From 12670c9352a94b978ca91480143ad25087c346f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ebbe=20Ba=C3=9F?= Date: Fri, 17 Jul 2026 09:09:14 +0200 Subject: [PATCH] fixed ip issueing --- .../deploy_collabora_code.yml | 49 ++++++++++--------- 1 file changed, 26 insertions(+), 23 deletions(-) diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml index 65fa28e..79b14e2 100644 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml +++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml @@ -172,48 +172,51 @@ ProxyPreserveHost On - # Required: without this, mod_proxy refuses to initiate TLS to - # the backend at all (AH01961/AH00961 "failed to enable ssl - # support"), even though SSLEngine on above enables TLS for the - # *client-facing* side of the connection. SSLEngine on does not - # imply SSLProxyEngine on - they control opposite directions. - SSLProxyEngine On - - # cert is issued for collaboraonline.example.com and we proxy to localhost - SSLProxyVerify None - SSLProxyCheckPeerCN Off - SSLProxyCheckPeerName Off - + # NOTE: coolwsd is configured with `ssl.termination true` + # (see the "Configure Collabora CODE to disable SSL" task), + # which tells coolwsd to expect a TLS-terminating proxy in + # front of it and to speak PLAIN HTTP/WS on 127.0.0.1:9980 + # itself. Apache must therefore proxy to it over http/ws, not + # https/wss - proxying https to a plaintext backend produces + # "500 Proxy Error: Error during SSL Handshake with remote + # server" because Apache sends a TLS ClientHello to a socket + # that never speaks TLS. + # + # If you ever flip coolconfig back to `ssl.enable true` / + # `ssl.termination false` (coolwsd terminates its own TLS), + # switch every ProxyPass/ProxyPassReverse target below back + # to https/wss and restore SSLProxyEngine On plus the + # SSLProxyVerify/CheckPeerCN/CheckPeerName directives. # static html, js, images, etc. served from coolwsd # browser is the client part of Collabora Online - ProxyPass /browser https://127.0.0.1:9980/browser retry=0 - ProxyPassReverse /browser https://127.0.0.1:9980/browser + ProxyPass /browser http://127.0.0.1:9980/browser retry=0 + ProxyPassReverse /browser http://127.0.0.1:9980/browser # WOPI discovery URL - ProxyPass /hosting/discovery https://127.0.0.1:9980/hosting/discovery retry=0 - ProxyPassReverse /hosting/discovery https://127.0.0.1:9980/hosting/discovery + ProxyPass /hosting/discovery http://127.0.0.1:9980/hosting/discovery retry=0 + ProxyPassReverse /hosting/discovery http://127.0.0.1:9980/hosting/discovery # Capabilities - ProxyPass /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities retry=0 - ProxyPassReverse /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities + ProxyPass /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities retry=0 + ProxyPassReverse /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities # Main websocket (legacy URL, with the document path encoded into it) - ProxyPassMatch "/cool/(.*)/ws$" wss://127.0.0.1:9980/cool/$1/ws nocanon + ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon # Main websocket (compact URL, used since 26.04, with the document passed via the WOPISrc query parameter) - ProxyPass /cool/ws wss://127.0.0.1:9980/cool/ws nocanon + ProxyPass /cool/ws ws://127.0.0.1:9980/cool/ws nocanon # Admin Console websocket - ProxyPass /cool/adminws wss://127.0.0.1:9980/cool/adminws + ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws # Download as, presentation (legacy svg) and image upload operations - ProxyPass /cool https://127.0.0.1:9980/cool - ProxyPassReverse /cool https://127.0.0.1:9980/cool + ProxyPass /cool http://127.0.0.1:9980/cool + ProxyPassReverse /cool http://127.0.0.1:9980/cool SSLEngine on SSLCertificateFile {{ cc_ssl_cert }}