Collabora CODE Server on docker fails to load document

[KevinKraze]

Hi there and merry Christmas,

I am having this issue with Collabora. I am currently running it in docker on an RPi 4 with 4 GB of ram. In the nextcloud settings, it says that the CODE server is reachable, however, when I try to open a document, it gives the error:
“Document loading failed
Failed to load nextcloud office - please try again later”

I am running collabora without ssl as it is handled by reverse proxy (haproxy). In the docker logs for the NC container, the only entry I get regarding collabora is this:

[25/Dec/2021:17:21:15 +0000] "GET /apps/richdocuments/index?fileId=6097&requesttoken=tJrUR1qPfKFTV%2FaHtRSnQQs0H15XusDPL%2FXUnjCrsxE%3D%3AjPiNMxHVLvsSD5LggHHCcjNCfT8i1%2FaberOZ7kmcylw%3D&path=%2FNew%20document.docx HTTP/1.1" 200 8551 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"

In the browser logs, I get this error when loading the page:

Mixed Content: The page at 'https://cloud.example.com/apps/files/?dir=/&fileid=6' was loaded over HTTPS, but requested an insecure form action 'http://office.example.com/browser/1e92cc5cf/cool.html?WOPISrc=https%3A%2F%2Fcloud.dwbi.ca%2Findex.php%2Fapps%2Frichdocuments%2Fwopi%2Ffiles%2F6097_oce68x1fko9q&title=New%20document.docx&lang=en&closebutton=1&revisionhistory=1'. This request has been blocked; the content must be served over HTTPS.

Clearly something is going on with the proxy settings within collabora but I have no idea what exactly.

In nextcloud.log i get no information regarding collabora.
Any help appreciated.

System Info:
RPi 4
Ubuntu Server 20.04
Nextcloud 23

[wwe]

this looks like the reason is:

@KevinKraze

http://office.example.com/browser

most likely you configure collabora container with http:// while it must be https:// (make sure both Nextcloud and the client can reach collabora using https:// with valid TLS certificate)

[KevinKraze]

I was able to fix the https error by disabling the “enable” setting and enabling the “termination” setting under the ssl category in coolwsd.xml.

Now however, I am getting a completely different error with WOPi check file info failing:

nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.878007 +0000 [ docbroker_003 ] WRN  Waking up dead poll thread [HttpSynReqPoll], started: false, finished: false| ./net/Socket.hpp:718
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.878468 +0000 [ docbroker_003 ] ERR  Socket #29 SSL error: SYSCALL (5) (EPIPE: Broken pipe)| ./net/SslSocket.hpp:279
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.878624 +0000 [ docbroker_003 ] ERR  Socket #29 SSL error: SYSCALL (5) (EPIPE: Broken pipe)| ./net/SslSocket.hpp:279
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.878682 +0000 [ docbroker_003 ] ERR  #29: Socket read returned -1 (EPIPE: Broken pipe)| ./net/Socket.hpp:1121
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.878760 +0000 [ docbroker_003 ] ERR  Socket #29 SSL error: SYSCALL (5) (EPIPE: Broken pipe)| ./net/SslSocket.hpp:279
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.878828 +0000 [ docbroker_003 ] ERR  Socket #29 SSL error: SYSCALL (5) (EPIPE: Broken pipe)| ./net/SslSocket.hpp:279
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.878929 +0000 [ docbroker_003 ] ERR  #29: Socket write returned -1 (EPIPE: Broken pipe)| ./net/Socket.hpp:1381
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.879010 +0000 [ docbroker_003 ] ERR  Socket #29 SSL error: SYSCALL (5) (EPIPE: Broken pipe)| ./net/SslSocket.hpp:279
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.879087 +0000 [ docbroker_003 ] ERR  Socket #29 SSL error: SYSCALL (5) (EPIPE: Broken pipe)| ./net/SslSocket.hpp:279
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.879141 +0000 [ docbroker_003 ] ERR  #29: Socket write returned -1 (EPIPE: Broken pipe)| ./net/Socket.hpp:1381
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.879360 +0000 [ docbroker_003 ] ERR  WOPI::CheckFileInfo failed for URI [https://cloud.example.com/index.php/apps/richdocuments/wopi/files/6097_oce68x1fko9q?access_token=kqysovLAQyf2amzlp45APXuutqQKAP08&access_token_ttl=0]: 0 . Headers:   Body: []| wsd/Storage.cpp:690
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.879603 +0000 [ docbroker_003 ] ERR  loading document exception: WOPI::CheckFileInfo failed: | wsd/DocumentBroker.cpp:1913
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.879742 +0000 [ docbroker_003 ] ERR  Failed to add session to [/index.php/apps/richdocuments/wopi/files/6097_oce68x1fko9q] with URI [https://cloud.example.com/index.php/apps/richdocuments/wopi/files/6097_oce68x1fko9q?access_token=kqysovLAQyf2amzlp45APXuutqQKAP08&access_token_ttl=0]: WOPI::CheckFileInfo failed: | wsd/DocumentBroker.cpp:1875
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.879844 +0000 [ docbroker_003 ] ERR  Storage error while starting session on /index.php/apps/richdocuments/wopi/files/6097_oce68x1fko9q for socket #20. Terminating connection. Error: WOPI::CheckFileInfo failed: | wsd/COOLWSD.cpp:3690
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.880336 +0000 [ docbroker_003 ] WRN  Ignoring attempted read from 20| ./net/Socket.hpp:1095
nextcloud-collabora | wsd-00001-00056 2021-12-26 21:50:59.880456 +0000 [ docbroker_003 ] ERR  Invalid or unknown session [04d] to remove.| wsd/DocumentBroker.cpp:1956
nextcloud-collabora | wsd-00001-00038 2021-12-26 21:51:00.580317 +0000 [ websrv_poll ] WRN  DocBroker with docKey [/index.php/apps/richdocuments/wopi/files/6097_oce68x1fko9q] that is marked to be destroyed. Rejecting client request.| wsd/COOLWSD.cpp:2277
nextcloud-collabora | wsd-00001-00038 2021-12-26 21:51:00.580685 +0000 [ websrv_poll ] ERR  Error while handling Client WS Request: Failed to create DocBroker with docKey [/index.php/apps/richdocuments/wopi/files/6097_oce68x1fko9q].| wsd/COOLWSD.cpp:3719
nextcloud-collabora | wsd-00001-00038 2021-12-26 21:51:00.580776 +0000 [ websrv_poll ] ERR  #20: Socket write returned -1 (EPIPE: Broken pipe)| ./net/Socket.hpp:1381
nextcloud-collabora | wsd-00001-00038 2021-12-26 21:51:00.580869 +0000 [ websrv_poll ] ERR  #20: Socket write returned -1 (EPIPE: Broken pipe)| ./net/Socket.hpp:1381
nextcloud-collabora | wsd-00001-00038 2021-12-26 21:51:00.580917 +0000 [ websrv_poll ] WRN  Socket #20 is shutting down but 64 bytes couldn't be flushed and still remain in the output buffer.| ./net/WebSocketHandler.hpp:771
nextcloud-collabora | wsd-00001-00038 2021-12-26 21:51:00.580977 +0000 [ websrv_poll ] ERR  #20: attempted to remove: 893 which is > size: 0 clamped to 0| ./net/Socket.hpp:1210
nextcloud-collabora | wsd-00001-00038 2021-12-26 21:51:00.581220 +0000 [ websrv_poll ] WRN  Ignoring attempted read from 20| ./net/Socket.hpp:1095
nextcloud-collabora | wsd-00001-00038 2021-12-26 21:51:00.581282 +0000 [ websrv_poll ] ERR  #20: Socket write returned -1 (EPIPE: Broken pipe)| ./net/Socket.hpp:1381
nextcloud-collabora | kit-00057-00034 2021-12-26 21:51:00.728456 +0000 [ kit_spare_004 ] ERR  mknod(/opt/cool/child-roots/xSXLjv258C6Glhxt//tmp/dev/random) failed. Mount must not use nodev flag. (EPERM: Operation not permitted)| common/JailUtil.cpp:249
nextcloud-collabora | kit-00057-00034 2021-12-26 21:51:00.728657 +0000 [ kit_spare_004 ] ERR  mknod(/opt/cool/child-roots/xSXLjv258C6Glhxt//tmp/dev/urandom) failed. Mount must not use nodev flag. (EPERM: Operation not permitted)| common/JailUtil.cpp:261
nextcloud-collabora | wsd-00001-00033 2021-12-26 21:51:01.880917 +0000 [ prisoner_poll ] WRN  Prisoner connection disconnected but without valid socket.| wsd/COOLWSD.cpp:2364
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.589956 +0000 [ docbroker_004 ] WRN  Waking up dead poll thread [HttpSynReqPoll], started: false, finished: false| ./net/Socket.hpp:718
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.590164 +0000 [ docbroker_004 ] ERR  Socket #29 SSL error: SYSCALL (5) (EPIPE: Broken pipe)| ./net/SslSocket.hpp:279
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.590253 +0000 [ docbroker_004 ] ERR  Socket #29 SSL error: SYSCALL (5) (EPIPE: Broken pipe)| ./net/SslSocket.hpp:279
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.590304 +0000 [ docbroker_004 ] ERR  #29: Socket read returned -1 (EPIPE: Broken pipe)| ./net/Socket.hpp:1121
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.590381 +0000 [ docbroker_004 ] ERR  Socket #29 SSL error: SYSCALL (5) (EPIPE: Broken pipe)| ./net/SslSocket.hpp:279
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.590449 +0000 [ docbroker_004 ] ERR  Socket #29 SSL error: SYSCALL (5) (EPIPE: Broken pipe)| ./net/SslSocket.hpp:279
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.590505 +0000 [ docbroker_004 ] ERR  #29: Socket write returned -1 (EPIPE: Broken pipe)| ./net/Socket.hpp:1381
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.590564 +0000 [ docbroker_004 ] ERR  Socket #29 SSL error: SYSCALL (5) (EPIPE: Broken pipe)| ./net/SslSocket.hpp:279
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.590623 +0000 [ docbroker_004 ] ERR  Socket #29 SSL error: SYSCALL (5) (EPIPE: Broken pipe)| ./net/SslSocket.hpp:279
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.590678 +0000 [ docbroker_004 ] ERR  #29: Socket write returned -1 (EPIPE: Broken pipe)| ./net/Socket.hpp:1381
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.590856 +0000 [ docbroker_004 ] ERR  WOPI::CheckFileInfo failed for URI [https://cloud.example.com/index.php/apps/richdocuments/wopi/files/6097_oce68x1fko9q?access_token=kqysovLAQyf2amzlp45APXuutqQKAP08&access_token_ttl=0&permission=edit]: 0 . Headers:   Body: []| wsd/Storage.cpp:690
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.591101 +0000 [ docbroker_004 ] ERR  loading document exception: WOPI::CheckFileInfo failed: | wsd/DocumentBroker.cpp:1913
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.591220 +0000 [ docbroker_004 ] ERR  Failed to add session to [/index.php/apps/richdocuments/wopi/files/6097_oce68x1fko9q] with URI [https://cloud.example.com/index.php/apps/richdocuments/wopi/files/6097_oce68x1fko9q?access_token=kqysovLAQyf2amzlp45APXuutqQKAP08&access_token_ttl=0&permission=edit]: WOPI::CheckFileInfo failed: | wsd/DocumentBroker.cpp:1875
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.591322 +0000 [ docbroker_004 ] ERR  Storage error while starting session on /index.php/apps/richdocuments/wopi/files/6097_oce68x1fko9q for socket #21. Terminating connection. Error: WOPI::CheckFileInfo failed: | wsd/COOLWSD.cpp:3690
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.591692 +0000 [ docbroker_004 ] WRN  Ignoring attempted read from 21| ./net/Socket.hpp:1095
nextcloud-collabora | wsd-00001-00058 2021-12-26 21:51:02.591786 +0000 [ docbroker_004 ] ERR  Invalid or unknown session [04f] to remove.| wsd/DocumentBroker.cpp:1956
nextcloud-collabora | sh: 1: /usr/bin/coolmount: Operation not permitted
nextcloud-collabora | frk-00034-00034 2021-12-26 21:51:03.745585 +0000 [ forkit ] ERR  Failed to unmount [/opt/cool/child-roots/WP7MJlL7Am0MqSGb/tmp]| common/JailUtil.cpp:70
nextcloud-collabora | sh: 1: /usr/bin/coolmount: Operation not permitted
nextcloud-collabora | frk-00034-00034 2021-12-26 21:51:03.788810 +0000 [ forkit ] ERR  Failed to unmount [/opt/cool/child-roots/WP7MJlL7Am0MqSGb/lo]| common/JailUtil.cpp:70
nextcloud-collabora | sh: 1: /usr/bin/coolmount: Operation not permitted
nextcloud-collabora | frk-00034-00034 2021-12-26 21:51:03.831479 +0000 [ forkit ] ERR  Failed to unmount [/opt/cool/child-roots/WP7MJlL7Am0MqSGb]| common/JailUtil.cpp:70
nextcloud-collabora | wsd-00001-00033 2021-12-26 21:51:04.592147 +0000 [ prisoner_poll ] WRN  Prisoner connection disconnected but without valid socket.| wsd/COOLWSD.cpp:2364
nextcloud-collabora | kit-00065-00034 2021-12-26 21:51:05.117640 +0000 [ kit_spare_005 ] ERR  mknod(/opt/cool/child-roots/vbdFfnCX1QF09m8B//tmp/dev/random) failed. Mount must not use nodev flag. (EPERM: Operation not permitted)| common/JailUtil.cpp:249
nextcloud-collabora | kit-00065-00034 2021-12-26 21:51:05.117820 +0000 [ kit_spare_005 ] ERR  mknod(/opt/cool/child-roots/vbdFfnCX1QF09m8B//tmp/dev/urandom) failed. Mount must not use nodev flag. (EPERM: Operation not permitted)| common/JailUtil.cpp:261
nextcloud-collabora | sh: 1: /usr/bin/coolmount: Operation not permitted
nextcloud-collabora | frk-00034-00034 2021-12-26 21:51:05.329099 +0000 [ forkit ] ERR  Failed to unmount [/opt/cool/child-roots/xSXLjv258C6Glhxt/tmp]| common/JailUtil.cpp:70
nextcloud-collabora | sh: 1: /usr/bin/coolmount: Operation not permitted
nextcloud-collabora | frk-00034-00034 2021-12-26 21:51:05.371662 +0000 [ forkit ] ERR  Failed to unmount [/opt/cool/child-roots/xSXLjv258C6Glhxt/lo]| common/JailUtil.cpp:70
nextcloud-collabora | sh: 1: /usr/bin/coolmount: Operation not permitted
nextcloud-collabora | frk-00034-00034 2021-12-26 21:51:05.414203 +0000 [ forkit ] ERR  Failed to unmount [/opt/cool/child-roots/xSXLjv258C6Glhxt]| common/JailUtil.cpp:

[wwe]

I assume you still have some issues in tern which component communicates how with others. My setup looks like this:

• each URL is https
• TLS termination is done at reverse proxy, communication behind reverse proxy is plain http
• connections between Nextcloud and Collabora container flow through reverse proxy (because direct connection has no TLS)

Maybe there are other way to setup but you should keep in mind how the access works:

• once the the client access a a file and wants to edit is using Collabora
• Nextcloud generates URL and access token for this file and passes it to the client (simplified: https:/collaboraurl?openfile=https://nextcloudurl/file=xyz&token=secret)
• Collabora in turn access the file on https://nextcloudurl/file=xyz remotely and provides editing features

this is why each component must be reachable using valid public URL (with https) in detail: client must reach both NC and Collabora, Collabora must reach NC and NC must reach Collabora. In my eyes the easiest way is to have only one entry point (reverse proxy) where you can do TLS handling and avoid complexity of TLS behind the RP which adds a challenge that internal communications between Nextcloud and Collabora must flow through RP as well.

take a look at the docker config here:

Docker Compose for Nextcloud + Collabora + Traefik?

I have such setup running 1,5y and survived 2 major updates and hardware move without issues, the setup is stable. maybe this is the least problematic advanced feature of NC… (works much more stable than talk+coturn). as I don’t use Collabora often first start takes multiple seconds but then it works good on old i3 desktop… The only big problem I experienced was Collabora outage for multiple weeks caused by Collabora until I discovered the solution in Collabora forums (Collabora+SNI). The prob…

[KevinKraze]

I was able to fix it! I realized that in my /etc/hosts file, I set 127.0.0.1 as my nextcloud domain while trying to fix one of my previous errors. So, when collabora was trying to connect to the nextcloud domain, it would connect to 127.0.0.1:443. Commenting that out fixed the problem!