Collabora not working on Ubuntu 16.04 with NGINX

I am currently trying to get Collabora working with my Nextcloud installation, but I am running into some problems.

I installed the official CODE package for Ubuntu 16.04 and added the following to my NGINX ssl vhost:

    # static files
            location ^~ /loleaflet {
            proxy_pass https://localhost:9980;
            proxy_set_header Host $http_host;
    }

    # WOPI discovery URL
            location ^~ /hosting/discovery {
            proxy_pass https://localhost:9980;
            proxy_set_header Host $http_host;
    }

    # main websocket
            location ~ ^/lool/(.*)/ws$ {
            proxy_pass https://localhost:9980;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_set_header Host $http_host;
            proxy_read_timeout 36000s;
    }

    # download, presentation and image upload
            location ~ ^/lool {
            proxy_pass https://localhost:9980;
            proxy_set_header Host $http_host;
    }

    # Admin Console websocket
            location ^~ /lool/adminws {
            proxy_pass https://localhost:9980;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_set_header Host $http_host;
            proxy_read_timeout 36000s;
    }

After that I installed the Collabora app in Nextcloud and entered the WOPI URL in the settings.
However, when I try to open a document inside Nextcloud, I only get an internal server error message.
NGINX log shows:

2018/02/04 11:23:04 [error] 370#370: *40 connect() failed (111: Connection refused) while connecting to upstream, client: XXX.XXX.XXX.XXX, server: foo.bar, request: "GET /hosting/discovery HTTP/1.1", upstream: "https://127.0.0.1:9980/hosting/discovery", host: "foo.bar"
2018/02/04 11:23:04 [warn] 370#370: *40 upstream server temporarily disabled while connecting to upstream, client: XXX.XXX.XXX.XXX, server: foo.bar, request: "GET /hosting/discovery HTTP/1.1", upstream: "https://127.0.0.1:9980/hosting/discovery", host: "foo.bar"
2018/02/04 11:23:04 [error] 370#370: *40 connect() failed (111: Connection refused) while connecting to upstream, client: XXX.XXX.XXX.XXX, server: foo.bar, request: "GET /hosting/discovery HTTP/1.1", upstream: "https://[::1]:9980/hosting/discovery", host: "foo.bar"
2018/02/04 11:23:04 [warn] 370#370: *40 upstream server temporarily disabled while connecting to upstream, client: XXX.XXX.XXX.XXX, server: foo.bar, request: "GET /hosting/discovery HTTP/1.1", upstream: "https://[::1]:9980/hosting/discovery", host: "foo.bar"

So I suppose it’s a problem with my webserver.
I’ve also created /var/log/loolwsd.log and changed it’s owner to lool but no log is written there.

systemctl status loolwsd also gives some errors, but I don’t know wether they have anything to do with my problem:

loolwsd[718]: kit-00722-00720 10:35:25.916286 [ loolkit ] ERR  Failed to install seccomp syscall filter| common/Seccomp.cpp:205
loolwsd[718]: kit-00722-00720 10:35:25.916341 [ loolkit ] ERR  LibreOfficeKit security lockdown failed. Exiting.| kit/Kit.cpp:2082

Maybe it’s pretty obvious but can’t seem to find what I’m doing wrong.

Thanks in advance for any advice!

I just had a look at my Nextcloud log and saw this error:

GuzzleHttp\Exception\ServerException: Server error response [url] https://foo.bar/hosting/discovery [status code] 502 [reason phrase] Bad Gateway

    /var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Subscriber/HttpError.php - line 32: GuzzleHttp\Exception\RequestException create(Object(GuzzleHttp\Message\Request), Object(GuzzleHttp\Message\Response))
    /var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Event/Emitter.php - line 108: GuzzleHttp\Subscriber\HttpError->onComplete(Object(GuzzleHttp\Event\CompleteEvent), 'complete')
    /var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/RequestFsm.php - line 91: GuzzleHttp\Event\Emitter->emit('complete', Object(GuzzleHttp\Event\CompleteEvent))
    /var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/RequestFsm.php - line 132: GuzzleHttp\RequestFsm->__invoke(Object(GuzzleHttp\Transaction))
    /var/www/nextcloud/3rdparty/react/promise/src/FulfilledPromise.php - line 25: GuzzleHttp\RequestFsm->GuzzleHttp\{closure}(*** sensitive parameters replaced ***)
    /var/www/nextcloud/3rdparty/guzzlehttp/ringphp/src/Future/CompletedFutureValue.php - line 55: React\Promise\FulfilledPromise->then(Object(Closure), NULL, NULL)
    /var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Message/FutureResponse.php - line 43: GuzzleHttp\Ring\Future\CompletedFutureValue->then(Object(Closure), NULL, NULL)
    /var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/RequestFsm.php - line 134: GuzzleHttp\Message\FutureResponse proxy(Object(GuzzleHttp\Ring\Future\CompletedFutureArray), Object(Closure))
    /var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php - line 165: GuzzleHttp\RequestFsm->__invoke(Object(GuzzleHttp\Transaction))
    /var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php - line 125: GuzzleHttp\Client->send(Object(GuzzleHttp\Message\Request))
    /var/www/nextcloud/lib/private/Http/Client/Client.php - line 138: GuzzleHttp\Client->get('https //foo.bar...', Array)
    /var/www/nextcloud/apps/richdocuments/lib/WOPI/DiscoveryManager.php - line 84: OC\Http\Client\Client->get('https //foo.bar...')
    /var/www/nextcloud/apps/richdocuments/lib/WOPI/Parser.php - line 41: OCA\Richdocuments\WOPI\DiscoveryManager->get()
    /var/www/nextcloud/apps/richdocuments/lib/TokenManager.php - line 122: OCA\Richdocuments\WOPI\Parser->getUrlSrc('application/vnd...')
    /var/www/nextcloud/apps/richdocuments/lib/Controller/DocumentController.php - line 168: OCA\Richdocuments\TokenManager->getToken(*** sensitive parameters replaced ***)
    [internal function] OCA\Richdocuments\Controller\DocumentController->index('1237')
    /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php - line 160: call_user_func_array(Array, Array)
    /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php - line 90: OC\AppFramework\Http\Dispatcher->executeController(Object(OCA\Richdocuments\Controller\DocumentController), 'index')
    /var/www/nextcloud/lib/private/AppFramework/App.php - line 114: OC\AppFramework\Http\Dispatcher->dispatch(Object(OCA\Richdocuments\Controller\DocumentController), 'index')
    /var/www/nextcloud/lib/private/AppFramework/Routing/RouteActionHandler.php - line 47: OC\AppFramework\App main('OCA\\Richdocumen...', 'index', Object(OC\AppFramework\DependencyInjection\DIContainer), Array)
    [internal function] OC\AppFramework\Routing\RouteActionHandler->__invoke(Array)
    /var/www/nextcloud/lib/private/Route/Router.php - line 299: call_user_func(Object(OC\AppFramework\Routing\RouteActionHandler), Array)
    /var/www/nextcloud/lib/base.php - line 1004: OC\Route\Router->match('/apps/richdocum...')
    /var/www/nextcloud/index.php - line 48: OC handleRequest()
    {main}

Does anyone know how to solve this problem?
I would really like to get this working.

Can you access Collabora via web page?
https://[SERVER-IP]:9980

Or if you have a domain name for your Collabora server, please try that.
Do you see some web page telling you that Collabora is running?

No, doesn’t work.

Okay, as long as Collabora is not running, don’t care about the integration with Nextcloud. Try to get Collabora running and then integrating it with Nextcloud will be easier.

So while it’s an Collabora issue, you might want to ask in the Collabora forum. They should be the experts there.
Or you can provide some more details about your setup, how you tried to install it. Your configs would be essential, too. Don’t forget to remove any sensitive data from the configs (replace them by ***removed*** for example).

I installed the official native package for Ubuntu 16.04 (since my vServer doesn’t allow me to run Docker) as stated on https://www.collaboraoffice.com/code/.

Here’s my loolwsd.xml:

<config>

    <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. -->
    <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. -->

    <allowed_languages desc="List of supported languages on this instance." default="de_DE en_GB en_US es_ES fr_FR it pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it pt_BR pt_PT ru</allowed_languages>

    <tile_cache_path desc="Path to a directory where to keep the tile cache." type="path" relative="false" default="/var/cache/loolwsd"></tile_cache_path>
    <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path>
    <lo_template_path desc="Path to a LibreOffice installation tree to be copied (linked) into the jails for child processes. Should be on the same file system as systemplate." type="path" relative="false" default="/opt/collaboraoffice5.3"></lo_template_path>
    <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path>

    <server_name desc="Hostname:port of the server running loolwsd. If empty, it's derived from the request." type="string" default=""></server_name>
    <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path>

    <memproportion desc="The maximum percentage of system memory consumed by all of the LibreOffice Online, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion>
    <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children>
    <per_document desc="Document-specific settings, including LO Core settings.">
        <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency>
        <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs>
        <!-- Idle save and auto save are checked every 30 seconds -->
        <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="uint" default="30">30</idlesave_duration_secs>
        <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="uint" default="300">300</autosave_duration_secs>
        <limit_virt_mem_kb desc="The maximum virtual memory allowed to each document process. 0 for unlimited, 1700 min." type="uint">0</limit_virt_mem_kb>
        <limit_data_mem_kb desc="The maximum memory data segment allowed to each document process. 0 for unlimited." type="uint">0</limit_data_mem_kb>
        <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb>
        <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb>
        <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files>
    </per_document>

    <per_view desc="View-specific settings.">
        <out_of_focus_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 60 seconds." type="uint" default="60">60</out_of_focus_timeout_secs>
        <idle_timeout_secs desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint" default="900">900</idle_timeout_secs>
    </per_view>

    <loleaflet_html desc="Allows UI customization by replacing the single endpoint of loleaflet.html" type="string" default="loleaflet.html">loleaflet.html</loleaflet_html>

    <logging>
        <color type="bool">true</color>
        <level type="string" desc="Can be 0-8, or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level>
        <file enable="false">
            <property name="path" desc="Log file path.">/var/log/loolwsd.log</property>
            <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property>
            <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property>
            <property name="compress" desc="Enable/disable log file compression.">true</property>
            <property name="purgeAge" desc="The maximum age of log files to preserve. See Poco FileChannel.">10 days</property>
            <property name="purgeCount" desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel.">10</property>
            <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property>
            <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property>
        </file>
    </logging>

    <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging>

    <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="true">
        <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting." compress="true" snapshot="false">/tmp/looltrace-%.gz</path>
        <filter>
            <message desc="Regex pattern of messages to exclude"></message>
        </filter>
        <outgoing>
            <record desc="Whether or not to record outgoing messages" default="false">false</record>
        </outgoing>
    </trace>

    <net desc="Network settings">
      <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto>
    </net>

    <ssl desc="SSL settings">
        <enable type="bool" default="true">true</enable>
        <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>
        <cert_file_path desc="Path to the cert file" relative="false">/etc/letsencrypt/live/foo.bar/fullchain.pem</cert_file_path>
        <key_file_path desc="Path to the key file" relative="false">/etc/letsencrypt/live/foo.bar/privkey.pem</key_file_path>
        <ca_file_path desc="Path to the ca file" relative="false">/etc/letsencrypt/live/foo.bar/cert.pem</ca_file_path>
        <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH">"ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK"</cipher_list>
        <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false">
            <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age>
            <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri>
            <pins desc="Base64 encoded SPKI fingerprints of keys to be pinned">
            <pin></pin>
            </pins>
        </hpkp>
    </ssl>

    <storage desc="Backend storage">
        <filesystem allow="false" />
        <wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true">
            <host desc="Regex pattern of hostname to allow or deny." allow="true">localhost</host>
            <host desc="Regex pattern of hostname to allow or deny." allow="true">10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
            <host desc="Regex pattern of hostname to allow or deny." allow="true">172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
            <host desc="Regex pattern of hostname to allow or deny." allow="true">172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
            <host desc="Regex pattern of hostname to allow or deny." allow="true">172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
            <host desc="Regex pattern of hostname to allow or deny." allow="true">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
            <host desc="Regex pattern of hostname to allow or deny." allow="false">192\.168\.1\.1</host>
            <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size>
        </wopi>
        <webdav desc="Allow/deny webdav storage. Mutually exclusive with wopi." allow="false">
            <host desc="Hostname to allow" allow="false">localhost</host>
        </webdav>
    </storage>

    <tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent>

    <admin_console desc="Web admin console settings.">
        <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="true">true</enable_pam>
        <username desc="The username of the admin console. Must be set, if PAM is not enabled, otherwise it's optional.">`david`</username>
        <password desc="The password of the admin console. Deprecated on most platforms. Instead, use loolconfig to set up a secure password.">`loolwsd128`</password>
    </admin_console>

</config>

I’m afraid there seems to be no dedicated Collabora Forum.

check if the certificates are really accessible… ownership…

to have it working from your nextcloud you need to add an allowed host like:
<host desc="Regex pattern of hostname to allow or deny." allow="true">sub\.domain\.com</host>
(somewhere round line 95)

Certificates are all on 755, so they should be accessible.
I added the right host line to my config, sadly it still doesn’t work.