Add Collabora Online (#330708)

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -108,6 +108,8 @@
 
 - [zeronsd](https://github.com/zerotier/zeronsd), a DNS server for ZeroTier users. Available with [services.zeronsd.servedNetworks](#opt-services.zeronsd.servedNetworks).
 
+- [Collabora Online](https://www.collaboraonline.com/), a collaborative online office suite based on LibreOffice technology. Available as [services.collabora-online](options.html#opt-services.collabora-online.enable).
+
 - [wg-access-server](https://github.com/freifunkMUC/wg-access-server/), an all-in-one WireGuard VPN solution with a web ui for connecting devices. Available at [services.wg-access-server](#opt-services.wg-access-server.enable).
 
 - [Pingvin Share](https://github.com/stonith404/pingvin-share), a self-hosted file sharing platform and an alternative for WeTransfer. Available as [services.pingvin-share](#opt-services.pingvin-share.enable).

nixos/modules/module-list.nix

@@ -1392,6 +1392,7 @@
   ./services/web-apps/chatgpt-retrieval-plugin.nix
   ./services/web-apps/cloudlog.nix
   ./services/web-apps/code-server.nix
+  ./services/web-apps/collabora-online.nix
   ./services/web-apps/commafeed.nix
   ./services/web-apps/convos.nix
   ./services/web-apps/crabfit.nix

nixos/modules/services/web-apps/collabora-online.nix

@@ -0,0 +1,200 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  cfg = config.services.collabora-online;
+
+  freeformType = lib.types.attrsOf ((pkgs.formats.json { }).type) // {
+    description = ''
+      `coolwsd.xml` configuration type, used to override values in the default configuration.
+
+      Attribute names correspond to XML tags unless prefixed with `@`. Nested attribute sets
+      correspond to nested XML tags. Attribute prefixed with `@` correspond to XML attributes. E.g.,
+      `{ storage.wopi."@allow" = true; }` in Nix corresponds to
+      `<storage><wopi allow="true"/></storage>` in `coolwsd.xml`, or `--o:storage.wopi[@allow]=true`
+      in the command line.
+
+      Arrays correspond to multiple elements with the same tag name. E.g.
+      `{ host = [ '''127\.0\.0\.1''' "::1" ]; }` in Nix corresponds to
+      ```xml
+      <net><post_allow>
+        <host>127\.0\.0\.1</host>
+        <host>::1</host>
+      </post_allow></net>
+      ```
+      in `coolwsd.xml`, or
+      `--o:net.post_allow.host[0]='127\.0\.0\.1 --o:net.post_allow.host[1]=::1` in the command line.
+
+      Null values could be used to remove an element from the default configuration.
+    '';
+  };
+
+  configFile =
+    pkgs.runCommandLocal "coolwsd.xml"
+      {
+        nativeBuildInputs = [
+          pkgs.jq
+          pkgs.yq-go
+        ];
+        userConfig = builtins.toJSON { config = cfg.settings; };
+        passAsFile = [ "userConfig" ];
+      }
+      # Merge the cfg.settings into the default coolwsd.xml.
+      # See https://github.com/CollaboraOnline/online/issues/10049.
+      ''
+        yq --input-format=xml \
+           --xml-attribute-prefix=@ \
+           --output-format=json \
+           ${cfg.package}/etc/coolwsd/coolwsd.xml \
+           > ./default_coolwsd.json
+
+        jq '.[0] * .[1] | del(..|nulls)' \
+           --slurp \
+           ./default_coolwsd.json \
+           $userConfigPath \
+           > ./merged.json
+
+        yq --output-format=xml \
+           --xml-attribute-prefix=@ \
+           ./merged.json \
+           > $out
+      '';
+in
+{
+  options.services.collabora-online = {
+    enable = lib.mkEnableOption "collabora-online";
+
+    package = lib.mkPackageOption pkgs "Collabora Online" { default = "collabora-online"; };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 9980;
+      description = "Listening port";
+    };
+
+    settings = lib.mkOption {
+      type = freeformType;
+      default = { };
+      description = ''
+        Configuration for Collabora Online WebSocket Daemon, see
+        <https://sdk.collaboraonline.com/docs/installation/Configuration.html>, or
+        <https://github.com/CollaboraOnline/online/blob/master/coolwsd.xml.in> for the default
+        configuration.
+      '';
+    };
+
+    aliasGroups = lib.mkOption {
+      type = lib.types.listOf (
+        lib.types.submodule {
+          options = {
+            host = lib.mkOption {
+              type = lib.types.str;
+              example = "scheme://hostname:port";
+              description = "Hostname to allow or deny.";
+            };
+
+            aliases = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              example = [
+                "scheme://aliasname1:port"
+                "scheme://aliasname2:port"
+              ];
+              description = "A list of regex pattern of aliasname.";
+            };
+          };
+        }
+      );
+      default = [ ];
+      description = "Alias groups to use.";
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Extra arguments to pass to the service.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.collabora-online.settings = {
+      child_root_path = lib.mkDefault "/var/lib/cool/child-roots";
+      sys_template_path = lib.mkDefault "/var/lib/cool/systemplate";
+
+      file_server_root_path = lib.mkDefault "${config.services.collabora-online.package}/share/coolwsd";
+
+      # Use mount namespaces instead of setcap'd coolmount/coolforkit.
+      mount_namespaces = lib.mkDefault true;
+
+      # By default, use dummy self-signed certificates provided for testing.
+      ssl.ca_file_path = lib.mkDefault "${config.services.collabora-online.package}/etc/coolwsd/ca-chain.cert.pem";
+      ssl.cert_file_path = lib.mkDefault "${config.services.collabora-online.package}/etc/coolwsd/cert.pem";
+      ssl.key_file_path = lib.mkDefault "${config.services.collabora-online.package}/etc/coolwsd/key.pem";
+    };
+
+    users.users.cool = {
+      isSystemUser = true;
+      group = "cool";
+    };
+    users.groups.cool = { };
+
+    systemd.services.coolwsd-systemplate-setup = {
+      description = "Collabora Online WebSocket Daemon Setup";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs [
+          "${cfg.package}/bin/coolwsd-systemplate-setup"
+          "/var/lib/cool/systemplate"
+          "${cfg.package.libreoffice}/lib/collaboraoffice"
+        ];
+        RemainAfterExit = true;
+        StateDirectory = "cool";
+        Type = "oneshot";
+        User = "cool";
+      };
+    };
+
+    systemd.services.coolwsd = {
+      description = "Collabora Online WebSocket Daemon";
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+        "coolwsd-systemplate-setup.service"
+      ];
+
+      environment = builtins.listToAttrs (
+        lib.imap1 (n: ag: {
+          name = "aliasgroup${toString n}";
+          value = lib.concatStringsSep "," ([ ag.host ] ++ ag.aliases);
+        }) cfg.aliasGroups
+      );
+
+      serviceConfig = {
+        ExecStart = utils.escapeSystemdExecArgs (
+          [
+            "${cfg.package}/bin/coolwsd"
+            "--config-file=${configFile}"
+            "--port=${toString cfg.port}"
+            "--use-env-vars"
+            "--version"
+          ]
+          ++ cfg.extraArgs
+        );
+        KillMode = "mixed";
+        KillSignal = "SIGINT";
+        LimitNOFILE = "infinity:infinity";
+        Restart = "always";
+        StateDirectory = "cool";
+        TimeoutStopSec = 120;
+        User = "cool";
+      };
+    };
+  };
+
+  meta.maintainers = [ lib.maintainers.xzfc ];
+}

pkgs/by-name/co/collabora-online/fix-file-server-regex.patch

@@ -0,0 +1,15 @@
+In the nix build, COOLWSD_VERSION_HASH becomes the same as COOLWSD_VERSION, e.g.
+`24.04.3.5`.  The web server that serves files from
+`/browser/$COOLWSD_VERSION_HASH`, doesn't expect the hash to contain dots.
+
+--- a/wsd/FileServer.cpp
++++ b/wsd/FileServer.cpp
+@@ -933,7 +933,7 @@ std::string FileServerRequestHandler::getRequestPathname(const HTTPRequest& requ
+ 
+     std::string path(requestUri.getPath());
+ 
+-    Poco::RegularExpression gitHashRe("/([0-9a-f]+)/");
++    Poco::RegularExpression gitHashRe("/([0-9a-f.]+)/");
+     std::string gitHash;
+     if (gitHashRe.extract(path, gitHash))
+     {

pkgs/by-name/co/collabora-online/package.nix

@@ -0,0 +1,105 @@
+{
+  autoreconfHook,
+  cairo,
+  cppunit,
+  fetchFromGitHub,
+  fetchNpmDeps,
+  lib,
+  libcap,
+  libpng,
+  libreoffice-collabora,
+  nodejs,
+  npmHooks,
+  pam,
+  pango,
+  pixman,
+  pkg-config,
+  poco,
+  python3,
+  rsync,
+  stdenv,
+  zstd,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "collabora-online";
+  version = "24.04.6-1";
+
+  src = fetchFromGitHub {
+    owner = "CollaboraOnline";
+    repo = "online";
+    rev = "refs/tags/cp-${finalAttrs.version}";
+    hash = "sha256-0IvymvXAozsjm+GXJK9AGWo79QMaIACrAfkYfX67fBc=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    nodejs
+    npmHooks.npmConfigHook
+    pkg-config
+    python3
+    python3.pkgs.lxml
+    python3.pkgs.polib
+    rsync
+  ];
+
+  buildInputs = [
+    cairo
+    cppunit
+    libcap
+    libpng
+    pam
+    pango
+    pixman
+    poco
+    zstd
+  ];
+
+  configureFlags = [
+    "--disable-setcap"
+    "--disable-werror"
+    "--enable-silent-rules"
+    "--with-lo-path=${libreoffice-collabora}/lib/collaboraoffice"
+    "--with-lokit-path=${libreoffice-collabora.src}/include"
+  ];
+
+  patches = [ ./fix-file-server-regex.patch ];
+
+  postPatch = ''
+    cp ${./package-lock.json} ${finalAttrs.npmRoot}/package-lock.json
+
+    patchShebangs browser/util/*.py coolwsd-systemplate-setup scripts/*
+    substituteInPlace configure.ac --replace-fail '/usr/bin/env python3' python3
+    substituteInPlace coolwsd-systemplate-setup --replace-fail /bin/pwd pwd
+  '';
+
+  # Copy dummy self-signed certificates provided for testing.
+  postInstall = ''
+    cp etc/ca-chain.cert.pem etc/cert.pem etc/key.pem $out/etc/coolwsd
+  '';
+
+  npmDeps = fetchNpmDeps {
+    unpackPhase = "true";
+    # TODO: Use upstream `npm-shrinkwrap.json` once it's fixed
+    # https://github.com/CollaboraOnline/online/issues/9644
+    postPatch = ''
+      cp ${./package-lock.json} package-lock.json
+    '';
+    hash = "sha256-CUh+jwJnKtmzk8w6QwH1Nh92500dFj63ThkI4tN5FyQ=";
+  };
+
+  npmRoot = "browser";
+
+  passthru = {
+    libreoffice = libreoffice-collabora; # Used by NixOS module.
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    description = "Collaborative online office suite based on LibreOffice technology";
+    license = lib.licenses.mpl20;
+    maintainers = [ lib.maintainers.xzfc ];
+    homepage = "https://www.collaboraonline.com";
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/co/collabora-online/update.sh

@@ -0,0 +1,38 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p common-updater-scripts prefetch-npm-deps jq sd
+#shellcheck shell=bash
+
+set -xeu -o pipefail
+
+PACKAGE_DIR="$(realpath "$(dirname "$0")")"
+cd "$PACKAGE_DIR/.."
+while ! test -f default.nix; do cd .. ; done
+NIXPKGS_DIR="$PWD"
+
+new_version="$(
+  list-git-tags --url=https://github.com/CollaboraOnline/online \
+  | grep --perl-regex --only-matching '^cp-\K[0-9.-]+$' \
+  | sort --version-sort \
+  | tail -n1
+)"
+
+cd "$NIXPKGS_DIR"
+update-source-version collabora-online "$new_version"
+
+TMPDIR="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR"' EXIT
+cd "$TMPDIR"
+
+src="$(nix-build --no-link "$NIXPKGS_DIR" -A collabora-online.src)"
+cp "$src"/browser/package.json .
+npm install --package-lock-only
+cp ./package-lock.json "$PACKAGE_DIR"
+
+prev_npm_hash="$(nix-instantiate "$NIXPKGS_DIR" \
+  --eval --json \
+  -A collabora-online.npmDeps.hash \
+  | jq -r .
+)"
+new_npm_hash="$(prefetch-npm-deps ./package-lock.json)"
+
+sd --fixed-strings "$prev_npm_hash" "$new_npm_hash" "$PACKAGE_DIR/package.nix"