Collabora online and Nextcloud behind Nginx reverse proxy

After browsing this forum for 2 days and not finding any solution for my issue, I’ve decided to open a new thread.

My setup is extremely standard: a reverse proxy (Nginx) with SSL termination, serving 2 domains matching 2 different servers in the backend :

  • nextcloud.example.com accepts HTTPS traffic and passes requests to HTTP on nextcloud-app
  • collabora.example.com accepts HTTPS traffic and passes requests to HTTP on collabora-app

I’ve installed the Collabora Online App and configured it. I’ve also configured /etc/loolwsd/loolwsd.xml on collabora-app. Everything checks out, and I can access the admin console fine.
Nextcloud works also fine.

Now here comes the wall: I can open (and save) a newly created document in the collabora app within Nextcloud, but I cannot reopen any documents.

I’ve run out of ideas, and couldn’t find any similar ‘symptoms’ on the forum.

Below is typically what I get every time I try to reopen a file:

May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.222269 [ docbroker_004 ] INF  Public URI [https://nextcloud.example.com/index.php/apps/richdocuments/wopi/files/260161_ocnd35017f0k?access_token=vNIn6VwDsFdLtcEELG1zVC13sGLhd3C2&access_token_ttl=0] considered WOPI.| wsd/Storage.cpp:274
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.222514 [ docbroker_004 ] INF  WopiStorage ctor with localStorePath: [/opt/lool/child-roots/VHnvsOHZpzZePWNT], jailPath: [/tmp/user/docs/VHnvsOHZpzZePWNT], uri: [https://nextcloud.example.com/index.php/apps/richdocuments/wopi/files/260161_ocnd35017f0k?access_token=vNIn6VwDsFdLtcEELG1zVC13sGLhd3C2&access_token_ttl=0], reuseCookies: [false].| wsd/Storage.hpp:382
May 06 15:42:33 collabora-app loolwsd[23954]: frk-23961-23961 2021-05-06 13:42:33.223778 [ kit_spare_005 ] INF  Thread 23961 (7f07ab79c7c0) of process 24043 formerly known as [forkit] is now called [kit_spare_005].| common/Util.cpp:589
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.224566 [ kit_spare_005 ] INF  Initializing kit. Local time: Thu 2021-05-06 15:42:33+0200. Log level is [6].| common/Log.cpp:325
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.224763 [ kit_spare_005 ] INF  User-data anonymization is disabled.| kit/Kit.cpp:2218
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.224953 [ kit_spare_005 ] INF  Jail path: /opt/lool/child-roots/OFi39MG6lfhzhtEw/| kit/Kit.cpp:2243
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.225230 [ kit_spare_005 ] INF  Mounting /opt/lool/systemplate -> /opt/lool/child-roots/OFi39MG6lfhzhtEw/| kit/Kit.cpp:2263
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.236614 [ kit_spare_005 ] INF  Mounting /opt/collaboraoffice6.4 -> /opt/lool/child-roots/OFi39MG6lfhzhtEw/lo/| kit/Kit.cpp:2273
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.245444 [ kit_spare_005 ] INF  Mounting random temp dir /opt/lool/child-roots/tmp/lool-yc6khdD7Ds4ftU4a -> /opt/lool/child-roots/OFi39MG6lfhzhtEw/tmp| kit/Kit.cpp:2288
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.250034 [ kit_spare_005 ] INF  chroot("/opt/lool/child-roots/OFi39MG6lfhzhtEw/")| kit/Kit.cpp:2356
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.251102 [ kit_spare_005 ] INF  RLIMIT_AS is 16777216.0 TiB (18446744073709551615 bytes)| kit/Kit.cpp:2435
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.251135 [ kit_spare_005 ] INF  RLIMIT_STACK is 7.8 MiB (8192000 bytes)| kit/Kit.cpp:2440
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.251145 [ kit_spare_005 ] INF  RLIMIT_FSIZE is 16777216.0 TiB (18446744073709551615 bytes)| kit/Kit.cpp:2445
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.251155 [ kit_spare_005 ] INF  RLIMIT_NOFILE is 1048576 files.| kit/Kit.cpp:2450
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.251161 [ kit_spare_005 ] INF  Process is ready.| kit/Kit.cpp:2454
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-23960 2021-05-06 13:42:33.251736 [ prisoner_poll ] INF  #23: Prisoner HTTP Request: GET /loolws/newchild?jailid=OFi39MG6lfhzhtEw HTTP/1.1 / Connection: Upgrade / User-Foo: Adminbits / Sec-WebSocket-Key: fxTaWTEMVhq1PkWsMoLxGw== / Upgrade: websocket / Accept-Language: en / Cache-Control: no-cache / Pragma: no-cache / Sec-WebSocket-Version: 13 / User-Agent: LOOLWSD WOPI Agent 6.4.8| net/Socket.cpp:861
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-23960 2021-05-06 13:42:33.251760 [ prisoner_poll ] INF  New child [24043], jailId: OFi39MG6lfhzhtEw.| wsd/LOOLWSD.cpp:2219
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-23960 2021-05-06 13:42:33.251768 [ prisoner_poll ] INF  #23: WebSocket version: 13, key: [fxTaWTEMVhq1PkWsMoLxGw==], protocol: [chat].| ./net/WebSocketHandler.hpp:723
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-23960 2021-05-06 13:42:33.251782 [ prisoner_poll ] INF  ChildProcess ctor [24043].| wsd/LOOLWSD.hpp:57
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-23960 2021-05-06 13:42:33.251790 [ prisoner_poll ] INF  Have 1 spare child after adding [24043].| wsd/LOOLWSD.cpp:479
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.252200 [ kit_spare_005 ] INF  New kit client websocket inserted.| kit/Kit.cpp:2530
May 06 15:42:33 collabora-app loolwsd[23954]: kit-24043-23961 2021-05-06 13:42:33.252216 [ kit_spare_005 ] INF  Kit unipoll loop run| kit/Kit.cpp:2548
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.253594 [ docbroker_004 ] INF  Missing JSON property [TemplateSaveAs] will default to [].| ./common/JsonUtil.hpp:133
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.253627 [ docbroker_004 ] INF  Missing JSON property [TemplateSource] will default to [].| ./common/JsonUtil.hpp:133
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.253683 [ docbroker_004 ] INF  Missing JSON property [WatermarkText] will default to [].| ./common/JsonUtil.hpp:133
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.253738 [ docbroker_004 ] INF  Missing JSON property [HideSaveOption] will default to [false].| ./common/JsonUtil.hpp:133
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.253769 [ docbroker_004 ] INF  Missing JSON property [EnableOwnerTermination] will default to [false].| ./common/JsonUtil.hpp:133
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.253793 [ docbroker_004 ] INF  Missing JSON property [DisableInactiveMessages] will default to [false].| ./common/JsonUtil.hpp:133
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.253811 [ docbroker_004 ] INF  Missing JSON property [SupportsLocks] will default to [false].| ./common/JsonUtil.hpp:133
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.253818 [ docbroker_004 ] INF  Missing JSON property [BreadcrumbDocName] will default to [].| ./common/JsonUtil.hpp:133
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.253823 [ docbroker_004 ] INF  Missing JSON property [FileUrl] will default to [].| ./common/JsonUtil.hpp:133
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.253829 [ docbroker_004 ] INF  Missing JSON property [DisableChangeTrackingRecord] will default to [false].| ./common/JsonUtil.hpp:133
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.253835 [ docbroker_004 ] INF  Missing JSON property [DisableChangeTrackingShow] will default to [false].| ./common/JsonUtil.hpp:133
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.253840 [ docbroker_004 ] INF  Missing JSON property [HideChangeTrackingControls] will default to [false].| ./common/JsonUtil.hpp:133
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.253902 [ docbroker_004 ] INF  WOPI::GetFile using default URI: https://nextcloud.example.com/index.php/apps/richdocuments/wopi/files/260161_ocnd35017f0k/contents?access_token=vNIn6VwDsFdLtcEELG1zVC13sGLhd3C2&access_token_ttl=0| wsd/Storage.cpp:951
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.288337 [ docbroker_004 ] ERR  WOPI::GetFile [https://nextcloud.example.com/index.php/apps/richdocuments/wopi/files/260161_ocnd35017f0k/contents?access_token=vNIn6VwDsFdLtcEELG1zVC13sGLhd3C2&access_token_ttl=0] failed with Status Code: 500| wsd/Storage.cpp:1005
May 06 15:42:33 collabora-app loolwsd[23954]: wsd-23954-24042 2021-05-06 13:42:33.288470 [ docbroker_004 ] ERR  Cannot download document from WOPI storage uri [https://nextcloud.example.com/index.php/apps/richdocuments/wopi/files/260161_ocnd35017f0k/contents?access_token=vNIn6VwDsFdLtcEELG1zVC13sGLhd3C2&access_token_ttl=0]. Error: WOPI::GetFile [https://nextcloud.example.com/index.php/apps/richdocuments/wopi/files/260161_ocnd35017f0k/contents?access_token=vNIn6VwDsFdLtcEELG1zVC13sGLhd3C2&access_token_ttl=0] failed: <!DOCTYPE html>
May 06 15:42:33 collabora-app loolwsd[23954]: <html class="ng-csp" data-placeholder-focus="false" lang="en" data-locale="en" >
May 06 15:42:33 collabora-app loolwsd[23954]:         <head
May 06 15:42:33 collabora-app loolwsd[23954]:  data-requesttoken="">
May 06 15:42:33 collabora-app loolwsd[23954]:                 <meta charset="utf-8">
May 06 15:42:33 collabora-app loolwsd[23954]:                 <title>
May 06 15:42:33 collabora-app loolwsd[23954]:                 Example Cloud                </title>
May 06 15:42:33 collabora-app loolwsd[23954]:                 <meta http-equiv="X-UA-Compatible" content="IE=edge">

The last part is the 500 HTTP page that Nextcloud returns to collabora-app.

This was all due to option quota_include_external_storage which was set to true.

Running:

occ config:system:set quota_include_external_storage --value=false --type=boolean

Everything works now.