From 5df2199f3ad26fab79ddad692561019e9ed9b386 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ebbe=20Ba=C3=9F?= Date: Tue, 14 Jul 2026 14:25:22 +0200 Subject: [PATCH] added http https redirect --- .../connect_nextcloud_collabora.yml | 4 +- .../deploy_collabora_code.yml | 106 ++++++++++++++++++ .../deployment_start.yml | 25 ----- 3 files changed, 108 insertions(+), 27 deletions(-) delete mode 100644 playbooks/linux/ubuntu-server/nextcloud_full_deployment/deployment_start.yml diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/connect_nextcloud_collabora.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/connect_nextcloud_collabora.yml index 4de48e6..94fb99c 100644 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/connect_nextcloud_collabora.yml +++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/connect_nextcloud_collabora.yml @@ -40,7 +40,7 @@ - name: Point richdocuments at the Collabora server ansible.builtin.command: > sudo -u www-data php occ config:app:set richdocuments wopi_url - --value="http://{{ collabora_fqdn }}:9980" + --value="https://{{ collabora_fqdn }}:9980" args: chdir: /etc/nextcloud changed_when: true @@ -48,7 +48,7 @@ - name: Set the public WOPI URL (same value, used for editor loading) ansible.builtin.command: > sudo -u www-data php occ config:app:set richdocuments public_wopi_url - --value="http://{{ collabora_fqdn }}:9980" + --value="https://{{ collabora_fqdn }}:9980" args: chdir: /etc/nextcloud changed_when: true \ No newline at end of file diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml index 46494eb..fd7aae7 100644 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml +++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_collabora_code.yml @@ -83,4 +83,110 @@ name: coolwsd state: restarted +# ================================================================ +# PLAY 2 — Install apache2 and configure reverse proxy with SSL for Collabora CODE +# ================================================================ +- name: Install apache2 and configure reverse proxy with SSL for Collabora CODE + hosts: collabora_code + become: true + + vars: + collabora_code_domain: "office.test.local" #EDIT based on your needs + ssl_cert: "/etc/ssl/certs/office-selfsigned.crt" + ssl_key: "/etc/ssl/private/office-selfsigned.key" + + tasks: + - name: Generate self-signed TLS certificate (10-year validity) + ansible.builtin.command: + cmd: > + openssl req -x509 -nodes -days 3650 + -newkey rsa:4096 + -keyout {{ ssl_key }} + -out {{ ssl_cert }} + -subj "/CN={{ collabora_code_domain }}/O=Office/C=DE" + -addext "subjectAltName=DNS:{{ collabora_code_domain }}" + creates: "{{ ssl_cert }}" + + - name: Restrict private key permissions + ansible.builtin.file: + path: "{{ ssl_key }}" + owner: root + group: root + mode: "0600" + + - name: Install apache2 and required modules + ansible.builtin.apt: + name: + - apache2 + - libapache2-mod-proxy-html + - libxml2-dev + state: present + + - name: Enable required Apache modules + ansible.builtin.apache2_module: + name: "{{ item }}" + state: present + loop: + - proxy + - proxy_http + - proxy_wstunnel + - rewrite + - headers + + - name: Deploy Nextcloud Apache virtual host (HTTP redirect + HTTPS) + ansible.builtin.copy: + dest: /etc/apache2/sites-available/nextcloud.conf + mode: "0644" + content: | + + ServerName {{ collabora_code_domain }} + Options -Indexes + + ErrorLog "/var/log/apache2/collabora_error" + # Encoded slashes need to be allowed + AllowEncodedSlashes NoDecode + + # keep the host + ProxyPreserveHost On + + # static html, js, images, etc. served from coolwsd + # loleaflet/browser is the client part of Collabora Online + ProxyPass /loleaflet http://127.0.0.1:9980/loleaflet retry=0 + ProxyPassReverse /loleaflet http://127.0.0.1:9980/loleaflet + ProxyPass /browser http://127.0.0.1:9980/browser retry=0 + ProxyPassReverse /browser http://127.0.0.1:9980/browser + + # WOPI discovery URL + ProxyPass /hosting/discovery http://127.0.0.1:9980/hosting/discovery retry=0 + ProxyPassReverse /hosting/discovery http://127.0.0.1:9980/hosting/discovery + + # Capabilities + ProxyPass /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities retry=0 + ProxyPassReverse /hosting/capabilities http://127.0.0.1:9980/hosting/capabilities + + # Main websocket + ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon + + # Admin Console websocket + ProxyPass /cool/adminws ws://127.0.0.1:9980/cool/adminws + + # Download as, Fullscreen presentation and Image upload operations + ProxyPass /cool http://127.0.0.1:9980/cool + ProxyPassReverse /cool http://127.0.0.1:9980/cool + + SSLEngine on + SSLCertificateFile /etc/ssl/certs/office-selfsigned.crt + SSLCertificateKeyFile /etc/ssl/private/office-selfsigned.key + + + - name: Enable Collabora virtual host + ansible.builtin.apache2_site: + name: collabora.conf + state: enabled + + - name: Restart Apache to apply changes + ansible.builtin.service: + name: apache2 + state: restarted + # This file was written by Ebbe Baß (umpi) - ebbe@ping-mee.de \ No newline at end of file diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deployment_start.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deployment_start.yml deleted file mode 100644 index e48182e..0000000 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deployment_start.yml +++ /dev/null @@ -1,25 +0,0 @@ -- name: Deploy hardened Nextcloud - hosts: nextcloud - tags: dp-hnc - tasks: - - ansible.builtin.include: deploy_hardened_nextcloud.yml - -- name: Deploy Collabora CODE - hosts: collabora_code - tags: dp-code - tasks: - - ansible.builtin.include: deploy_collabora_code.yml - -- name: Connect Nextcloud and Collabora CODE - hosts: nc2code - tags: nc2code - tasks: - - ansible.builtin.include: connect_nextcloud_collabora.yml - -- name: Connect Nextcloud to OpenExchange - hosts: nc2ex - tags: nc2ex - tasks: - - ansible.builtin.include: connect_nextcloud_openexchange.yml - -# This file was written by Ebbe Baß (umpi) - ebbe@ping-mee.de \ No newline at end of file