Seafile WOPI error in Collabora

Installation & Configuration
1

I am trying to integrate Collabora into Seafile. Everytime I try to open an Office file I get this error:

Unauthorized WOPI host. Please try again later and report to your administrator if the issue persists.

I followed the Seafile Guid here and the Collabora Documentations here to find a way but still not working. In the Doher Log I get those errors when trying to open the office files

[ websrv_poll ] ERR  #30: WOPI::CheckFileInfo failed for URI [https://seafile.domain.tld/api2/wopi/files/xxx?access_token=xxx&access_token_ttl=0]: 0 (Unknown) . Headers: 	Body: []| wsd/wopi/CheckFileInfo.cpp:103
[ websrv_poll ] ERR  #30: Invalid URI or access denied to [https://seafile.domain.tld/api2/wopi/files/xxx?access_token=xxx&access_token_ttl=0]| wsd/wopi/CheckFileInfo.cpp:118

When the container starts it also reports some errors:

wsd-00001-00001 2025-05-16 20:16:04.603177 +0000 [ coolwsd ] ERR  enterMountingNS, root mount failed: Permission denied| common/JailUtil.cpp:79
wsd-00001-00001 2025-05-16 20:16:04.603435 +0000 [ coolwsd ] ERR  creating usernamespace for mount user failed.| wsd/COOLWSD.cpp:1229
wsd-00001-00001 2025-05-16 20:16:04.628437 +0000 [ coolwsd ] ERR  Failed to bind-mount [/opt/cool/systemplate] -> [/opt/cool/child-roots/1-a7e2f2e1/cool_test_mount]| common/JailUtil.cpp:157
wsd-00001-00001 2025-05-16 20:16:04.628507 +0000 [ coolwsd ] ERR  Bind-Mounting fails and will be disabled for this run. To disable permanently set mount_jail_tree config entry in coolwsd.xml to false.| common/JailUtil.cpp:454

...

kit-00035-00035 2025-05-16 20:16:25.618101 +0000 [ kit_spare_001 ] ERR  Failed to get the realpath of [/opt/cool/child-roots/1-a7e2f2e1/tmp/sharedpresets/template] (ENOENT: No such file or directory)| common/FileUtil-unix.cpp:63
kit-00035-00035 2025-05-16 20:16:25.618292 +0000 [ kit_spare_001 ] ERR  linkOrCopy: nftw() failed for '/opt/cool/child-roots/1-a7e2f2e1/tmp/sharedpresets/template'| kit/Kit.cpp:612
wsd-00001-00029 2025-05-16 20:16:25.661290 +0000 [ prisoner_poll ] TRC  PrisonerRequestDispatcher| wsd/COOLWSD.cpp:2891
kit-00042-00042 2025-05-16 20:16:26.228852 +0000 [ kit_spare_004 ] ERR  Failed to get the realpath of [/opt/cool/child-roots/1-a7e2f2e1/tmp/sharedpresets/template] (ENOENT: No such file or directory)| common/FileUtil-unix.cpp:63
kit-00042-00042 2025-05-16 20:16:26.228989 +0000 [ kit_spare_004 ] ERR  linkOrCopy: nftw() failed for '/opt/cool/child-roots/1-a7e2f2e1/tmp/sharedpresets/template'| kit/Kit.cpp:612
kit-00041-00041 2025-05-16 20:16:26.242437 +0000 [ kit_spare_003 ] ERR  Failed to get the realpath of [/opt/cool/child-roots/1-a7e2f2e1/tmp/sharedpresets/template] (ENOENT: No such file or directory)| common/FileUtil-unix.cpp:63
kit-00041-00041 2025-05-16 20:16:26.242548 +0000 [ kit_spare_003 ] ERR  linkOrCopy: nftw() failed for '/opt/cool/child-roots/1-a7e2f2e1/tmp/sharedpresets/template'| kit/Kit.cpp:612
kit-00040-00040 2025-05-16 20:16:26.339427 +0000 [ kit_spare_002 ] ERR  Failed to get the realpath of [/opt/cool/child-roots/1-a7e2f2e1/tmp/sharedpresets/template] (ENOENT: No such file or directory)| common/FileUtil-unix.cpp:63
kit-00040-00040 2025-05-16 20:16:26.339625 +0000 [ kit_spare_002 ] ERR  linkOrCopy: nftw() failed for '/opt/cool/child-roots/1-a7e2f2e1/tmp/sharedpresets/template'| kit/Kit.cpp:612

Docker compose for Collabora:

services:
  seafile-collabora:
    image: collabora/code
    container_name: seafile-collabora
    restart: unless-stopped
    networks:
      - public
    cap_add:
     - MKNOD
    privileged: true
    tty: true
    security_opt:
      - seccomp:unconfined
    env_file: ./seafile-collabora.env
networks:
  public:
    external: true

content of .env

username=user
password=pass
domain=seafile\\.domain\\.tld
server_name=documentserver.domain.tld
aliasgroup1=https://.*:443
dictionaries=de_DE en_GB en_US es_ES
extra_params=--o:ssl.enable=false --o:ssl.termination=true --o:wopi.host=seafile.domain.tld

Added this to seahub_settings.py

OFFICE_SERVER_TYPE = 'CollaboraOffice'
ENABLE_ONLYOFFICE = False
ENABLE_OFFICE_WEB_APP = True
OFFICE_WEB_APP_BASE_URL = 'https://documentserver.domain.tld/hosting/discovery'
WOPI_ACCESS_TOKEN_EXPIRATION = 30 * 60
OFFICE_WEB_APP_FILE_EXTENSION = ('odp', 'ods', 'odt', 'xls', 'xlsb', 'xlsm', 'xlsx','ppsx', 'ppt', 'pptm', 'pptx', 'doc', 'docm', 'docx')
ENABLE_OFFICE_WEB_APP_EDIT = True
OFFICE_WEB_APP_EDIT_FILE_EXTENSION = ('odp', 'ods', 'odt', 'xls', 'xlsb', 'xlsm', 'xlsx','ppsx', 'ppt', 'pptm', 'pptx', 'doc', 'docm', 'docx')
2

hii @asem1989 welcome to collabora online forum

Integration Debug Checklist for Collabora + Seafile

1. Ensure wopi.host matches Seafile domain

  • Set --o:wopi.host=seafile.domain.tld exactly.
  • If Seafile redirects internally to another domain or uses a proxy, use that host instead.

2. Set correct aliasgroup1

  • Avoid wildcards like https://.*:443. Instead, use:

    aliasgroup1=https://seafile.domain.tld

  • You can also explicitly pass via:

    --o:aliasgroup1=https://seafile.domain.tld

3. Disable sandboxing if needed

  • If you’re seeing:

    root mount failed: Permission denied
Bind-Mounting fails...

    Add to your .env or extra_params:

    --o:mount_jail_tree=false

4. Verify Collabora → Seafile connectivity

  • Inside the container, test DNS and HTTPS access:

    docker exec -it seafile-collabora ping seafile.domain.tld
docker exec -it seafile-collabora curl -vk 'https://seafile.domain.tld/api2/wopi/files/xxx?access_token=xxx'

5. Check Seafile logs for WOPI errors

  • It’s possible Seafile is rejecting or misrouting WOPI requests.

  • Look in Seafile’s logs (usually in seahub.log or gunicorn.log) for issues like:

    • Missing access_token
    • 403 or 404 errors
    • Internal server errors

  • Confirm that Seafile is actually serving WOPI endpoints at /api2/wopi/...

6. Check Seafile seahub_settings.py

  • Ensure all required settings are in place and correct, especially:

    OFFICE_WEB_APP_BASE_URL = 'https://documentserver.domain.tld/hosting/discovery'

7. Check for proxy issues

  • If using Nginx, Apache, or Traefik in front of Seafile or Collabora, ensure:

    • Headers like Host, Authorization, and Access-Control-* are not stripped.
    • No redirect or rewrite breaks the WOPI path.

Please check few topics from this forum which is realted to seafile issue. There might be already present solution that can help you with this

Thanks
Darshan

1 Like
3

Adding --o:wopi.host=seafile.domain.tld changed the type of message I get trying to open an office file:

Failed to establish socket connection or socket connection closed unexpectedly. The reverse proxy might be misconfigured, please contact the administrator. For more info on proxy configuration please checkout Proxy settings — SDK https://sdk.collaboraonline.com/ documentation

I am running Collabora behind NginX Proxy Manager. I tried the collowing custom configurations but it did not work:

# static files
location ^~ /browser {
  proxy_pass $forward_scheme://$server:$port;
  proxy_set_header Host $http_host;
}

# WOPI discovery URL
location ^~ /hosting/discovery {
  proxy_pass $forward_scheme://$server:$port;
  proxy_set_header Host $http_host;
}

# Capabilities
location ^~ /hosting/capabilities {
  proxy_pass $forward_scheme://$server:$port;
  proxy_set_header Host $http_host;

 }
# main websocket
location ~ ^/cool/(.*)/ws$ {
  proxy_pass $forward_scheme://$server:$port;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "Upgrade";
  proxy_set_header Host $http_host;
  proxy_read_timeout 36000s;
}

# download, presentation and image upload
location ~ ^/(c|l)ool {
  proxy_pass $forward_scheme://$server:$port;
  proxy_set_header Host $http_host;
}

# Admin Console websocket
location ^~ /cool/adminws {
  proxy_pass $forward_scheme://$server:$port;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "Upgrade";
  proxy_set_header Host $http_host;
  proxy_read_timeout 36000s;
}

The Docker log for Collabora container has this error:

ERR #31: Rejecting WebSocket upgrade with: origin [https://documentserver.domain.tld] expected [https://documentserver.domain.tld:443] instead| net/WebSocketHandler.hpp:1035

4

This means:

  • Collabora expects the origin to include the port (e.g., :443), but the request only sent the host without the port.
1 Like