Configuring Collabora Online with AIO properly

[wwe]

hi @florian.l welcome to the forum

@florian.l

The “URL used by the browser” makes sense to me, the second one makes me think I found my problem: if Collabora is requesting documents from Nextcloud through the public reverse proxy it will indeed due that via my public IP. But actually, it would not need to go that way because the Collabora container is running right next to the Nextcloud one?

this is exactly how the WOPI protocol works. Connections always use public FQDN which usually results in going through the public internet as long there are no special measules like splitbraindns (101: Split-Brain DNS (split-horizon)) are in place.

see Collabora integration guide for details about the WOPI protocol

@florian.l

The text aside the allowlist field suggests that it’s insecure to allow requests from everywhere. But is that actually the case? After doing some searches, I am under the impression that these WOPI requests towards Nextcloud contain some token - so allowing all IPs to make requests wouldn’t actually be a problem because an attacker couldn’t provide a valid token?

yes the connection is secured with a token. limiting network ranges adds additional security layer which might or not be required for your specific installation.

@florian.l

Can I configure Collabora to make its WOPI requests to the local container IP of Nextcloud instead of going the long way through the reverse proxy without messing with AIO?

review splitbraindns article above.