search

nextcloud / richdocuments

📑 Collabora Online for Nextcloud
https://nextcloud.com/collaboraonline
349 stars 115 forks source link

Collabora unable to open documents, coolwsd can't seem to collabora-te with Apache's proxy #2192

Closed DigitalLeaves closed 2 years ago

DigitalLeaves commented 2 years ago

Describe the bug

Hello! I am trying to get Collabora to work on our subdomain (Debian 11). I did a fresh installation (without docker) using the collaboraoffice.com packages here. I think NextCloud is going to be a game-changer, but I am stuck with this. Can you please help me?

I configured Collabora and it is working and listening on localhost:

localhost:~# netstat -putan | grep LISTEN | grep coolwsd
tcp6       0      0 :::9980                 :::*                    LISTEN      55874/coolwsd

NextCloud detects Collabora nicely as you can see.

Screenshot 2022-05-07 at 11 31 24

However, when I try to create or open a new document, I had the dreaded white screen of death:

Screenshot 2022-05-07 at 11 32 06

These are the logs from Apache:

==> /var/log/apache2/collabora_error.log <==
[Sat May 07 09:47:56.666693 2022] [proxy_http:error] [pid 55895] (20014)Internal error (specific information not available): [client 94.133.242.174:55346] AH01102: error reading status line from remote server 127.0.0.1:9980
[Sat May 07 09:47:56.666896 2022] [proxy:error] [pid 55895] [client 94.133.242.174:55346] AH00898: Error reading from remote server returned by /cool/https:/cloud.mydomain.com/index.php/apps/richdocuments/wopi/files/672_ocmaqq15fyvi?access_token=hWzvsopvM1WhwyRuVxUPJ2EEqtb1nVSy&access_token_ttl=0&permission=edit/ws

==> /var/log/apache2/other_vhosts_access.log <==
collabora.mydomain.com:443 94.133.242.174 - - [07/May/2022:09:47:56 +0000] "GET /cool/https%3A%2F%2Fcloud.mydomain.com%2Findex.php%2Fapps%2Frichdocuments%2Fwopi%2Ffiles%2F672_ocmaqq15fyvi%3Faccess_token%3DhWzvsopvM1WhwyRuVxUPJ2EEqtb1nVSy%26access_token_ttl%3D0%26permission%3Dedit/ws?WOPISrc=https%3A%2F%2Fcloud.mydomain.com%2Findex.php%2Fapps%2Frichdocuments%2Fwopi%2Ffiles%2F672_ocmaqq15fyvi&compat=/ws HTTP/1.1" 502 1199 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36"

Which seems to indicate some kind of Proxy error. If I navigate to https:/cloud.mydomain.com/index.php/apps/richdocuments/wopi/files/672_ocmaqq15fyvi?access_token=hWzvsopvM1WhwyRuVxUPJ2EEqtb1nVSy&access_token_ttl=0&permission=edit/ws I see the information perfectly displayed:

{
    "BaseFileName": "New document.docx",
    "Size": 7567,
    "Version": "0",
    "UserId": "ignacio",
    "OwnerId": "ignacio",
    "UserFriendlyName": "ignacio",
    "UserExtraInfo": {
    "avatar": "https://cloud.mydomain.com/index.php/avatar/ignacio/32",
    "is_admin": true
    },
    "UserCanWrite": true,
    "UserCanNotWriteRelative": false,
    "PostMessageOrigin": "https://cloud.mydomain.com/",
    "LastModifiedTime": "2022-05-07T08:44:16.000000Z",
    "SupportsRename": true,
    "UserCanRename": true,
    "EnableInsertRemoteImage": true,
    "EnableShare": true,
    "HideUserList": "",
    "DisablePrint": false,
    "DisableExport": false,
    "DisableCopy": false,
    "HideExportOption": false,
    "HidePrintOption": false,
    "DownloadAsPostMessage": false
}

I also see these from time to time:

[Sat May 07 11:05:45.375905 2022] [core:error] [pid 57958] [remote 127.0.0.1:9980] AH01961:  failed to enable ssl support [Hint: if using mod_ssl, see SSLProxyEngine]
[Sat May 07 11:05:45.375964 2022] [proxy:error] [pid 57958] AH00961: https: failed to enable ssl support for 127.0.0.1:9980 (127.0.0.1)

But SSLProxyEngine is On.

The browser's log may indicate some kind of issue with the Web Socket connection:

Screenshot 2022-05-07 at 11 31 55

However, my Apache configuration follows the official documentation.

<VirtualHost *:443>
  ServerName collabora.mydomain.com:443

  # SSL configuration, you may want to take the easy route instead and use Let's Encrypt!
  SSLEngine on
  SSLCertificateFile /etc/letsencrypt/live/collabora.mydomain.com/cert.pem
  SSLCertificateChainFile /etc/letsencrypt/live/collabora.mydomain.com/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/collabora.mydomain.com/privkey.pem

  SSLProtocol             all -SSLv2 -SSLv3
  # SSLProtocol -all +TLSv1.3 +TLSv1.2
  SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
  SSLHonorCipherOrder     on

  # Encoded slashes need to be allowed
  AllowEncodedSlashes On 
# NoDecode

  # Container uses a unique non-signed certificate
  SSLProxyEngine On
  SSLProxyVerify None
  SSLProxyCheckPeerCN Off
  # SSLProxyCheckPeerName Off

  # keep the host
  ProxyPreserveHost On

  # static html, js, images, etc. served from coolwsd
  # loleaflet/browser is the client part of Collabora Online
  ProxyPass           /browser https://127.0.0.1:9980/browser retry=0
  ProxyPassReverse    /browser https://127.0.0.1:9980/browser

  # WOPI discovery URL
  ProxyPass           /hosting/discovery https://127.0.0.1:9980/hosting/discovery retry=0
  ProxyPassReverse    /hosting/discovery https://127.0.0.1:9980/hosting/discovery

  # Capabilities
  ProxyPass           /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities retry=0
  ProxyPassReverse    /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities

  # Main websocket
  ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon

  # Admin Console websocket
  ProxyPass   /cool/adminws ws://127.0.0.1:9980/cool/adminws

  # Download as, Fullscreen presentation and Image upload operations
  ProxyPass           /cool https://127.0.0.1:9980/cool
  ProxyPassReverse    /cool https://127.0.0.1:9980/cool
  ProxyPass           /lool https://127.0.0.1:9980/cool
  ProxyPassReverse    /lool https://127.0.0.1:9980/cool

  ErrorLog /var/log/apache2/collabora_error.log
</VirtualHost>

If I go to https://collabora.mydomain.com/cool, I get a "This page is not working" 400 error. Curl (see log in details below) does not show any particular error, just closes the connection with a 400.

I have tried the solutions shown here, including:

- changing the SSLProtocol variables of Apache:

SSLProtocol all -SSLv2 -SSLv3

SSLProtocol -all +TLSv1.3 +TLSv1.2


Without success.

**To Reproduce**
Steps to reproduce the behavior:
1. Well, install Nextcloud on a VPS using the Debian official packages from collaboraoffice.com
2. Set up reverse proxy
3. Connect Collabora to NextCloud on Admin settings
4. Try to create or open a document

**Expected behavior**
I should be able to open and edit the document.

**Screenshots**

See above.

**Client details:**
 - OS: [e.g. iOS]" Server:  MacOS Monterey 12.2.1 (21D62)
 - Browser [e.g. chrome, safari] Chrome Version 101.0.4951.54 (Official Build) (x86_64) on a
 - Version [e.g. 22] 24.0.0
 - Device: [e.g. iPhone6, desktop] Desktop

## Server details

**Operating system**: Debian Linux 11

**Web server:** Apache 2.4.53

**Database:** MariaDB 1:10.5.15-0+deb11u1

**PHP version:** PHP 7.4.28 (cli) (built: Feb 17 2022 16:17:19) ( NTS )

**Nextcloud version:** 24.0.0

**Version of the richdocuments app** Didn't find this, if this is "Text", it is 3.5.1.

**Version of Collabora Online** NextCloud Office 6.0.0

<details>
<summary>Logs</summary>

See above

#### Nextcloud log (data/nextcloud.log)

(nothing relevant here)


#### Browser log

cool.html?WOPISrc=https%3A%2F%2Fcloud.mydomain.com%2Findex.php%2Fapps%2Frichdocuments%2Fwopi%2Ffiles%2F672_ocmaqq15fyvi&title=New%20document.docx&lang=en&closebutton=1&revisionhistory=1:264 WebSocket connection to 'wss://collabora.mydomain.com/cool/https%3A%2F%2Fcloud.mydomain.com%2Findex.php%2Fapps%2Frichdocuments%2Fwopi%2Ffiles%2F672_ocmaqq15fyvi%3Faccess_token%3DNil4BIb7RcGd7g6slHl0uDaASL9uNfUc%26access_token_ttl%3D0/ws?WOPISrc=https%3A%2F%2Fcloud.mydomain.com%2Findex.php%2Fapps%2Frichdocuments%2Fwopi%2Ffiles%2F672_ocmaqq15fyvi&compat=/ws' failed: global.createWebSocket @ cool.html?WOPISrc=https%3A%2F%2Fcloud.mydomain.com%2Findex.php%2Fapps%2Frichdocuments%2Fwopi%2Ffiles%2F672_ocmaqq15fyvi&title=New%20document.docx&lang=en&closebutton=1&revisionhistory=1:264 (anonymous) @ cool.html?WOPISrc=https%3A%2F%2Fcloud.mydomain.com%2Findex.php%2Fapps%2Frichdocuments%2Fwopi%2Ffiles%2F672_ocmaqq15fyvi&title=New%20document.docx&lang=en&closebutton=1&revisionhistory=1:264 (anonymous) @ cool.html?WOPISrc=https%3A%2F%2Fcloud.mydomain.com%2Findex.php%2Fapps%2Frichdocuments%2Fwopi%2Ffiles%2F672_ocmaqq15fyvi&title=New%20document.docx&lang=en&closebutton=1&revisionhistory=1:264 bundle.js:1 Blocked autofocusing on a