pazpi/nix
1
0
Fork 0
Code Issues 2 Pull requests 1 Projects Releases Packages Wiki Activity Actions

Add collabora trust domain

Browse source
This commit is contained in:
pazpi 2026-02-04 16:16:06 +01:00
parent 0b70e3952f
commit 96e3db4a8b
2 changed files with 31 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

8
hosts/collabora/default.nix
View file

@ -17,14 +17,14 @@ in
services.collabora-online = {
enable = true;
trustedDomains = [
"cloud.${p.domains.public}"
];
};
virtualisation.proxmox.enable = true;
};
# Extra packages
environment.systemPackages = with pkgs; [ ];
system.stateVersion = "24.11";
system.stateVersion = "25.11";
}

34
modules/services/collabora-online.nix
View file

@ -12,6 +12,15 @@ in
options.my.services.collabora-online = {
enable = lib.mkEnableOption "Enable Collabora Online module";
trustedDomains = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
description = ''
List of trusted WOPI hostnames (for example your Nextcloud URL)
that are allowed to use this Collabora Online instance.
'';
};
proxy = {
enable = lib.mkEnableOption "Set the proxy entry for this service";
@ -46,12 +55,24 @@ in
services.collabora-online = {
enable = true;
# settings = {
# host = [
# ''127\.0\.0\.1''
# ];
# storage.wopi."@allow" = true;
# };
settings =
{
net.listen = "0.0.0.0";
# terminate TLS at Caddy, NOT in coolwsd
ssl.enable = false;
ssl.termination = true;
# allow WOPI (Nextcloud etc.)
storage.wopi."@allow" = true;
}
// lib.optionalAttrs (cfg.trustedDomains != [ ]) {
# Restrict which hosts may use WOPI (e.g. only your Nextcloud).
# Collabora expects regexes here, so escape dots.
storage.wopi.host = map
(d: builtins.replaceStrings [ "." ] [ "\\." ] d)
cfg.trustedDomains;
};
};
networking.firewall.allowedTCPPorts = [
@ -72,4 +93,3 @@ in
})
];
}