[Solved] Is the Collabora Code Mattermost plugin working properly?

I’m using Mattermost 9.11.7 and 10.0.1 separately.

I recently learned about Collabora Code and installed it on a VM in the same network.

I installed the Collabora Mattermost plugin version 1.10.

  • Symptom: The “Edit” button appears, but changes aren’t saved after editing.

  • Error 1: unencoded WOPISrc warning

    • Log message: WRN WOPISrc validation error: unencoded WOPISrc […] in URL […] WOPISrc must be URI-encoded.
    • Details: When the Mattermost plugin calls the Collabora Online editor, it passes the WOPISrc URL parameter containing file information without URL encoding (Percent-encoding).
  • Error 2: Invalid or missing JSON … LastModifiedTime warning

    • Log message: WRN Invalid or missing JSON in WOPI::PutFile HTTP_OK response. Expected json object with a LastModifiedTime value
    • Details: When the Collabora Online server tries to save the edited file back to the Mattermost server (WOPI PutFile request), the Mattermost server (plugin) sends a success (HTTP OK) response, but the response body doesn’t include the LastModifiedTime information (file’s last modification time) in JSON format as required by WOPI specifications.
  • Error 3: StorageManager’s lastModifiedTime doesn’t match… error

    • Log message: ERR StorageManager’s lastModifiedTime […] doesn’t match that of SaveManager’s […]
    • Details: An inconsistency in file modification time information has occurred internally within Collabora.

This is my situation… Is there anyone using this with relatively recent or latest versions of Mattermost? If so, I’d appreciate some help.

Stay healthy and happy always!

This won’t help this issue, but I’d upgrade to 9.11.11 and 10.0.4 (if not to 10.5.2) to get latest bug and security fixes. Version archive - Mattermost documentation

Have you looked at the issues for the plugin GitHub · Where software is built Not a lot of recent activity there, but I did see a mention of some issues that were resolved by moving from a Docker deployment to a VM deployment.

Take a look at GitHub - coltoneshaw/mattermost-collabra-demo I’ve used it a few times to demo the Collabara plugin. There may be some info that’ll help. It is absolutely possible that more recent versions of Mattermost introduced a change that nobody’s noticed yet… a lot of Mattermost instances are running surprisingly old versions (if it ain’t broke, don’t fix it!) and maybe the folks using Collabara just haven’t noticed yet.

I’ve already checked the plugin’s issue tab on GitHub.

Unfortunately, while there are some issues raised by users, there has been no official feedback, and even the pull requests submitted by the community haven’t been merged. It seems that the official plugin is no longer compatible with recent versions of Mattermost.

I’ve made considerable efforts to fix the issue myself — including rebuilding the plugin with URL encoding fixes and various other attempts — but since I’m not a developer, I’ve hit a wall and couldn’t make further progress.

That’s why I’m posting here in the hope that someone might be able to help.

I still hope the Collabora team will update the plugin officially, but it seems like they’re no longer interested in maintaining it.

I’ll ask and see if we can’t get this looked at.

2 Likes

If the Mattermost team could work on resolving this issue, it would be a tremendous help to many users.
Thank you.

ps.)

log -
Mar 28 10:31:36 code coolwsd[8338]: wsd-08338-08351 2025-03-28 10:31:36.476698 +0900 [ websrv_poll ] WRN WOPISrc validation error: unencoded WOPISrc [https://matter2.aaaaa.aaaaa/plugins/com.collaboraonline.mattermost/wopi/files/tc7fht6pnb8b8f9dn65eequy9c] in URL: /browser/ded56d8ff7/cool.html?WOPISrc=https://matter2.aaaaa.aaaaa/plugins/com.collaboraonline.mattermost/wopi/files/tc7fht6pnb8b8f9dn65eequy9c| wsd/RequestDetails.cpp:37

Mar 28 10:31:36 code coolwsd[8338]: wsd-08338-08351 2025-03-28 10:31:36.476772 +0900 [ websrv_poll ] WRN WOPISrc validation error: unencoded WOPISrc [https://matter2.aaaaa.aaaaa/plugins/com.collaboraonline.mattermost/wopi/files/tc7fht6pnb8b8f9dn65eequy9c] in URL: /browser/ded56d8ff7/cool.html?WOPISrc=https://matter2.aaaaa.aaaaa/plugins/com.collaboraonline.mattermost/wopi/files/tc7fht6pnb8b8f9dn65eequy9c| wsd/RequestDetails.cpp:37

Analysis of the WOPISrc Validation Error

The error messages shown in your logs come from the Collabora Online server (coolwsd process):

WRN WOPISrc validation error: unencoded WOPISrc [https://matter2.aaaaa.aaaaaplugins/com.collaboraonline.mattermost/wopi/files/tc7fht6pnb8b8f9dn65eequy9c] in URL: /browser/ded56d8ff7/cool.html?WOPISrc=https://matter2.aaaaa.aaaaa/plugins/com.collaboraonline.mattermost/wopi/files/tc7fht6pnb8b8f9dn65eequy9c

Core Issue Identified

The fundamental problem is a missing URL encoding in the communication between the Mattermost plugin and Collabora Online:

  1. Protocol Requirements: The WOPI (Web Application Open Platform Interface) protocol specification requires that the WOPISrc parameter be properly URL-encoded (percent-encoded).
  2. Current Implementation Problem: The Mattermost Collabora plugin (v1.10) is passing the raw, unencoded URL directly as a parameter:
/browser/ded56d8ff7/cool.html?WOPISrc=https://matter2.aaaaa.aaaaa/plugins/com.collaboraonline.mattermost/wopi/files/tc7fht6pnb8b8f9dn65eequy9c
  1. Expected Format: The properly encoded URL should look like:
/browser/ded56d8ff7/cool.html?WOPISrc=https%3A%2F%2Fmatter2.aaaaa.aaaaa%2Fplugins%2Fcom.collaboraonline.mattermost%2Fwopi%2Ffiles%2Ftc7fht6pnb8b8f9dn65eequy9c

Where special characters like : and / are encoded as %3A and %2F respectively.
4. Validation Enforcement: The error is being triggered in the Collabora codebase at wsd/RequestDetails.cpp:37, which is likely performing validation on incoming requests.

Root Cause

This is a code-level defect in the Mattermost Collabora plugin (v1.10):

  1. The plugin’s code is not using proper URL encoding functions when constructing the request URL with the WOPISrc parameter.
  2. This appears to be a compatibility issue that’s manifesting with newer Mattermost versions possibly due to changes in how the plugin interfaces with the updated Mattermost API.

Just for transparency, Collabara developed that plugin, not Mattermost. I’ve reached out to them and to a developer who worked on it at one point. Hopefully, they’ll see the value of fixing it.

I understand well that the Mattermost Collabora plugin was not created by Mattermost. As mentioned in my first reply, it was created by the Collabora team, but it seemed they are no longer maintaining this plugin.

I would be glad if they showed interest in this plugin again and fixed it after receiving your contact.

Thank you.

Some 2c from my side.

We’re using the Collabora Plugin version 1.2.0 with the latest Mattermost 10.6.1 and an up-to-date Debain based Collabora standalone WOPI server. Works without any issues. The WOPI connections are made thru the NGINX proxy also used for Mattermost.

The only thing missing is, that we cannot create new files from within Mattermost, but that’s not a real issue. Editing / viewing files works, also collaborative editing on a file. Updates are stored to the file in Mattermost.

For us this is a great solution.

If I recall this correctly, I build version 1.2.0 from the github repo on my own, which also enabled the file permission settings etc. I’ll try to find the binaries, if you’re interested & could post them in a DM on community.mattermost.com (@jprusch)
I can also provide a redacted collabora wopi config from our server.

Best regards

JP

1 Like

Hello,

I have been trying to apply the Collabora plugin in the latest version of Mattermost, but despite significant effort, I’ve been unsuccessful (the file editing feature exists in Mattermost, but changes aren’t saved when editing and saving).

To solve this issue, I’ve attempted to build it myself, but since I’m not a developer, I’ve repeatedly failed and that’s why I’m asking for help.

If you could share the 1.2.0 binary that you built, I would be extremely grateful.

You would be an enormous help to me. I will send you a DM on community.mattermost.com.

Thank you very much!

1 Like

Hi,
I created a tgz from our installed, working plugin (1.2.0)

Nothing guaranteed, feel free to play around with it.

3 Likes

Just got a confirmation from @EricKim that the plugin is working on his side.

2 Likes

Hey, thanks for the great help so far and sorry to bring this up again.

I am running a fresh debian 12 server with

  • mattermost 10.4.2 and
  • collabora 24.04.13.2 and
  • mattermost collabora plugin 1.2.0 ( thanks @jprusch1 )
  • “The WOPI connections are made thru the NGINX proxy also used for Mattermost.”

The collabora plugins is installed, enabled and showing the extra buttons when clicking on the send attachment button in mattermost.

BUT:

  1. Creating / Attaching new files doesnt work
    After clicking on “New document” (or any other button) the file name popup opens. When I choose a file name and click create: nothing happens.

  2. Editing existing attachments doesnt work
    I can not view / edit the files, whatever I do: I download the attachment.

Mattermost log and coolwsd log don’t show any errors (actually coolwsd log shows no new entry when I try to edit files in mattermost)

I tried to rule out ssl certificate errors (letsEncypt certificate installed) or IP errors (I used servers external IP / localhost / 0.0.0.0)

Maybe someone has a clue?

PS: after writing this I upgraded to mattermost 10.6.1, collabora plugin is still not working :frowning:

jprusch1 does not allow you to create new files with the plugin provided by , but view and edit work well for files that have been sent and received…

You mean you can’t edit or edit it? Are you using a plugin downloaded from Google Drive?

1 Like

Hi,
the 1.2.0 plugin should be working with all server versions up to 10.7.1 (latest)

Plugin config Mattermost:

We run an NGINX proxy on the same host as the CODE server to terminate SSL & proxy the requests:

site config:

server {
   listen       443 ssl;
   server_name  collabora.YOURDOMAIN;

   ssl_certificate /etc/ssl/YOURDOMAIN/bundle.YOURDOMAIN.crt;
   ssl_certificate_key /etc/ssl/YOURDOMAIN/wildcard.YOURDOMAIN.key;

    # static files
    location ^~ /browser {
        proxy_pass http://127.0.0.1:9980;
        proxy_set_header Host $http_host;
    }

    # WOPI discovery URL
    location ^~ /hosting/discovery {
        proxy_pass http://127.0.0.1:9980;
        proxy_set_header Host $http_host;
    }

    # Capabilities
    location ^~ /hosting/capabilities {
        proxy_pass http://127.0.0.1:9980;
        proxy_set_header Host $http_host;
    }

    # main websocket
    location ~ ^/cool/(.*)/ws$ {
        proxy_pass http://127.0.0.1:9980;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $http_host;
        proxy_read_timeout 36000s;
    }

    # download, presentation and image upload
    location ~ ^/(c|l)ool {
        proxy_pass http://127.0.0.1:9980;
        proxy_set_header Host $http_host;
    }

    # Admin Console websocket
    location ^~ /cool/adminws {
        proxy_pass http://127.0.0.1:9980;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $http_host;
        proxy_read_timeout 36000s;
    }
}

coolwsd.xml config:

<!-- -*- nxml-child-indent: 4; tab-width: 4; indent-tabs-mode: nil -*- -->
<config>
	<!-- For more detailed documentation on typical configuration options please see:
         https://sdk.collaboraonline.com/docs/installation/Configuration.html -->
	<!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. -->
	<!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. -->
	<allowed_languages default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru" desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance.">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages>

	<languagetool desc="LanguageTool Remote API settings for grammar checking">
        	<enabled desc="Enable LanguageTool Remote Grammar Checker" type="bool" default="false"></enabled>
	        <base_url desc="Http endpoint for the LanguageTool API server, without /check or /languages postfix at the end." type="string" default=""></base_url>
	        <user_name desc="LanguageTool account username for premium usage." type="string" default=""></user_name>
	        <api_key desc="Api key provided by LanguageTool account for premium usage." type="string" default=""></api_key>
	        <ssl_verification desc="Enable or disable SSL verification" type="string" default="true"></ssl_verification>
	</languagetool>

<!--
	<deepl desc="DeepL API settings for translation service">
        	<api_url desc="URL for the API" type="string" default=""></api_url>
	        <auth_key desc="Auth Key generated by your account" type="string" default=""></auth_key>
	</deepl>
-->

	<sys_template_path default="systemplate" desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." relative="true" type="path"/>
	<child_root_path default="jails" desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." relative="true" type="path"/>
	<mount_jail_tree default="true" desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool"/>

	<server_name default="" desc="External hostname:port of the server running coolwsd. If empty, it's derived from the request (please set it if this doesn't work). Must be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string"/>
	<file_server_root_path default="browser/../" desc="Path to the directory that should be considered root for the file server. This should be the directory containing cool." relative="true" type="path"/>
	<hexify_embedded_urls default="false" desc="Enable to protect encoded URLs from getting decoded by intermediate hops. Particularly useful on Azure deployments" type="bool"/>
	<experimental_features desc="Enable/Disable experimental features" type="bool" default="true">true</experimental_features>

	<memproportion default="80.0" desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents" type="double"/>
	<num_prespawn_children default="1" desc="Number of child processes to keep started in advance and waiting for new clients." type="uint">1</num_prespawn_children>
	<!-- <fetch_update_check desc="Every number of hours will fetch latest version data. Defaults to 10 hours." type="uint" default="10">10</fetch_update_check> -->
	<per_document desc="Document-specific settings, including LO Core settings.">
		<max_concurrency default="4" desc="The maximum number of threads to use while processing a document." type="uint">4</max_concurrency>
		<batch_priority default="5" desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint">5</batch_priority>
		<document_signing_url default="" desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string"/>
		<redlining_as_comments default="false" desc="If true show red-lines as comments" type="bool">false</redlining_as_comments>
		<pdf_resolution_dpi default="96" desc="The resolution, in DPI, used to render PDF documents as image. Memory consumption grows proportionally. Must be a positive value less than 385. Defaults to 96." type="uint">200</pdf_resolution_dpi>
		<idle_timeout_secs default="3600" desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint">3600</idle_timeout_secs>
		<idlesave_duration_secs default="30" desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="int">30</idlesave_duration_secs>
		<autosave_duration_secs default="300" desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="int">300</autosave_duration_secs>
		<always_save_on_exit default="false" desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool">false</always_save_on_exit>
		<limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb>
		<limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb>
		<limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb>
		<limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files>
		<limit_load_secs default="100" desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint">100</limit_load_secs>
		<limit_convert_secs default="100" desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint">100</limit_convert_secs>
<!--		<min_time_between_saves_ms desc="Minimum number of milliseconds between saving the document on disk." type="uint" default="500"">500</min_time_between_saves_ms> -->
        	<min_time_between_uploads_ms desc="Minimum number of milliseconds between uploading the document to storage." type="uint" default="5000">5000</min_time_between_uploads_ms>
		<cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="true">
			<cleanup_interval_ms default="10000" desc="Interval between two checks" type="uint">10000</cleanup_interval_ms>
			<bad_behavior_period_secs default="60" desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint">60</bad_behavior_period_secs>
			<idle_time_secs default="300" desc="Minimum idle time for a document to be candidate for bad state" type="uint">300</idle_time_secs>
			<limit_dirty_mem_mb default="3072" desc="Minimum memory usage for a document to be candidate for bad state" type="uint">3072</limit_dirty_mem_mb>
			<limit_cpu_per default="85" desc="Minimum CPU usage for a document to be candidate for bad state" type="uint">85</limit_cpu_per>
			<lost_kit_grace_period_secs default="120" desc="The minimum grace period for a lost kit process (not referenced by coolwsd) to resolve its lost status before it is terminated. To disable the cleanup of lost kits use value 0">120</lost_kit_grace_period_secs>
		</cleanup>
	</per_document>

	<per_view desc="View-specific settings.">
		<out_of_focus_timeout_secs default="120" desc="The maximum number of seconds before dimming and stopping updates when the browser tab is no longer in focus. Defaults to 120 seconds." type="uint">120</out_of_focus_timeout_secs>
		<idle_timeout_secs default="900" desc="The maximum number of seconds before dimming and stopping updates when the user is no longer active (even if the browser is in focus). Defaults to 15 minutes." type="uint">900</idle_timeout_secs>
		<group_download_as type="bool" default="false">true</group_download_as>
	</per_view>

	<ver_suffix default="" desc="Appended to etags to allow easy refresh of changed files during development" type="string"/>

	<logging>
		<color type="bool">true</color>
		<!--
             		Note to developers: When you do "make run", the logging.level will be set on the
             		coolwsd command line, so if you want to change it for your testing, do it in
             		Makefile.am, not here.
        	-->
		<level default="warning" desc="Can be 0-8 (with the lowest numbers being the least verbose), or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" type="string">notice</level>
		<most_verbose_level_settable_from_client default="notice" desc="A loggingleveloverride message from the client can not set a more verbose log level than this" type="string">debug</most_verbose_level_settable_from_client>
		<least_verbose_level_settable_from_client default="fatal" desc="A loggingleveloverride message from a client can not set a less verbose log level than this" type="string">fatal</least_verbose_level_settable_from_client>
		<protocol desc="Enable minimal client-site JS protocol logging from the start" type="bool">false</protocol>
		<!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav"
	             See also: https://docs.libreoffice.org/sal/html/sal_log.html -->
		<lokit_sal_log default="-INFO-WARN" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." type="string">-INFO-WARN</lokit_sal_log>
		<file enable="false">
			<!-- If you use other path than /var/log and you run coolwsd from systemd, make sure that you enable that path in coolwsd.service (ReadWritePaths). -->
			<property desc="Log file path." name="path">/var/log/coolwsd</property>
			<property desc="Log file rotation strategy. See Poco FileChannel." name="rotation">never</property>
			<property desc="Append either timestamp or number to the archived log filename." name="archive">timestamp</property>
			<property desc="Enable/disable log file compression." name="compress">true</property>
			<property desc="The maximum age of log files to preserve. See Poco FileChannel." name="purgeAge">10 days</property>
			<property desc="The maximum number of log archives to preserve. Use 'none' to disable purging. See Poco FileChannel." name="purgeCount">10</property>
			<property desc="Enable/disable log file rotation on opening." name="rotateOnOpen">true</property>
			<property desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order." name="flush">false</property>
		</file>
		<anonymize>
			<anonymize_user_data default="false" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." type="bool">false</anonymize_user_data>
			<anonymization_salt default="82589933" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." type="uint">82589933</anonymization_salt>
		</anonymize>
	</logging>

	<!--
         Note to developers: When you do "make run", the trace_event[@enable] will be set on the
         coolwsd command line, so if you want to change it for your testing, do it in Makefile.am,
         not here.
	-->
	<trace_event desc="The possibility to turn on generation of a Chrome Trace Event file" enable="false">
		<path default="/var/log/coolwsd.trace.json" desc="Output path for the Trace Event file, to which they will be written if turned on at run-time" type="string">/var/log/coolwsd.trace.json</path>
	</trace_event>

	<browser_logging default="false" desc="Logging in the browser console">false</browser_logging>

	<trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="false">
		<path compress="true" desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /some/path/to/cooltrace-%.gz" snapshot="false"/>
		<filter>
			<message desc="Regex pattern of messages to exclude"/>
		</filter>
		<outgoing>
			<record default="false" desc="Whether or not to record outgoing messages">false</record>
		</outgoing>
	</trace>

	<net desc="Network settings">
	<!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, coolwsd unexpectedly listens on [::1] only.
             You need to change net.proto to IPv4, if you want to use 127.0.0.1. -->
		<proto default="all" desc="Protocol to use IPv4, IPv6 or all for both" type="string">all</proto>
		<listen default="any" desc="Listen address that coolwsd binds to. Can be 'any' or 'loopback'." type="string">any</listen>
		<!-- this allows you to shift all of our URLs into a sub-path from
	           https://my.com/browser/a123... to https://my.com/my/sub/path/browser/a123... -->
		<service_root default="" desc="Prefix all the pages, websockets, etc. with this path." type="path"/>
		<post_allow allow="true" desc="Allow/deny client IP address for POST(REST).">
			<host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
			<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
			<host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host>
			<host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host>
			<host desc="The IPv6 loopback (localhost) address.">::1</host>
			<host desc="The IPv4 private 172.17.0.0/16 subnet (Docker).">172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host>
			<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host>
			<host desc="The IPv4 private 10.0.0.0/8 subnet (Podman).">10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
			<host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host>
			<!-- Allow ALL for testing -->
			<!-- <host desc="All IP v4 addrsses">[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host> -->
                        <!-- <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host> -->
		</post_allow>
		<frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (coolwsd and WOPI host are always allowed). Separate multiple hosts by space."/>
		<connection_timeout_secs default="30" desc="Specifies the connection, send, recv timeout in seconds for connections initiated by coolwsd (such as WOPI connections)." type="int"/>
		<!-- this setting radically changes how online works, it should not be used in a production environment -->
		<proxy_prefix default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests" type="bool"/>
	</net>
	
	<ssl desc="SSL settings"> <!-- We terminate SSL at nginx proxy on same machine -->
		<!-- switches from https:// + wss:// to http:// + ws:// -->
		<enable default="true" desc="Controls whether SSL encryption between coolwsd and the network is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." type="bool">false</enable>
		<!-- SSL off-load can be done in a proxy, if so disable SSL, and enable termination below in production -->
		<termination default="true" desc="Connection via proxy where coolwsd acts as working via https, but actually uses http." type="bool">true</termination>
		<cert_file_path desc="Path to the cert file" relative="false">/etc/coolwsd/cert.pem</cert_file_path>
		<key_file_path desc="Path to the key file" relative="false">/etc/coolwsd/key.pem</key_file_path>
		<ca_file_path desc="Path to the ca file" relative="false">/etc/coolwsd/ca-chain.cert.pem</ca_file_path>
		<cipher_list default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH" desc="List of OpenSSL ciphers to accept"/>
		<hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false">
			<max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age>
			<report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"/>
			<pins desc="Base64 encoded SPKI fingerprints of keys to be pinned">
			<pin></pin>
			</pins>
		</hpkp>
	</ssl>

	<security desc="Altering these defaults potentially opens you to significant risk">
		<seccomp default="true" desc="Should we use the seccomp system call filtering." type="bool">true</seccomp>
		<capabilities default="true" desc="Should we require capabilities to isolate processes into chroot jails" type="bool">true</capabilities>
		<jwt_expiry_secs default="1800" desc="Time in seconds before the Admin Console's JWT token expires" type="int">1800</jwt_expiry_secs>
		<enable_macros_execution default="false" desc="Specifies whether the macro execution is enabled in general. This will enable Basic, Beanshell, Javascript and Python scripts. If it is set to false, the macro_security_level is ignored. If it is set to true, the mentioned entry specified the level of macro security." type="bool">true</enable_macros_execution>
		<macro_security_level default="1" desc="Level of Macro security. 1 (Medium) Confirmation required before executing macros from untrusted sources. 0 (Low, not recommended) All macros will be executed without confirmation." type="int">1</macro_security_level>
		<enable_metrics_unauthenticated default="false" desc="When enabled, the /cool/getMetrics endpoint will not require authentication." type="bool">false</enable_metrics_unauthenticated>
	</security>

	<certificates>
		<database_path type="string" desc="Path to the NSS certificates that are used for signing documents" default=""></database_path>
	</certificates>

	<watermark>
		<opacity default="0.2" desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double"/>
		<text desc="Watermark text to be displayed on the document if entered" type="string"/>
	</watermark>

	<welcome>
		<enable default="true" desc="Controls whether the welcome screen should be shown to the users on new install and updates." type="bool">false</enable>
		<enable_button default="false" desc="Controls whether the welcome screen should have an explanatory button instead of an X button to close the dialog." type="bool">false</enable_button>
		<path default="browser/welcome" desc="Path to 'welcome-$lang.html' files served on first start or when the version changes. When empty, defaults to the Release notes." relative="true" type="path"/>
	</welcome>

	<user_interface>
		<mode default="default" desc="Controls the user interface style. The 'default' means: Take the value from ui_defaults, or decide for one of classic or notebookbar (default|classic|notebookbar)" type="string">tabbed</mode>
		<use_integration_theme default="true" type="bool">true</use_integration_theme>
	</user_interface>

	<storage desc="Backend storage">
		<filesystem allow="false"/>
		<wopi allow="true" desc="Allow/deny wopi storage.">
			<host allow="true" desc="Regex pattern of hostname to allow or deny.">mattermost\.YOURDOMAIN</host>
			<host allow="true" desc="Regex pattern of hostname to allow or deny.">YOURIP</host>
			<host allow="true" desc="Regex pattern of hostname to allow or deny.">localhost</host>
			<host allow="true" desc="Regex pattern of hostname to allow or deny.">10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}</host> <!-- We allow all non public net access -->
			<host allow="true" desc="Regex pattern of hostname to allow or deny.">172\.1[6789]\.[0-9]{1,3}\.[0-9]{1,3}</host>
			<host allow="true" desc="Regex pattern of hostname to allow or deny.">172\.2[0-9]\.[0-9]{1,3}\.[0-9]{1,3}</host>
			<host allow="true" desc="Regex pattern of hostname to allow or deny.">172\.3[01]\.[0-9]{1,3}\.[0-9]{1,3}</host>
			<host allow="true" desc="Regex pattern of hostname to allow or deny.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
			<host allow="false" desc="Regex pattern of hostname to allow or deny.">192\.168\.1\.1</host>
			<max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size>
			<locking desc="Locking settings"></locking>
		</wopi>
		<ssl desc="SSL settings">
			<as_scheme default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage" type="bool">true</as_scheme>
			<enable desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and coolwsd. When empty this defaults to following the ssl.enable setting" type="bool"/>
			<cert_file_path desc="Path to the cert file" relative="false"/>
			<key_file_path desc="Path to the key file" relative="false"/>
			<ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"/>
			<cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overridden only if absolutely needed."/>
		</ssl>
	</storage>

	<tile_cache_persistent default="true" desc="Should the tiles persist between two editing sessions of the given document?" type="bool">true</tile_cache_persistent>

	<admin_console desc="Web admin console settings.">
		<enable default="true" desc="Enable the admin console functionality" type="bool">true</enable>
		<enable_pam default="false" desc="Enable admin user authentication with PAM" type="bool">false</enable_pam>
		<username desc="The username of the admin console. Ignored if PAM is enabled.">admin</username>
		<password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or coolconfig to set up a secure password.">1qayVFR$</password>
	</admin_console>

	<monitors desc="Addresses of servers we connect to on start for monitoring">
	</monitors>

	<quarantine_files default="false" desc="Files are stored here to be examined later in cases of crashes or similar situation." enable="false">
		<limit_dir_size_mb default="250" desc="Maximum directory size. On exceeding the specified limit, older files will be deleted." type="uint"/>
		<max_versions_to_maintain default="2" desc="How many versions of the same file to keep." type="uint"/>
		<path default="quarantine" desc="Path to directory under which quarantined files will be stored" relative="true" type="path"/>
		<expiry_min default="30" desc="Time in mins after quarantined files will be deleted." type="int"/>
	</quarantine_files>

	<remote_config>
        	<remote_url desc="remote server to which you will send resquest to get remote config in response" type="string" default=""></remote_url>
	</remote_config>

	<remote_font_config>
        	<url desc="URL of optional JSON file that lists fonts to be included in Online" type="string" default=""></url>
	</remote_font_config>

	<home_mode>
        	<enable desc="Enable more configuration options for home users" type="bool" default="false">false</enable>
	</home_mode>

</config>

Nginx access logs will log something when the connection is working.
Also try
https://collabora.YOURDOMAIN/hosting/discovery
This should give you a list of all supported endpoints of the WOPI Code server & indicates that your proxy is working.
Check the backend storage settings in coolwsd.xml to support your Mattermost server IP/URLs.

Hope this helps.

1 Like

Yes I meant i can not edit an uploaded / posted file. I downloaded the plugin from google drive.

@jprusch1: I went through nginx config and coolwsd conf. Couldnt identify problems.

  • Collabora is working for other software (nextcloud).
  • /hosting/discovery gives back a xml.
  • The collabora plugin is enabled and running (i can see the collabora file creation menu when clicking on “upload file” (attachment button).
  • i cant find anything in the logs :frowning:
    • mattermost: nothing
    • nginx access / error: nothing
    • coolwsd: nothing

Only hint I have so far: In the website inspector I see that there are “301” produced mattermost is loading the plugin.

Concerning creating new files:
In the website inspector (developer tools) i can see that the collabora plugin seems to call the wrong path “DOMAIN.TLD/plugins” instead of “DOMAIN.TLD/mattermost/plugins”.

At least my nginx doesnt like the first path :frowning:

EDIT: I successfully rewrote the URL with nginx (add “/mattermost” when only “plugins” is called). Now I can VIEW and EDIT uploaded files wit collabora :upside_down_face:

1 Like

Thanks so much @mo-kuh for following up with the work around!