames can cause issues.
Lastly, here’s a relevant document from Collabora’s SDK setup guide: Collabora Online SDK. It might provide more insights, especially if you need to adjust advanced settings.
I did not set any volume for collabora, are you saying that nextcloud’s ‘nextcloud_aio_mastercontainer’ should be shared with collabora? Otherwise I have not messed with the docker permissions at all, I was under the impression that it handled that behind the scenes. All docker volumes save to the docker file that I moved to my server drive, it’s set to root. Should I chmod 777 or something? That seems like it’d be a security concern.
Caddy is working great. I didn’t include them in the docker-compose because they weren’t pertinent but jellyfin, audiobookshelf, all sorts of services are also using it without issues. No errors have been reported in its logs either.
I’m not sure I see any mention of hostnames, I must be reading it wrong. I had to trim it due to char limit.
[drm@archlinux ~]$ docker exec -it collaborac sh
$ cd /etc/coolwsd
$ cat coolwsd.xml
<!-- -*- nxml-child-indent: 4; tab-width: 4; indent-tabs-mode: nil -*- -->
<config>
<!-- For more detailed documentation on typical configuration options please see:
https://sdk.collaboraonline.com/docs/installation/Configuration.html -->
<!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. -->
<!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. -->
<accessibility desc="Accessibility settings">
<enable type="bool" desc="Controls whether accessibility support should be enabled or not." default="false">false</enable>
</accessibility>
<allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages>
<!--
These are the settings of external (remote) spellchecker and grammar checker services. Currently LanguageTool and Duden Korrekturserver APIs are supported, you can
set either of them. By default they are disabled. To turn the support on, please set "enabled" property to true. It works with self hosted or cloud services, free
and premium as well. The "base_url" may be https://api.languagetoolplus.com/v2 if the cloud version of LanguageTool is used. Please note that your data in the
document e.g. the text part of it will be sent to the cloud API. Please read the respective privacy policies, e.g. https://languagetool.org/legal/privacy.
-->
<languagetool desc="Remote API settings for spell and grammar checking">
<enabled desc="Enable Remote Spell and Grammar Checker" type="bool" default="false"></enabled>
<base_url desc="HTTP endpoint for the API server, without /check or /languages postfix at the end." type="string" default=""></base_url>
<user_name desc="LanguageTool or Duden account username for premium usage." type="string" default=""></user_name>
<api_key desc="API key provided by LanguageTool or Duden account for premium usage." type="string" default=""></api_key>
<ssl_verification desc="Enable or disable SSL verification. You may have to disable it in test environments with self-signed certificates." type="string" default="true"></ssl_verification>
<rest_protocol desc="REST API protocol. For LanguageTool leave it blank, for Duden Korrekturserver use the string 'duden'." type="string" default=""></rest_protocol>
</languagetool>
<deepl desc="DeepL API settings for translation service">
<enabled desc="If true, shows translate option as a menu entry in the compact view and as an icon in the tabbed view." type="bool" default="false">false</enabled>
<api_url desc="URL for the API" type="string" default=""></api_url>
<auth_key desc="Auth Key generated by your account" type="string" default=""></auth_key>
</deepl>
<sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path>
<child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path>
<mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree>
<mount_namespaces desc="Use mount namespaces instead of coolmount." type="bool" default="true"></mount_namespaces>
<server_name desc="External hostname:port of the server running coolwsd. If empty, it's derived from the request (please set it if this doesn't work). May be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default=""></server_name>
<file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing cool." type="path" relative="true" default="browser/../"></file_server_root_path>
<hexify_embedded_urls desc="Enable to protect encoded URLs from getting decoded by intermediate hops. Particularly useful on Azure deployments" type="bool" default="false"></hexify_embedded_urls>
<experimental_features desc="Enable/Disable experimental features" type="bool" default="true">true</experimental_features>
<memproportion desc="The maximum percentage of available memory consumed by all of the Collabora Online Development Edition processes, after which we start cleaning up idle documents. If cgroup memory limits are set, this is the maximum percentage of that limit to consume." type="double" default="80.0"></memproportion>
<num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="4">4</num_prespawn_children>
<!-- <fetch_update_check desc="Every number of hours will fetch latest version data. Defaults to 10 hours." type="uint" default="10">10</fetch_update_check> -->
<!-- <allow_update_popup desc="Allows notification about an update in the editor" type="bool" default="true">true</allow_update_popup> -->
<per_document desc="Document-specific settings, including LO Core settings.">
<max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency>
<batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority>
<bgsave_priority desc="A (lower) priority for use by background save processes to free time for interactive ones" type="uint" default="5">5</bgsave_priority>
<redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments>
<pdf_resolution_dpi desc="The resolution, in DPI, used to render PDF documents as image. Memory consumption grows proportionally. Must be a positive value less than 385. Defaults to 96." type="uint" default="96">96</pdf_resolution_dpi>
<idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs>
<idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Disabled when 0. Defaults to 30 seconds." type="uint" default="30">30</idlesave_duration_secs>
<autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Disabled when 0. Defaults to 5 minutes." type="uint" default="300">300</autosave_duration_secs>
<background_autosave desc="Allow auto-saves to occur in a forked background process where possible." type="bool" default="true">true</background_autosave>
<background_manualsave desc="Allow manual save to occur in a forked background process where possible" type="bool" default="true">true</background_manualsave>
<always_save_on_exit desc="On exiting the last editor, always perform a save and upload if the document had been modified. This is to allow the storage to store the document, if it had skipped doing so, previously, as an optimization." type="bool" default="false">false</always_save_on_exit>
<limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb>
<limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb>
<limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb>
<limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files>
<limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs>
<limit_store_failures desc="Maximum number of consecutive save-and-upload to storage failures when unloading the document. 0 for unlimited (not recommended)." type="uint" default="5">5</limit_store_failures>
<limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs>
<min_time_between_saves_ms desc="Minimum number of milliseconds between saving the document on disk." type="uint" default="500">500</min_time_between_saves_ms>
<min_time_between_uploads_ms desc="Minimum number of milliseconds between uploading the document to storage." type="uint" default="5000">5000</min_time_between_uploads_ms>
<cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="true">
<cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms>
<bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs>
<idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs>
<limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb>
<limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per>
<lost_kit_grace_period_secs desc="The minimum grace period for a lost kit process (not referenced by coolwsd) to resolve its lost status before it is terminated. To disable the cleanup of lost kits use value 0" default="120">120</lost_kit_grace_period_secs>
</cleanup>
</per_document>
<per_view desc="View-specific settings.">
<out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 300 seconds." type="uint" default="300">300</out_of_focus_timeout_secs>
<idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs>
<custom_os_info desc="Custom string shown as OS version in About dialog, get from system if empty." type="string" default=""></custom_os_info>
</per_view>
<ver_suffix desc="Appended to etags to allow easy refresh of changed files during development" type="string" default=""></ver_suffix>
<logging>
<color type="bool">true</color>
<!--
Note to developers: When you do "make run", the logging.level will be set on the
coolwsd command line, so if you want to change it for your testing, do it in
Makefile.am, not here.
-->
<level type="string" desc="Can be 0-8 (with the lowest numbers being the least verbose), or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level>
<level_startup type="string" desc="As for level - but for the initial startup phase which is most problematic, logging reverts to level configured above when startup is complete" default="trace">trace</level_startup>
<disabled_areas type="string" desc="High verbosity logging ie. info to trace are disable-able, comma separated: Generic, Pixel, Socket, WebSocket, Http, WebServer, Storage, WOPI, Admin, Javascript" default="Socket,WebSocket,Admin">Socket,WebSocket,Admin,Pixel</disabled_areas>
<most_verbose_level_settable_from_client type="string" desc="A loggingleveloverride message from the client can not set a more verbose log level than this" default="notice">notice</most_verbose_level_settable_from_client>
<least_verbose_level_settable_from_client type="string" desc="A loggingleveloverride message from a client can not set a less verbose log level than this" default="fatal">fatal</least_verbose_level_settable_from_client>
<protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol>
<!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav"
See also: https://docs.libreoffice.org/sal/html/sal_log.html -->
<lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log>
<file enable="false">
<!-- If you use other path than /var/log and you run coolwsd from systemd, make sure that you enable that path in coolwsd.service (ReadWritePaths). -->
<property name="path" desc="Log file path.">/var/log/coolwsd.log</property>
<property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property>
<property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property>
<property name="compress" desc="Enable/disable log file compression.">true</property>
<property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property>
<property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property>
<property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property>
<property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property>
</file>
<anonymize>
<anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data>
<anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt>
</anonymize>
<docstats type="bool" desc="Enable to see document handling information in logs." default="false">false</docstats>
<userstats desc="Enable user stats. i.e: logs the details of a file and user" type="bool" default="false">false</userstats>
<disable_server_audit type="bool" desc="Disabled server audit dialog and notification. Admin will no longer see warnings in the application user interface. This doesn't affect log file." default="false">false</disable_server_audit>
</logging>
<!--
Note to developers: When you do "make run", the trace_event[@enable] will be set on the
coolwsd command line, so if you want to change it for your testing, do it in Makefile.am,
not here.
-->
<trace_event desc="The possibility to turn on generation of a Chrome Trace Event file" enable="false">
<path desc="Output path for the Trace Event file, to which they will be written if turned on at run-time" type="string" default="/var/log/coolwsd.trace.json">/var/log/coolwsd.trace.json</path>
</trace_event>
<browser_logging desc="Logging in the browser console" default="false">false</browser_logging>
<trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false">
<path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/cooltrace-%.gz" compress="true" snapshot="false"></path>
<filter>
<message desc="Regex pattern of messages to exclude"></message>
</filter>
<outgoing>
<record desc="Whether or not to record outgoing messages" default="false">false</record>
</outgoing>
</trace>
<net desc="Network settings">
<!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, coolwsd unexpectedly listens on [::1] only.
You need to change net.proto to IPv4, if you want to use 127.0.0.1. -->
<proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto>
<listen type="string" default="any" desc="Listen address that coolwsd binds to. Can be 'any' or 'loopback'.">any</listen>
<!-- this allows you to shift all of our URLs into a sub-path from
https://my.com/browser/a123... to https://my.com/my/sub/path/browser/a123... -->
<service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root>
<post_allow desc="Allow/deny client IP address for POST(REST)." allow="true">
<host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host>
<host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host>
<host desc="The IPv6 loopback (localhost) address.">::1</host>
<host desc="The IPv4 private 172.16.0.0/12 subnet part 1.">172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 private 172.16.0.0/12 subnet part 2.">172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 private 172.16.0.0/12 subnet part 3.">172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 private 10.0.0.0/8 subnet (Podman).">10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
</post_allow>
<lok_allow desc="Allowed hosts as an external data source inside edited files. All allowed post_allow.host and storage.wopi entries are also considered to be allowed as a data source. Used for example in: PostMessage Action_InsertGraphics, =WEBSERVICE() function, external reference in the cell.">
<host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host>
<host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host>
<host desc="The IPv6 loopback (localhost) address.">::1</host>
<host desc="The IPv4 private 172.16.0.0/12 subnet part 1.">172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 private 172.16.0.0/12 subnet part 2.">172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 private 172.16.0.0/12 subnet part 3.">172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 private 10.0.0.0/8 subnet (Podman).">10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Localhost access by name">localhost</host>
</lok_allow>
<content_security_policy desc="Customize the CSP header by specifying one or more policy-directive, separated by semicolons. See w3.org/TR/CSP2"></content_security_policy>
<frame_ancestors desc="OBSOLETE: Use content_security_policy. Specify who is allowed to embed the Collabora Online iframe (coolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors>
<connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by coolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs>
<!-- this setting radically changes how online works, it should not be used in a production environment -->
<proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix>
</net>
<ssl desc="SSL settings">
<!-- switches from https:// + wss:// to http:// + ws:// -->
<enable type="bool" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable>
<!-- SSL off-load can be done in a proxy, if so disable SSL, and enable termination below in production -->
<termination desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool" default="false">false</termination>
<cert_file_path desc="Path to the cert file" relative="false">/etc/coolwsd/cert.pem</cert_file_path>
<key_file_path desc="Path to the key file" relative="false">/etc/coolwsd/key.pem</key_file_path>
<ca_file_path desc="Path to the ca file" relative="false">/etc/coolwsd/ca-chain.cert.pem</ca_file_path>
<ssl_verification desc="Enable or disable SSL verification of hosts remote to coolwsd. If true SSL verification will be strict, otherwise certs of hosts will not be verified. You may have to disable it in test environments with self-signed certificates." type="string" default="false">false</ssl_verification>
<cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list>
<hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false">
<max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age>
<report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri>
<pins desc="Base64 encoded SPKI fingerprints of keys to be pinned">
<pin></pin>
</pins>
</hpkp>
<sts desc="Strict-Transport-Security settings, per rfc6797. Subdomains are always included.">
<enabled desc="Whether or not Strict-Transport-Security is enabled. Enable only when ready for production. Cannot be disabled without resetting the browsers." type="bool" default="false">false</enabled>
<max_age desc="Strict-Transport-Security max-age directive, in seconds. 0 is allowed; please see rfc6797 for details. Defaults to 1 year." type="int" default="31536000">31536000</max_age>
</sts>
</ssl>
<security desc="Altering these defaults potentially opens you to significant risk">
<seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp>
<!-- deprecated: If capabilities is 'false', coolwsd will assume mount_namespaces of 'true' to achieve
this goal, only avoiding chroot for process isolation if linux namespaces are unavailable -->
<capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities>
<jwt_expiry_secs desc="Time in seconds before the Admin Console's JWT token expires" type="int" default="1800">1800</jwt_expiry_secs>
<enable_macros_execution desc="Specifies whether the macro execution is enabled in general. This will enable Basic and Python scripts to execute both installed and from documents. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool" default="false">false</enable_macros_execution>
<macro_security_level desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int" default="1">1</macro_security_level>
<enable_websocket_urp desc="Should we enable URP (UNO remote protocol) communication over the websocket. This allows full control of the Kit child server to anyone with access to the websocket including executing macros without confirmation or running arbitrary shell commands in the jail." type="bool" default="false">false</enable_websocket_urp>
<enable_metrics_unauthenticated desc="When enabled, the /cool/getMetrics endpoint will not require authentication." type="bool" default="false">false</enable_metrics_unauthenticated>
</security>
<certificates>
<database_path type="string" desc="Path to the NSS certificates that are available to all users" default=""></database_path>
</certificates>
<watermark>
<opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity>
<text desc="Watermark text to be displayed on the document if entered" type="string"></text>
</watermark>
<storage desc="Backend storage">
<filesystem allow="false" />
<wopi desc="Allow/deny wopi storage." allow="true">
<max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size>
<locking desc="Locking settings">
<refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh>
</locking>
<alias_groups desc="default mode is 'first' it allows only the first host when groups are not defined. set mode to 'groups' and define group to allow multiple host and its aliases" mode="first">
<!-- If you need to use multiple wopi hosts, please change the mode to "groups" and
add the hosts below. If one host is accessible under multiple ip addresses
or names, add them as aliases. -->
<!--<group>
<host desc="hostname to allow or deny." allow="true">scheme://hostname:port</host>
<alias desc="regex pattern of aliasname">scheme://aliasname1:port</alias>
<alias desc="regex pattern of aliasname">scheme://aliasname2:port</alias>
</group>-->
<!-- More "group"s possible here -->
</alias_groups>
<is_legacy_server desc="Set to true for legacy server that need deprecated headers." type="bool" default="false"></is_legacy_server>
</wopi>
<ssl desc="SSL settings">
<as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme>
<enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and coolwsd. When empty this defaults to following the ssl.enable setting"></enable>
<cert_file_path desc="Path to the cert file. When empty this defaults to following the ssl.cert_file_path setting" relative="false"></cert_file_path>
<key_file_path desc="Path to the key file. When empty this defaults to following the ssl.key_file_path settinge" relative="false"></key_file_path>
<ca_file_path desc="Path to the ca file. When empty this defaults to following the ssl.ca_file_path setting" relative="false"></ca_file_path>
<cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overridden only if absolutely needed."></cipher_list>
</ssl>
</storage>
So am I reading that collabora does indeed not need a volume because it uses nextcloud’s WOPI? Here you can see my settings for that:
@darshan over on the nextcloud forum we narrowed the issue down to the keyboard. Switching to google’s seems to alleviate it. Of course, getting away from Google was the whole point of collabora and Nextcloud for me. Now we’ve found a more specific problem do you have any idea on how to fix it? Also, .md files work for either keyboard if that’s helpful.
