Configuring a reverse proxy for LOOL

From The Document Foundation Wiki
Jump to navigation Jump to search

Configuring a reverse proxy for LibreOffice Online

Getting a Let's Encrypt SSL certificate

The Docker container works with a self-signed SSL certificate. To make your instance available from outside, however, your reverse proxy needs a proper SSL certificate, e.g. from Let's Encrypt. To assist with that process, various clients are available. In the following quick sample, we'll use, which is a bash script handling certificate creation. To install on Debian 10, you can run the following commands (although installation as root is discouraged!):

apt -y install socat
cd ~
git clone
./ --install --home /opt/ --config-home /etc/ --accountemail your@mail.address

To actually create the certificates, the following commands can be used: --issue --keylength ec-384 --domain --domain --standalone --cert-file /etc/ssl/certs/ --key-file /etc/ssl/private/ --ca-file /etc/ssl/certs/ --fullchain-file /etc/ssl/certs/ --reloadcmd "service nginx force-reload" --issue --keylength 4096 --domain --domain --standalone --cert-file /etc/ssl/certs/ --key-file /etc/ssl/private/ --ca-file /etc/ssl/certs/ --fullchain-file /etc/ssl/certs/ --reloadcmd "service nginx force-reload"

You can add as many --domain statements as needed, to have a certificate that covers several hostnames.

Much more convenient than using the reloadcmd is the stateless mode. In any case, don't forget to add a cron job for automated certificate renewal.



On Debian 10, the nginx-light package is sufficient to act as reverse proxy. If you strengthened your SSL parameter configuration with the help of or and you have the server-wide ssl_ecdh_curve directive set, the highest value supported seems to be secp384r1.

A sample nginx configuration (/etc/nginx/nginx.conf) that seems to be working is as follows:

user www-data;
worker_processes auto;
pid /run/;
include /etc/nginx/modules-enabled/*.conf;

events {
 worker_connections 768;

http {
 sendfile on;
 tcp_nopush on;
 keepalive_timeout 65;
 types_hash_max_size 2048;

 server_tokens off;
 index index.html index.php;
 autoindex off;
 disable_symlinks on;
 client_max_body_size 512m;

 include /etc/nginx/mime.types;
 default_type application/octet-stream;

 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_prefer_server_ciphers on;
 ssl_ecdh_curve secp384r1;
 ssl_session_timeout 10m;
 ssl_session_cache shared:SSL:10m;
 ssl_session_tickets off;
 ssl_stapling on;
 ssl_stapling_verify on;

 access_log /var/log/nginx/access.log;
 error_log /var/log/nginx/error.log;

 gzip on;
 gzip_vary on;

 include /etc/nginx/conf.d/*.conf;
 include /etc/nginx/sites-enabled/*;

For the virtual site definition, the following template needs to be filled with the actual proxying (see the articles at [1] and [2]) to your LOOL instance:

server {
 root /var/www/;

 access_log /var/log/nginx/;
 error_log /var/log/nginx/ error;

 listen 80;
 listen [::]:80;
 return 301 https://$host$request_uri;

server {
 root /var/www/;

 access_log /var/log/nginx/;
 error_log /var/log/nginx/ error;

 listen 443 ssl http2;
 listen [::]:443 ssl http2;
 add_header Strict-Transport-Security "max-age=15768000" always;

 ssl_certificate /etc/ssl/certs/;
 ssl_certificate_key /etc/ssl/private/;
 ssl_certificate /etc/ssl/certs/;
 ssl_certificate_key /etc/ssl/private/;

 # Add proxying to your LOOL instance here


You also might want to setup a robots.txt file to prevent search engines from indexing your site:

User-Agent: *
Disallow: /


No special configuration is needed to run LOOL behind HAProxy. Something like this should perfectly fit:

frontend https_in
	bind *:443 ssl crt /etc/letsencrypt/live/lool.domain.tld/haproxy.pem
	option httplog
	option forwardfor

	acl host_lool hdr(host) -i lool.domain.tld
	use_backend lool if host_lool

backend lool
	server lool1 check ssl verify none