Hello @NaXal, I’ve compiled all the possibilities from various sources and documents. I truly hope this time it works, and you achieve the outcome you’re aiming for. My only request is that you go through each point with utmost attention.
It seems like the changes in your coolwsd.xml file are not taking effect as expected. Given the issue persists, here are a few more things to check and try:
1. Check for Other Configuration Files
Sometimes Docker images or Docker Compose setups might be using a different configuration file than expected. Verify that the coolwsd.xml file you’re editing is the correct one being used by the running Collabora container.
To confirm this, you can:
- Enter the running Collabora container:
docker exec -it <container-id> /bin/bash
- Navigate to where the configuration file is located (typically
/etc/coolwsd/) and confirm that your changes are present.
cat /etc/coolwsd/coolwsd.xml
If your changes are not present, the container might be mapping a different config file or restoring the default config during startup. In that case, you’ll need to ensure the Docker Compose file is mapping the correct configuration.
2. Verbose Logs for WOPI Domain Restrictions
Enable more verbose logging to see if the WOPI host restrictions are being read and applied during runtime.
In your coolwsd.xml, change the logging level to debug:
<logging>
<file enable="true">/var/log/coolwsd.log</file>
<level desc="0-5, where 0 is nothing and 5 is most verbose." type="int" default="2">5</level>
<color type="bool" desc="true enables colorful logs" default="true">false</color>
</logging>
Then, after restarting the container, monitor the logs for clues:
docker logs <container-id>
Look for lines related to WOPI host verification to see if the correct domain restrictions are being applied.
3. Verify Alias Group Mode
Double-check if Collabora is reading your alias group configuration properly. If you’re only allowing one Nextcloud instance and don’t need multiple alias groups, make sure you’ve kept mode="first" in <alias_groups>. You can also try explicitly switching to mode="groups" and specifying the allowed host under a group:
<alias_groups mode="groups">
<group>
<host allow="true">https://nc.mydomain.online</host>
</group>
</alias_groups>
4. Disable Unwanted Access at the Proxy Level
If the coolwsd.xml settings are still not working as expected, you can restrict unwanted access at the reverse proxy (Nginx) level, as a more enforceable workaround.
In your Nginx configuration for office.mydomain.online, explicitly deny all domains except nc.mydomain.online by checking the Origin header:
server {
server_name office.mydomain.online;
location / {
# Deny any requests from non-authorized domains
if ($http_origin !~* "^https://nc.mydomain.online") {
return 403;
}
proxy_pass http://localhost:9980;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
This will ensure that only requests coming from nc.mydomain.online are allowed through to the Collabora server. Any other domain, such as nc.mydomain.com, will be blocked.
5. Firewall or IP Blocking
Another option is to use firewall rules on the host running Collabora CODE to restrict access based on the source IP address. This can be configured using iptables or the firewall of your choice.
For example, to allow only connections from nc.mydomain.online:
sudo iptables -A INPUT -s <Nextcloud server IP> -p tcp --dport 9980 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 9980 -j DROP
This will allow traffic from the specified IP only, blocking all other sources from accessing the Collabora service.
6. Check Collabora CODE Version
It’s worth checking whether your current Collabora CODE version fully supports the coolwsd.xml domain restrictions. You can try updating to the latest stable version to ensure that all security features, including WOPI restrictions, are properly enforced.
Conclusion
- Double-check that you’re editing the correct
coolwsd.xml file.
- Increase log verbosity to see what’s happening with domain restrictions.
- If necessary, explicitly switch to
mode="groups" for more precise control.
- Consider enforcing domain restrictions at the Nginx or firewall level if the config changes still don’t work.
- Make sure you are running the latest version of Collabora CODE.
All the best,
Darshan
