Document how to add WOPI host in ADMIN.MD

[lapineige]

Users are confused when they try to use the app, as they have to:

• Open the Collabora Online app (codename richdocuments) in Nextcloud and specify the collabora app domain
  • For secure use : Configure a list of WOPI-allowed URLs in Nextcloud Allow list for WOPI requests
• Add this domain in allowlist if it's not the main one configured during install https://github.com/YunoHost-Apps/collabora_ynh/blob/master/conf/coolwsd.xml#L185 that's here /etc/coolwsd/coolwsd.xml https://github.com/YunoHost-Apps/collabora_ynh/blob/master/scripts/install#L37

This should be documented in the ADMIN.md file to help admins to understand how to configure the app.

Good first issue for newcomers ;)

[tio-trom]

Thanks for the headsup. I have Collabora installed on the same server as Nextcloud and I add the IP of the server in the WOPI allowed list. However Collabora cannot open any document saying

Unauthorized WOPI host. Please try again later and report to your administrator if the issue persists.

Do I have to add that IP in a different way, mentioning a port? Or?

[rodinux]

Thanks for the headsup. I have Collabora installed on the same server as Nextcloud and I add the IP of the server in the WOPI allowed list. However Collabora cannot open any document saying

Unauthorized WOPI host. Please try again later and report to your administrator if the issue persists.

Do I have to add that IP in a different way, mentioning a port? Or?

On some Yunohost instances with Nextcloud and Collabora, I haven't added Allowed list Wopi Request...
But if a port is needed, I think by default it may be 9980, is the default port for collabora...

[rodinux]

But if a port is needed, I think by default it may be 9980, is the default port for collabora...

This isn't a solution, usually you don't need add a port here.

I think perhaps in the file /etc/coolwsd/coolwsd.xml is missing lines inside the block <wopi> </wopi>, like this:

            <alias_groups desc="default mode is 'first' it allows only the first host when groups are not defined. set mode to 'groups' and define group to allow multiple host and its aliases" mode="first">
            <!-- If you need to use multiple wopi hosts, please change the mode to "groups" and
                    add the hosts below.  If one host is accessible under multiple ip addresses
                    or names, add them as aliases. -->
                <group>
                    <host desc="hostname to allow or deny." allow="true">https://__NEXTCLOUD_DOMAIN__:443</host>
                    <!--<alias desc="regex pattern of aliasname">scheme://aliasname1:port</alias>
                    <alias desc="regex pattern of aliasname">scheme://aliasname2:port</alias> -->
                </group>
            </alias_groups>

the mode="first" ensure it is only this host server for Collabora...

I think reading the official doc it is also necessary: https://docs.nextcloud.com/server/latest/admin_manual/office/configuration.html#wopi-settings

Not sure, but I have had to this on some collabora builds with docker stacks...

[rodinux]

I think perhaps in the file /etc/coolwsd/coolwsd.xml is missing lines inside the block <wopi> </wopi>, like this:

Well, after some tests, it doesn't work also like this...

[tio-trom]

To update I can open any document with collabora after a server reboot, but I still get this error:

[rodinux]

It is really strange...
I have a server where I could put 127.0.0.1 for Allow list for WOPI requests, but on others servers it did not works as excepted..

[tootbrute]

Users are confused when they try to use the app, as they have to:

great idea. i find myself in confused space, too. if we get the steps documented here, we can then update the Readme.

EDIT: I got it working!

Not sure if this is secure but it came alive when I added this to the Nextcloud Admin settings for Office:

[tomdereub]

If I understand well, ::/0 and 0.0.0.0/0 allow all ip adresses, so it does not add security.
I managed with this : 127.0.0.1,::1
Wich loop's back to the same server, in ipv4 and ipv6. But I would appreciate an expert advice !

[Aaaamu]

If I understand well, ::/0 and 0.0.0.0/0 allow all ip adresses, so it does not add security. I managed with this : 127.0.0.1,::1 Wich loop's back to the same server, in ipv4 and ipv6. But I would appreciate an expert advice !

well t-h-a-n-k y-o-u! this really helped. I read a lot of comments that said loopback ip wont do, but apparently on a setup with collabora and nc on the same server it works - IF you add the ipv6 bit. both bits of information could be mentioned under the input field and in every bit of documentation please :) lost so much time for this already. question still open if this is a secure solution?

[Riik]

Just to add to this thread;
I spent over an hour trying different settings for the allowlist, but what fixed it for me was to allow "Nextcloud" permissions to visitor, I only had "Nextcloud (api)" configured.
Some other useful tips are here: https://forum.yunohost.org/t/collabora-nextcloud-yunohost-tips-and-limitation/30314

This thread has been going for a while already, but I'm happy to take a stab at updating the ADMIN.md and make a PR? I only started with Yunohost today so still quite new to everything, but also happy to put in some effort to save others some trouble