Docker-CODE
Docker-CODE copied to clipboard
CollaboraOnline
Requesting address is denied
Have a running Collabora with nextcloud, but if I load file list I get the following error messege for each word / excel document in list.
wsd-00029-00040 2018-12-13 14:45:46.879437 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.17.0.8| wsd/LOOLWSD.cpp:1851
wsd-00029-00040 2018-12-13 14:45:46.903576 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.17.0.8| wsd/LOOLWSD.cpp:1851
172.17.0.8 is the current nextcloud container ip address which should be allowed. So how can I allow it?
<storage desc="Backend storage">
<filesystem allow="false" />
<wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true">
<host desc="Regex pattern of hostname to allow or deny." allow="true">10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Regex pattern of hostname to allow or deny." allow="true">172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Regex pattern of hostname to allow or deny." allow="true">172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Regex pattern of hostname to allow or deny." allow="true">172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Regex pattern of hostname to allow or deny." allow="true">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Regex pattern of hostname to allow or deny." allow="false">192\.168\.1\.1</host>
<max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size>
</wopi>
<webdav desc="Allow/deny webdav storage. Mutually exclusive with wopi." allow="false">
<host desc="Hostname to allow" allow="false">office</host>
</webdav>
</storage>
connected from nextcloud container to collabora container looks good.
$ docker exec -ti nextcloud_app_1 curl http://office:9980
OK
So I think I need to allow the nextcloud container by hostname or ip (subnet)? How to do with docker compose environment?
I note the same issue when accessing collabora from a nextcloud container in Docker swarm. I updated storage.wopi.host to include the following (for ipv6-enabled hosts):
<host desc="Regex pattern of hostname to allow or deny." allow="true">::ffff:172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Regex pattern of hostname to allow or deny." allow="true">::ffff:172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Regex pattern of hostname to allow or deny." allow="true">::ffff:172\.3[01\.[0-9]{1,3}\.[0-9]{1,3}</host>
... but I still get requesting address denied. What's the right way to fix this?
Thanks! D
It's not about the WOPI host. There is another setting, net.post_allow.host.Basically it is for the thumbnail generation.
@timar Could you give an example how to allow it? I'm new with collabora and don't know how to set that / multiple options by env variable to the docker container. At the moment I set ssl.enable to false because of a container to container connection without encryption.
Tried for example that extra_params:
extra_params: '--o:ssl.enable=false --o:net.post_allow.host=172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3} --o:net.post_allow.host=172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3} --o:net.post_allow.host=172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}'
The ssl.enable=false should work, because without the connection fails earlier...
I did not try, but probably you can pass only one --o:net.post_allow.host. Edit your regex carefully, and you can also use | character to separate your regexes.
I am getting the same error when proxying the requests through traefik and disabling ssl on the docker image. I read through the issues and tried the parameters suggested here but I haven't been successful. Here is the error: wsd-00031-00041 2018-12-27 20:21:25.091316 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.16.253.40| wsd/LOOLWSD.cpp:1971
The docker parameters command line:
sudo docker run -t -d -p 9980:9980 -e extra_params='--o:ssl.enable=false --o:net.post_allow.host=172\.16\.[0-9]{1,3}\.[0-9]{1,3} --o:storage.wopi.host=172\.16\.[0-9]{1,3}\.[0-9]{1,3} --o:ssl.termination=true' --cap-add MKNOD --restart always collabora/code
loolwsd.xml has the ip pattern allowed:
<host desc="Regex pattern of hostname to allow or deny." allow="true">172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
I am using the latest docker image from hub.docker.com. It should be 4.0.0.2
::ffff:172.16.253.40 is an IPv6 address, and you allowed IPv4 addresses. The 172.16.[0-9]{1,3}.[0-9]{1,3} regex won't match ::ffff:172.16.253.40.
Thx, I got it working by changing the pattern to an ipv4 mapped ipv6 address pattern. I also had to add the domain parameter. Even though it is working I still get the error message in the logs. I am not sure why.
new docker command:
sudo docker run -t -d -p 9980:9980 -e 'domain=cloud\\.example\\.com' -e extra_params='--o:ssl.enable=false --o:net.post_allow.host=\:\:ffff\:172\.16\.[0-9]{1,3}\.[0-9]{1,3} --o:storage.wopi.host=\:\:ffff\:172\.16\.[0-9]{1,3}\.[0-9]{1,3} --o:ssl.termination=true' --cap-add MKNOD --restart always collabora/code
Error: wsd-00031-00031 2018-12-28 00:46:51.201584 [ loolwsd ] INF WSD initialization complete: setting log-level to [warning] as configured.| wsd/LOOLWSD.cpp:3179 wsd-00031-00041 2018-12-28 00:50:16.790039 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.16.253.40| wsd/LOOLWSD.cpp:1971 wsd-00031-00041 2018-12-28 00:50:18.765730 [ websrv_poll ] WRN WOPI host did not pass optional access_token_ttl| wsd/FileServer.cpp:610
Files not opened. Have to check why... Only see...
Could anyone share a working compose / stack nextcloud with collabora?
Here’s how I ended up setting mine up:
https://geek-cookbook.funkypenguin.co.nz/recipes/collabora-online/
D
-- Sent from my mobile device
On 5/01/2019, at 10:22 AM, pwFoo [email protected] wrote:
Files not opened. Have to check why... Only see...
Could anyone share a working compose / stack nextcloud with collabora?
— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.
Today, I installed the official collabora/code container and an apache reverse proxy with a valid certificate. I got the same issue. What is the official fix for it ?
The problem with ::ffff:172 comes from merging IPv6 and IPv4. Disable IPv6 with echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6 and for future echo net.ipv6.conf.all.disable_ipv6 = 1 > /etc/sysctl.d/01-disable-ipv6.conf than restart the dockercotainer and all works fine.
with regards
wsd-00028-00039 2019-02-14 06:34:49.520306 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.17.0.1| wsd/LOOLWSD.cpp:197
I did the IPv6 trick however honestly didn't know where I should use these commands --- I have freebsd install of nextcloud in a jail and a vm running ubuntu which is running docker and the container. I tried the IPv6 command on the Ubuntu VM and same thing occured.
I even tried with following config:sudo docker run -t -d -p 127.0.0.1:9980:9980 -e 'domain=nextcloud\.domain\.com' -e "username=admin" -e "password=dockercol" -e extra_params='--o:net.proto=IPv4' --restart always --cap-add MKNOD collabora/code
I received this error: _wsd-00028-00039 2019-02-14 06:34:49.520306 [ websrv_poll ] ERR Requesting address is denied: 172.17.0.1| wsd/LOOLWSD.cpp:197
I also tried adding both the ipv6 and ipv4 variant of the 172.17.0.1 and got a similar error.
I modified the config file and basically added the following:
storage.filesystem.wopi section
net.post_allow section
Note nothing ever worked!!! Similar post here: https://help.nextcloud.com/t/requesting-address-is-denied-172-17-0-1-wsd-loolwsd-cpp-1971/44179/15
HELP!!
<!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. -->
<!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. -->
<allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages>
<tile_cache_path desc="Path to a directory where to keep the tile cache." type="path" relative="false" default="/var/cache/loolwsd"></tile_cache_path>
<sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path>
<lo_template_path desc="Path to a LibreOffice installation tree to be copied (linked) into the jails for child processes. Should be on the same file system as systemplate." type="path" relative="false" default="/opt/collaboraoffice6.0"></lo_template_path>
<child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path>
<server_name desc="Hostname:port of the server running loolwsd. If empty, it's derived from the request." type="string" default=""></server_name>
<file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path>
<memproportion desc="The maximum percentage of system memory consumed by all of the LibreOffice Online, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion>
<num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children>
<per_document desc="Document-specific settings, including LO Core settings.">
<max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency>
<document_signing_url desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string" default="https://app.vereign.com">https://app.vereign.com</document_signing_url>
<redlining_as_comments desc="If true show red-lines as comments" type="bool" default="true">true</redlining_as_comments>
<idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs>
<!-- Idle save and auto save are checked every 30 seconds -->
<idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="uint" default="30">30</idlesave_duration_secs>
<autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="uint" default="300">300</autosave_duration_secs>
<limit_virt_mem_kb desc="The maximum virtual memory allowed to each document process. 0 for unlimited, 1700 min." type="uint">0</limit_virt_mem_kb>
<limit_data_mem_kb desc="The maximum memory data segment allowed to each document process. 0 for unlimited." type="uint">0</limit_data_mem_kb>
<limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb>
<limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb>
<limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files>
<limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs>
</per_document>
<per_view desc="View-specific settings.">
<out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 60 seconds." type="uint" default="60">60</out_of_focus_timeout_secs>
<idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs>
</per_view>
<loleaflet_html desc="Allows UI customization by replacing the single endpoint of loleaflet.html" type="string" default="loleaflet.html">loleaflet.html</loleaflet_html>
<logging>
<color type="bool">true</color>
<level type="string" desc="Can be 0-8, or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">debug</level>
<file enable="false">
<property name="path" desc="Log file path.">/var/log/loolwsd.log</property>
<property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property>
<property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property>
<property name="compress" desc="Enable/disable log file compression.">true</property>
<property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property>
<property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property>
<property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property>
<property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property>
</file>
<anonymize>
<filenames type="bool" desc="Enable to anonymize/obfuscate filenames in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</filenames>
<usernames type="bool" desc="Enable to anonymize/obfuscate usernames in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</usernames>
</anonymize>
</logging>
<loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging>
<trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false">
<path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/looltrace-%.gz" compress="true" snapshot="false"></path>
<filter>
<message desc="Regex pattern of messages to exclude"></message>
</filter>
<outgoing>
<record desc="Whether or not to record outgoing messages" default="false">false</record>
</outgoing>
</trace>
<net desc="Network settings">
<proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto>
<listen type="string" default="any" desc="Listen address that loolwsd binds to. Can be 'any' or 'loopback'.">any</listen>
<service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root>
<post_allow desc="Allow/deny client IP address for POST(REST)." allow="true">
<host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 private 10.0 block as plain IPv4 dotted decimal addresses.">10\.0\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host>
<host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host>
<host desc="The IPv6 loopback (localhost) address.">::1</host>
<host desc="RFC1918 private addressing in inet6 format">::ffff:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="RFC1918 private addressing in inet6 format">::ffff:172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="RFC1918 private addressing in inet6 format">::ffff:172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="RFC1918 private addressing in inet6 format">::ffff:172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="RFC1918 private addressing in inet6 format">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
</post_allow>
<frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (loolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors>
</net>
<ssl desc="SSL settings">
<enable type="bool" desc="Controls whether SSL encryption is enable (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>
<termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination>
<cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path>
<key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path>
<ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path>
<cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list>
<hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false">
<max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age>
<report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri>
<pins desc="Base64 encoded SPKI fingerprints of keys to be pinned">
<pin></pin>
</pins>
</hpkp>
</ssl>
<security desc="Altering these defaults potentially opens you to significant risk">
<seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp>
<capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities>
</security>
<storage desc="Backend storage">
<filesystem allow="false" />
<wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true">
<host desc="Regex pattern of hostname to allow or deny." allow="true">nextcloud\.gohilton\.com</host>
<host desc="Regex pattern of hostname to allow or deny." allow="true">10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Regex pattern of hostname to allow or deny." allow="true">172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Regex pattern of hostname to allow or deny." allow="true">172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Regex pattern of hostname to allow or deny." allow="true">172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Regex pattern of hostname to allow or deny." allow="true">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
<host desc="Regex pattern of hostname to allow or deny." allow="false">192\.168\.1\.1</host>
<max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size>
</wopi>
<webdav desc="Allow/deny webdav storage. Mutually exclusive with wopi." allow="false">
<host desc="Hostname to allow" allow="false">nextcloud\.gohilton\.com</host>
</webdav>
</storage>
<tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent>
<admin_console desc="Web admin console settings.">
<enable desc="Enable the admin console functionality" type="bool" default="true">true</enable>
<enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam>
<username desc="The username of the admin console. Ignored if PAM is enabled.">admin</username>
<password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or loolconfig to set up a secure password.">dockercol</password>
</admin_console>
<monitors desc="Addresses of servers we connect to on start for monitoring">
</monitors>
The problem with ::ffff:172 comes from merging IPv6 and IPv4. Disable IPv6 with echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6 and for future echo net.ipv6.conf.all.disable_ipv6 = 1 > /etc/sysctl.d/01-disable-ipv6.conf than restart the dockercotainer and all works fine.
with regards
I made these changes within the container itself by passing a statement like this:
sudo docker run --sysctl net.ipv6.conf.all.disable_ipv6=1 --sysctl net.ipv6.conf.default.disable_ipv6=1 -t -d -p 127.0.0.1:9980:9980 -e 'domain=nextcloud\\.domainname\\.com' --name="jax" -e "username=admin" -e "password=dockercol" --restart always --cap-add MKNOD collabora/code
Still received following error: wsd-00028-00039 2019-02-14 13:31:10.619489 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.17.0.1| wsd/LOOLWSD.cpp:1971
The --o: override method here is a bit strange. I had only success by providing an explicit index to the option:
--o:net.post_allow.host[0]=::ffff:172.18.[0-9]+.[0-9]+
I couldnt find out though if this overrides the first entry of the xml config file or prepends one. The code there is quite messy.
The problem with ::ffff:172 comes from merging IPv6 and IPv4. Disable IPv6 with echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6 and for future echo net.ipv6.conf.all.disable_ipv6 = 1 > /etc/sysctl.d/01-disable-ipv6.conf than restart the dockercotainer and all works fine.
with regards
More info: https://askubuntu.com/questions/41543/how-to-dynamically-enable-and-disable-ipv6-on-an-interface
Although I still think, this is a workaround!
--o:net.post_allow.host[0]=::ffff:172.18.[0-9]+.[0-9]+
In my was it was: Requesting address is denied: ::ffff:172.17.0.1. So notice t he 172.17 instead of 172.18 ><
Edit: Still I can't open files. This Collabora Online really drives me nuts. Now I'm getting:
wsd-00029-00044 2019-02-22 23:01:50.128503 [ docbroker_001 ] WRN Client session [0002] not found to forward message: o281 statusindicatorstart:| wsd/DocumentBroker.cpp:1778
wsd-00029-00044 2019-02-22 23:01:50.128552 [ docbroker_001 ] WRN Client session [0002] not found to forward message: o282 statusindicatorfinish:| wsd/DocumentBroker.cpp:1778
wsd-00029-00044 2019-02-22 23:01:50.128572 [ docbroker_001 ] WRN Client session [0002] not found to forward message: o283 signaturestatus: 0| wsd/DocumentBroker.cpp:1778
wsd-00029-00045 2019-02-22 23:01:50.257571 [ docbroker_002 ] WRN Client session [0003] not found to forward message: o286 statusindicatorstart:| wsd/DocumentBroker.cpp:1778
wsd-00029-00045 2019-02-22 23:01:50.257696 [ docbroker_002 ] WRN Client session [0003] not found to forward message: o287 statusindicatorfinish:| wsd/DocumentBroker.cpp:1778
wsd-00029-00045 2019-02-22 23:01:50.257793 [ docbroker_002 ] WRN Client session [0003] not found to forward message: o288 signaturestatus: 0| wsd/DocumentBroker.cpp:1778
wsd-00029-00045 2019-02-22 23:01:50.257892 [ docbroker_002 ] WRN Client session [0003] not found to forward message: o289 cellformula: Human League* – (Keep Feeling) Fascination | wsd/DocumentBroker.cpp:1778
wsd-00029-00045 2019-02-22 23:01:50.257962 [ docbroker_002 ] WRN Client session [0003] not found to forward message: o290 celladdress: D11| wsd/DocumentBroker.cpp:1778
wsd-00029-00045 2019-02-22 23:01:50.258063 [ docbroker_002 ] WRN Client session [0003] not found to forward message: o291 cellcursor: 7590, 2550, 8999, 254, 3, 10| wsd/DocumentBroker.cpp:1778
The snippet fixes the error message, but still can't open a document?
--o:net.post_allow.host[0]=::ffff:172.[0-9]+.[0-9]+.[0-9]+
Loading icon forever, no error message with collabora or nextcloud container logs and reverse proxy too. Any idea?
I also tried different Nginx reverse proxy configs like: https://raw.githubusercontent.com/LibreOffice/online/master/etc/nginx/loolwsd.conf
Getting:
wsd-00015-00023 2019-02-25 17:03:15.610821 [ websrv_poll ] WRN client - server version mismatch, disabling browser cache.| wsd/FileServer.cpp:279
wsd-00015-00023 2019-02-25 17:03:15.750901 [ websrv_poll ] WRN FileServerRequestHandler: File not found: Invalid URI request: [/loleaflet/8a61a5302/branding.js].| wsd/FileServer.cpp:425
wsd-00015-00023 2019-02-25 17:03:15.949821 [ websrv_poll ] WRN FileServerRequestHandler: File not found: Invalid URI request: [/loleaflet/8a61a5302/branding.js].| wsd/FileServer.cpp:425
wsd-00015-00023 2019-02-25 17:03:16.676578 [ websrv_poll ] WRN client - server version mismatch, disabling browser cache.| wsd/FileServer.cpp:279
wsd-00015-00023 2019-02-25 17:03:16.800043 [ websrv_poll ] WRN FileServerRequestHandler: File not found: Invalid URI request: [/loleaflet/8a61a5302/branding.js].| wsd/FileServer.cpp:425
wsd-00015-00023 2019-02-25 17:03:16.982456 [ websrv_poll ] WRN FileServerRequestHandler: File not found: Invalid URI request: [/loleaflet/8a61a5302/branding.js].| wsd/FileServer.cpp:425
wsd-00015-00023 2019-02-25 17:05:59.125728 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.20.0.1| wsd/LOOLWSD.cpp:1966
wsd-00015-00023 2019-02-25 17:06:02.130269 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.20.0.1| wsd/LOOLWSD.cpp:1966
Really there is no good install guide.
I too am awaiting a proper fix or instruction on this issue. The ipv6 trick did not work for me.
In my case I even suspect the Nextcloud Content Security Policy (CSP), but I have no clue anymore... I gave up.
In my case I even suspect the Nextcloud Content Security Policy (CSP), but I have no clue anymore... I gave up.
I think you didn't configure your loolwsd.xml file properly for the WOPI host. Why don't you open a help request here: https://help.nextcloud.com/c/support/collabora. I'm pretty sure you're problem is fixable.
Here is my actual compose file, but documents not open. Just loading spinner and no failed calls.
version: '3.2'
services:
db:
image: mariadb:latest
network_mode: bridge
volumes:
- db:/var/lib/mysql
environment:
- MYSQL_DATABASE=<DB>
- MYSQL_ROOT_PASSWORD=<ROOT-PW>
- MYSQL_USER=<USER>
- MYSQL_PASSWORD=<PW>
app:
image: nextcloud:stable-apache
network_mode: bridge
volumes:
- nextcloud:/var/www/html
environment:
- MYSQL_HOST=db
- MYSQL_DB=<DB>
- MYSQL_USER=<USER>
- MYSQL_PASSWORD=<PW>
- VIRTUAL_HOST=<DOMAIN> # custom reverse proxy
- VIRTUAL_PORT=80 # custom reverse proxy
- CADDY_PROXY_OPTS=websocket # custom reverse proxy
depends_on:
- db
- collabora
links:
- db:db
- collabora:office
cron:
image: nextcloud:stable-apache
volumes:
- nextcloud:/var/www/html
entrypoint: /cron.sh
depends_on:
- db
links:
- db:db
collabora:
image: collabora/code
network_mode: bridge
cap_add:
- MKNOD
environment:
domain: office
server_name: office
# extra_params: '--o:ssl.enable=false --o:net.post_allow.host=\:\:ffff\:172\.1[6-7]\.[0-9]{1,3}\.[0-9]{1,3} --o:storage.wopi.host=\:\:ffff\:172\.1[6-7]\.[0-9]{1,3}\.[0-9]{1,3} --o:ssl.termination=true'
extra_params: '--o:ssl.enable=false --o:net.post_allow.host= --o:net.post_allow.host[0]=::ffff:172.[0-9]+.[0-9]+.[0-9]+'
volumes:
db:
nextcloud:
wsd-00029-00039 2019-03-16 13:53:29.587683 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.17.0.1| wsd/LOOLWSD.cpp:1978 wsd-00029-00039 2019-03-16 13:53:29.627371 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.17.0.1| wsd/LOOLWSD.cpp:1978 wsd-00029-00039 2019-03-16 13:53:29.658028 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.17.0.1| wsd/LOOLWSD.cpp:1978 wsd-00029-00039 2019-03-16 13:53:29.718302 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.17.0.1| wsd/LOOLWSD.cpp:1978 wsd-00029-00039 2019-03-16 13:53:31.450725 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.17.0.1| wsd/LOOLWSD.cpp:1978 wsd-00029-00039 2019-03-16 13:53:31.477725 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.17.0.1| wsd/LOOLWSD.cpp:1978 wsd-00029-00039 2019-03-16 13:53:31.513833 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.17.0.1| wsd/LOOLWSD.cpp:1978 wsd-00029-00039 2019-03-16 13:53:31.715323 [ websrv_poll ] ERR Requesting address is denied: ::ffff:172.17.0.1| wsd/LOOLWSD.cpp:1978
Same issue here! After my latest Coolabora update, document editing stopped working. I rely on IPv6 as my provider does carrier grade NAT so disabling IPV6 is no option. I spent a whole weekend to get this solved without success.
Hopefully there will be a solution soon.
@mhow2 , would you share your configs? I set up Collabora behind an nginx reverse proxy, so that it's connecting over IPv4 over 127.0.0.1 -- and I know I did it right because it was working before I upgraded Collabora just today. I'm not seeing "Requesting address is denied:" but the other symptoms are all the same.
I'm seeing (https://github.com/nextcloud/richdocuments/issues/450#issuecomment-475748347) /hosting/discovery get downloaded, but my browser not try to make any websocket connections as followups. Is /hosting/discovery supposed to provide a websocket endpoint maybe?
I finaly got it working (Partially)
Context : I'm behind my reverse proxy, jwilder's container and the let's encrypt companion.
I'm using this parameters :
--o:ssl.enable=false --o:ssl.termination=true --o:storage.wopi.host=\:\:ffff\:172\.17\.[0-9]{1,3}\.[0-9]{1,3} --o:net.post_allow.host=\:\:ffff\:172\.17\.[0-9]{1,3}\.[0-9]{1,3}
Hope it helps. Good luck.
EDIT : Don't forget to restart collabora/code container once it's built.
EDIT 2: I tried only with this --o:ssl.enable=false --o:ssl.termination=true and some files work, and other files gave me the same error.
EDIT 3 : When I enable the regex again and trying to load the same file, it never loads.
docker run -d --name collabora --restart unless-stopped
-p 9980:9980
-e extra_params='--o:ssl.enable=false --o:net.post_allow.host[0]=::ffff:10.20.30.[0-9]+'
-e username=admin
-e password=your_password
--cap-add MKNOD
collabora/code:4.0.3.1
