Add collabora trust domain

hosts/collabora/default.nix

@@ -17,14 +17,14 @@ in
 
     services.collabora-online = {
       enable = true;
+      trustedDomains = [
+        "cloud.${p.domains.public}"
+      ];
     };
 
     virtualisation.proxmox.enable = true;
   };
 
-  # Extra packages
+  system.stateVersion = "25.11";
-  environment.systemPackages = with pkgs; [ ];
-
-  system.stateVersion = "24.11";
 }
 

modules/services/collabora-online.nix

@@ -12,6 +12,15 @@ in
   options.my.services.collabora-online = {
     enable = lib.mkEnableOption "Enable Collabora Online module";
 
+    trustedDomains = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        List of trusted WOPI hostnames (for example your Nextcloud URL)
+        that are allowed to use this Collabora Online instance.
+      '';
+    };
+
     proxy = {
       enable = lib.mkEnableOption "Set the proxy entry for this service";
 
@@ -46,12 +55,24 @@ in
 
       services.collabora-online = {
         enable = true;
-        # settings = {
+        settings =
-        #   host = [
+          {
-        #     ''127\.0\.0\.1''
+            net.listen = "0.0.0.0";
-        #   ];
+
-        #   storage.wopi."@allow" = true;
+            # terminate TLS at Caddy, NOT in coolwsd
-        # };
+            ssl.enable = false;
+            ssl.termination = true;
+
+            # allow WOPI (Nextcloud etc.)
+            storage.wopi."@allow" = true;
+          }
+          // lib.optionalAttrs (cfg.trustedDomains != [ ]) {
+            # Restrict which hosts may use WOPI (e.g. only your Nextcloud).
+            # Collabora expects regexes here, so escape dots.
+            storage.wopi.host = map
+              (d: builtins.replaceStrings [ "." ] [ "\\." ] d)
+              cfg.trustedDomains;
+          };
       };
 
       networking.firewall.allowedTCPPorts = [
@@ -72,4 +93,3 @@ in
     })
   ];
 }
-