Issue installing Collabora following official guide

šŸš§ Installation
101

@hans: If you installed CODE by docker container on a linux environment you must get the self signed certificate generated inside the docker:

  1. check what is your docker id ( inside the list you should find the collabora/code)
    sudo docker ps

  2. run a bash in your docker ( I guess other methods are possible but this should do)
    sudo docker exec -i -t /bin/bash

  3. You can find the key here:
    cat /etc/loolwsd/ca-chain.cert.pem file

then copy this key using a safe method on your nextcloud and add it at the very end of the nextcloud trusted keys file:
for ubuntu-like: /var/www//resources/config/ca-bundle.crt

@rolandixor: I had the same issue than you, I forgot the part where I had to redirect all the ressources on the environment where the CODE docker is deployed
Double check your nginx/apache settings,
for apache: in your /etc/apache2/sites-enabled your -ssl.conf should contain:

WOPI discovery URL

    ProxyPass           /hosting/discovery https://localhost:9980/hosting/discovery
    ProxyPassReverse    /hosting/discovery https://localhost:9980/hosting/discovery

Donā€™t forget to enable the conf with a2ensite and service apache restart

Hope this helps

102

@remidebette

I am having the same issue with the certificate error. I have although copied the correct CA as per your instructions already but still perl error 60 for certificate.

I am hosting the environment on a seperate box , so seperate box for nextcloud and seperate for docket collabora online
/hosting/disovery works , I can open the lool plugin manually defined within the xml but from the app its error

103

I remain stumped. Unless I am missing somethingā€¦ this didnā€™t make any difference (adding the localhost entries you mentioned and enabling with a2ensite).

Is there something more to the first part of your reply? ā€œredirect all the ressources on the environment where the CODE docker is deployedā€

Or do you just mean what you mentioned in the second part of your reply?

104

Are you on digitalocean by any chance and did you try this path?

105

I just followed the instructions previously mentioned: Nextcloud Office - Self-hosted online office suite
Their full

  1. Install the Apache reverse proxy

worked fine for me (after merging them with my own Letsencrypt SSL conf).
At some point I had the 404 error on /hosting/discovery because I forgot the mentioned lines.

Make sure you have thoroughly followed all the steps.
I am not expert enough in apache to troubleshoot specific errors. Any chance with the logs?

106

To add some input on this, I am now also stuck with the

ClientRequestHandler::handleRequest: BadRequestException: Invalid URI or access denied.

The reasons advanced here in this topic for this issue seem to be that separating the nextcloud and CODE environments to different subdomains through apache reverse proxying blocks some information transmission (socket?) between the two. A local build of CODE seems to work fine.

(The following does not work, this is just for the sake of the discussion)
I actually donā€™t like the idea to expose the whole CODE only for this purpose when I could directly contact the docker on the local network. Furthermore using this self-signed certificate system.

This said, fully deploying on local causes issues: Problem with Collabora Online nginx setup - #17 by lukas
For my test purpose I have deployed everything on my local but the way docker handles the ā€œ-p 127.0.0.1:9980:9980ā€ seems to mess up with the https communication with nextcloud/owncloud if you configure the CODE address at ā€œhttps://localhost:9980ā€

A solution I could think about is to use dsndock (https://github.com/tonistiigi/dnsdock)
This allows you to consider all your dockers as machines in your domain with names in your dns.
After succesfully doing this I changed all my ā€œhttps://localhost:9980ā€ to ā€œhttps://code.docker:9980ā€ (default configuration)
The apache reverse proxy way still gives the same error.
Now if I try ā€œhttps://code.docker:9980ā€ for CODE address in nextcloud itself I have the wonderful:

Collabora Online unknown error: cURL error 51: SSL: certificate subject name ā€˜localhostā€™ does not match target host name ā€˜code.dockerā€™

The Self-signed certificate provided in the docker seems unsafe to me and is even blocking in my case.
Any idea how to work around this?

107

Iā€™ll have to try merging with my letsencrypt SSL configuration and digging through the logs - but that wonā€™t be able to happen too soon (full day).

I wish the setup was bit more straightforward.

108

@rolandixor:
FYI Here is what my <domain>-le-ssl.conf looks like after Letsencrypt + CODE: https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-16-04

(if you do it, please replace the code.docker by localhosts in the ProxyPasses)
(But remember that eventually after that, there is still this BadRequestException error happening)

<IfModule mod_ssl.c>
<VirtualHost *:443>
        # The ServerName directive sets the request scheme, hostname and port that
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request's Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.
        #ServerName www.example.com

        ServerAdmin <admin-mail>
        ServerName <domain>
        ServerAlias <subdomain>
        DocumentRoot /var/www/<domain>/public_html

        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf

        # Encoded slashes need to be allowed
        AllowEncodedSlashes On

        # Container uses a unique non-signed certificate
        SSLProxyEngine On
        SSLProxyVerify None
        SSLProxyCheckPeerCN Off
        SSLProxyCheckPeerName Off

        # keep the host
        ProxyPreserveHost On

        # static html, js, images, etc. served from loolwsd
        # loleaflet is the client part of LibreOffice Online
        ProxyPass           /loleaflet https://code.docker:9980/loleaflet retry=0
        ProxyPassReverse    /loleaflet https://code.docker:9980/loleaflet

        # WOPI discovery URL
        ProxyPass           /hosting/discovery https://code.docker:9980/hosting/discovery retry=0
        ProxyPassReverse    /hosting/discovery https://code.docker:9980/hosting/discovery

        # Main websocket
        ProxyPass   /lool/ws      wss://code.docker:9980/lool/ws

        # Admin Console websocket
        ProxyPass   /lool/adminws wss://code.docker:9980/lool/adminws

        # Download as, Fullscreen presentation and Image upload operations
        ProxyPass           /lool https://code.docker:9980/lool
        ProxyPassReverse    /lool https://code.docker:9980/lool

SSLCertificateFile /etc/letsencrypt/live/<domain>/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/<domain>/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
</IfModule>
109

No I have everything entirely self hosted. Iā€™ve almost got everything working correctly. Iā€™m just coming across a few really weird issues. Collabora is able to open some documents. All types, ODF, DOC, DOCX, XLS, etcā€¦ but it seems to decide all on its own to just stop working again. Itā€™s totally random.

110

Thatā€™s the only thing I didnā€™t have before. Still getting a 404 error, nothing in the logs seems to indicate any issue.
Still getting a 404ā€¦ https://office.sptmin.com/hosting/discovery

Does anyone have any idea what to do? (something that will actually work :slight_smile:)ā€¦

111 
<VirtualHost *:443>
  Include /etc/letsencrypt/options-ssl-apache.conf
  ServerName office.sptmin.com:443

  # SSL configuration, you may want to take the easy route instead and use Lets Encrypt!
  SSLEngine on
  SSLCertificateFile /etc/letsencrypt/live/office.sptmin.com/cert.pem
  SSLCertificateChainFile /etc/letsencrypt/live/office.sptmin.com/chain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/office.sptmin.com/privkey.pem
  SSLProtocol             all -SSLv2 -SSLv3
  SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
  SSLHonorCipherOrder     on

  # Encoded slashes need to be allowed
  AllowEncodedSlashes On

  # Container uses a unique non-signed certificate
  SSLProxyEngine On
  SSLProxyVerify None
  SSLProxyCheckPeerCN Off
  SSLProxyCheckPeerName Off

  # keep the host
  ProxyPreserveHost On

  # static html, js, images, etc. served from loolwsd
  # loleaflet is the client part of LibreOffice Online
  ProxyPass           /loleaflet https://127.0.0.1:9980/loleaflet retry=0
  ProxyPassReverse    /loleaflet https://127.0.0.1:9980/loleaflet

  # WOPI discovery URL
  ProxyPass           /hosting/discovery https://127.0.0.1:9980/hosting/discovery retry=0
  ProxyPassReverse    /hosting/discovery https://127.0.0.1:9980/hosting/discovery
  ProxyPass           /hosting/discovery https://localhost:9980/hosting/discovery
  ProxyPassReverse    /hosting/discovery https://localhost:9980/hosting/discovery

  # Main websocket
  ProxyPass   /lool/ws      wss://127.0.0.1:9980/lool/ws

  # Admin Console websocket
  ProxyPass   /lool/adminws wss://127.0.0.1:9980/lool/adminws

  # Download as, Fullscreen presentation and Image upload operations
  ProxyPass           /lool https://127.0.0.1:9980/lool
  ProxyPassReverse    /lool https://127.0.0.1:9980/lool
</VirtualHost>

Tell me if I missed anythingā€¦ (Iā€™m beginning to feel like this is a well crafted practical joke).

112

Installed both NC 9.0.53 and NC 10beta following the instructions and tried to get Collabora working - to no avail.
I followed instructions for Collabora exactly: fired up the docker image (on a different host, but adjusted the docker commandline accordingly), configured Apache to proxy to the different host and had NC save the domain for the Collabora host.
Now, when I open the Office App in NC it displays the available ODT files as really large icons. Once I click one of them I get the rotating circle - but thatā€™s it :frowning: No content, no buttons I could push, ā€¦ - plain nothing :unamused: After a while the rotating circle vanishes, then I just have the NC bar at the top and a grey screen otherwise :angry:

How can I find out what the problem is?

113

Anyone has experience in setting this up with different SSL Port? Nextcloud and collaboraonline have the same portnumber.

Do I have to escape the :portnumber in step 1?

Still having [post 98] (Issue installing Collabora following official guide) errors.

114

Hi.
I have my Nextcloud installed on a local server and it is and will be only available in local network, therefore I donā€™t have a domain name and I canā€™t get SSL certificate. Is this somehow possible to install Collabora with that configuration?

115

Has anybody the problem that the top left menu doesnā€™t show when using Collabora?

116

Hello, I followed the official install guide as far as possible, but now Iā€™m facing the following issue when trying to open a document:
ā€œWe are sorry, this is an unexpected connection error. Please try again.ā€

Here an error I found in the docker container while running:
# docker logs 01ace1d79076

kit-00071-00 00:00:38.006606 [ loolkit ] Process started.
kit-00071-00 00:00:38.006707 [ loolkit ] Jail path: /opt/lool/child-roots/71/
kit-00071-00 00:00:38.006973 [ loolkit ] symlink("../lo","/opt/lool/child-roots/71/opt/collaboraoffice5.1")
kit-00071-00 00:00:38.052013 [ loolkit ] link("/opt/collaboraoffice5.1/program/libCbcSolver.so.3","/opt/lool/child-roots/71/lo/program/libCbcSolver.so.3") failed. Exiting. (errno: Operation not permitted)
frk-00031-00 00:00:39.007313 [ loolforkit ] Child 71 has exited, removing its jail '/opt/lool/child-roots/71'

Iā€™m running docker on debian jessie, it is possible that Iā€™m also suffering from missing AUFS support or could this be a different error?

# grep  XATTR /boot/config-$(uname -r)   
CONFIG_REISERFS_FS_XATTR=y
CONFIG_TMPFS_XATTR=y
CONFIG_JFFS2_FS_XATTR=y
CONFIG_SQUASHFS_XATTR=y
CONFIG_F2FS_FS_XATTR=y
CONFIG_CIFS_XATTR=y
117

I have tried running the docker image on Debian Jessie too, and got the same problem. I was able to install it under Centos 7 without any problems.

I was facing the link(xx) not permitted problem too.

118

I have this issue on the same system, debian jessie.

119

My current guess is that its an AUFS issue. But as Iā€™m running it on a production server, I currently donā€™t dare to switch to debian testing which has a more recent kernel with built-in overlayfs support (part of mainline linux kernel which is not the case for AUFS. Many references also prefer overlayfs over AUFS). Anyone willing to give it a try? :slight_smile:

Edit:
maybe its also possible to just install the new kernel with following this procedure: http://serverfault.com/questions/22414/how-can-i-run-debian-stable-but-install-some-packages-from-testing
and then trying to select the new storage driver: https://docs.docker.com/engine/userguide/storagedriver/selectadriver/

120

I tried using overlayFS but got permission errors. When I switched back to AUFS it worked. I am running Debian 8.5.