Can't open documents in CollaboraOnline

[fion-private]

Hello Community,
I can't open documents in CollaboraOnline from OpenCloud. Perhaps someone has a tip for me as to where the problem might be. I have OpenCloud installed behind an external proxy (NginxProxyManager). OpenCloud is running, I can log in, create files, etc. However, when I try to edit a file in CollaboraOnline, I get this error (This content is blocked. Please contact the website owner to resolve the issue.):

I found this console error in the dev tools:

web-app-external-C2VoHhCZ.mjs:1 Framing 'https://office.mydomain.tld/' violates the following Content Security Policy directive: "frame-src 'self' blob: https://embed.diagrams.net/". The request has been blocked.

I can access the Collabora and Collaboration URLs in the browser and receive these responses:

• office.mydomain.tld --> ok
• wopi.mydomain.tld --> 404 page not found

Here is my Docker configuration for OpenCloud, Collaboration and Collabora:
`opencloud:
container_name: opencloud
image: opencloudeu/opencloud:4
user: 1000:1000
entrypoint:
- /bin/sh
command: ["-c", "opencloud init || true; opencloud server"]
environment:
OC_ADD_RUN_SERVICES:
OC_URL: https://cloud.mydomain.tld
OC_LOG_LEVEL: error
OC_LOG_COLOR: "false"
OC_LOG_PRETTY: "false"
PROXY_TLS: "false"
OC_INSECURE: "true"
PROXY_ENABLE_BASIC_AUTH: "false"
IDM_CREATE_DEMO_USERS: "false"
IDM_ADMIN_PASSWORD: "mypassword"
FRONTEND_ARCHIVER_MAX_SIZE: "10000000000"
FRONTEND_CHECK_FOR_UPDATES: "true"
PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml
OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: banned-password-list.txt
OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD: "true"
OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD: "true"
OC_PASSWORD_POLICY_DISABLED: "false"
OC_PASSWORD_POLICY_MIN_CHARACTERS: "8"
OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS: "1"
OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS: "1"
OC_PASSWORD_POLICY_MIN_DIGITS: "1"
OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS: "1"
COLLABORA_DOMAIN: office.mydomain.tld
NATS_NATS_HOST: 0.0.0.0
GATEWAY_GRPC_ADDR: 0.0.0.0:9142
FRONTEND_APP_HANDLER_SECURE_VIEW_APP_ADDR: eu.opencloud.api.collaboration
GRAPH_AVAILABLE_ROLES: "b1e2218d-eef8-4d4c-b82d-0f1a1b48f3b5,a8d5fe5e-96e3-418d-825b-534dbdf22b99,fb6c3e19-e378-47e5-b277-9732f9de6e21,58c63c02-1d89-4572-916a-870abc5a1b7d,2d00ce52-1fc2-4dbc-8b95-a73b73395f5a,1c996275-f1c9-4e71-abdf-a42f6495e960,312c0871-5ef7-4b3a-85b6-0e4074c64049,aa97fe03-7980-45ac-9e50-b325749fd7e6"
PROXY_HTTP_ADDR: "0.0.0.0:9200"
volumes:
- ./opencloud/config/csp.yaml:/etc/opencloud/csp.yaml
- ./opencloud/config/banned-password-list.txt:/etc/opencloud/banned-password-list.txt
- ./opencloud/config:/etc/opencloud
- ./opencloud/data:/var/lib/opencloud
- ./opencloud/apps:/var/lib/opencloud/web/assets/apps
- clamav-socket:/var/run/clamav
logging:
driver: local
restart: always

collaboration:
container_name: collaboration
image: opencloudeu/opencloud:4
user: 1000:1000
depends_on:
opencloud:
condition: service_started
collabora:
condition: service_healthy
entrypoint:
- /bin/sh
command: [ "-c", "opencloud collaboration server" ]
environment:
COLLABORATION_GRPC_ADDR: 0.0.0.0:9301
COLLABORATION_HTTP_ADDR: 0.0.0.0:9300
MICRO_REGISTRY: "nats-js-kv"
MICRO_REGISTRY_ADDRESS: "opencloud:9233"
COLLABORATION_WOPI_SRC: https://wopi.mydomain.tld
COLLABORATION_APP_NAME: "CollaboraOnline"
COLLABORATION_APP_PRODUCT: "Collabora"
COLLABORATION_APP_ADDR: https://office.mydomain.tld
COLLABORATION_APP_ICON: https://office.mydomain.tld/favicon.ico
COLLABORATION_APP_INSECURE: "true"
COLLABORATION_CS3API_DATAGATEWAY_INSECURE: "true"
COLLABORATION_LOG_LEVEL: error
OC_URL: https://cloud.mydomain.tld
volumes:
- ./opencloud/config:/etc/opencloud
logging:
driver: local
restart: always
collabora:
container_name: collabora
image: collabora/code:25.04.7.1.1
environment:
aliasgroup1: https://wopi.mydomain.tld
DONT_GEN_SSL_CERT: "YES"
extra_params: |
--o:ssl.enable=false
--o:ssl.ssl_verification=false
--o:ssl.termination=true
--o:welcome.enable=false
--o:net.frame_ancestors=cloud.mydomain.tld
--o:net.lok_allow.host[14]=cloud.mydomain.tld
--o:home_mode.enable=false
username: admin
password: "mypassword"
cap_add:
- MKNOD
volumes:
- /usr/share/fonts/truetype:/usr/share/fonts/truetype/more:ro
- /usr/share/fonts/truetype:/opt/cool/systemplate/usr/share/fonts/truetype/more:ro
logging:
driver: local
restart: unless-stopped
entrypoint: [ '/bin/bash', '-c' ]
command: [ 'coolconfig generate-proof-key && /start-collabora-online.sh' ]
healthcheck:
test: [ "CMD", "curl", "-f", "http://localhost:9980/hosting/discovery" ]
interval: 15s
timeout: 10s
retries: 5`

Does anyone have any idea where I should start troubleshooting?
Thanks in advance!

[micbar]

The issue is related to CSP.

Are you using a custom deployment or the official compose project?

In the official compose we add the collabora domain to the csp.yaml automatically.

[fion-private]

I'm using a custom deployment. I'm using the contents of the files

• docker-compose.yml
• weboffice/collabora.yml
• search/tika.yml
• external-proxy/opencloud.yml
• external-proxy/collabora.yml
• antivirus/clamav.yml

together with the configurations of other containers in a docker-compose.yml file, as described above (except for Tika and Clamav). No .env files, no other modifications.

[micbar]

You need to configure proper CSP rules. Please check the compose project.

[fion-private]

Ah, I mapped an empty file as csp.yml. Now I added the content from the project and it works. Thanks for helping!

[TheColin21]

I have a similar problem. I also setup OpenCloud using an external proxy (traefik) but I am using the original compose repo as far as possible (added some Traefik labels to the ymls in the external proxy folder...). My WOPI container always just returns a 404 not found, even when trying to curl it (with a correct host header) from within the container itself. I did fill the csp.yaml, I hope correctly, but the behaviour does not change.

[micbar]

When you curl it, it will respond on wopiserver.your-domain.tld/wopi

[TheColin21]

Aah thanks there it shows 'i'm a teapot'👍🏻

I still can't use collabora, it just shows
'failed to establish socket connection or socket connection closed unexpectedly' :(

[micbar]

'failed to establish socket connection or socket connection closed unexpectedly' :(

This is a reverse proxy issue. I had that once with traefik, a restart of traefik fixed it for me.

[TheColin21]

Doesn't fix it for me sadly. I even recreated the container since I first saw this problem... I triple checked the spelling of all subdomains in the .env and yaml files...no idea why it doesn't work