Configuring a reverse proxy for LOOL

    From The Document Foundation Wiki

    Configuring a reverse proxy for LibreOffice Online

    Getting a Let's Encrypt SSL certificate

    The Docker container works with a self-signed SSL certificate. To make your instance available from outside, however, your reverse proxy needs a proper SSL certificate, e.g. from Let's Encrypt. To assist with that process, various clients are available. In the following quick sample, we'll use acme.sh, which is a bash script handling certificate creation. To install acme.sh on Debian 10, you can run the following commands (although installation as root is discouraged!):

    apt -y install socat
    cd ~
    git clone https://github.com/Neilpang/acme.sh.git
    cd acme.sh
    ./acme.sh --install --home /opt/acme.sh --config-home /etc/acme.sh --accountemail your@mail.address

    To actually create the certificates, the following commands can be used:

    acme.sh --issue --keylength ec-384 --domain your.cloud.domain --domain your.other.cloud.domain --standalone --cert-file /etc/ssl/certs/your.cloud.domain.ecc.cert.pem --key-file /etc/ssl/private/your.cloud.domain.ecc.key.pem --ca-file /etc/ssl/certs/your.cloud.domain.ecc.ca.pem --fullchain-file /etc/ssl/certs/your.cloud.domain.ecc.chain.pem --reloadcmd "service nginx force-reload"
    
    acme.sh --issue --keylength 4096 --domain your.cloud.domain --domain your.other.cloud.domain --standalone --cert-file /etc/ssl/certs/your.cloud.domain.cert.pem --key-file /etc/ssl/private/your.cloud.domain.key.pem --ca-file /etc/ssl/certs/your.cloud.domain.ca.pem --fullchain-file /etc/ssl/certs/your.cloud.domain.chain.pem --reloadcmd "service nginx force-reload"

    You can add as many --domain statements as needed, to have a certificate that covers several hostnames.

    Much more convenient than using the reloadcmd is the stateless mode. In any case, don't forget to add a cron job for automated certificate renewal.

    Apache

    nginx

    On Debian 10, the nginx-light package is sufficient to act as reverse proxy. If you strengthened your SSL parameter configuration with the help of https://bettercrypto.org or https://github.com/RaymiiOrg/cipherli.st and you have the server-wide ssl_ecdh_curve directive set, the highest value supported seems to be secp384r1.

    A sample nginx configuration (/etc/nginx/nginx.conf) that seems to be working is as follows:

    user www-data;
    worker_processes auto;
    pid /run/nginx.pid;
    include /etc/nginx/modules-enabled/*.conf;
    
    events {
     worker_connections 768;
    }
    
    http {
     sendfile on;
     tcp_nopush on;
     keepalive_timeout 65;
     types_hash_max_size 2048;
    
     server_tokens off;
     index index.html index.php;
     autoindex off;
     disable_symlinks on;
     client_max_body_size 512m;
    
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
    
     ssl_protocols TLSv1.2 TLSv1.3;
     ssl_prefer_server_ciphers on;
     ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
     ssl_ecdh_curve secp384r1;
     ssl_session_timeout 10m;
     ssl_session_cache shared:SSL:10m;
     ssl_session_tickets off;
     ssl_stapling on;
     ssl_stapling_verify on;
    
     access_log /var/log/nginx/access.log;
     error_log /var/log/nginx/error.log;
    
     gzip on;
     gzip_vary on;
    
     include /etc/nginx/conf.d/*.conf;
     include /etc/nginx/sites-enabled/*;
    }

    For the virtual site definition, the following template needs to be filled with the actual proxying (see the articles at [1] and [2]) to your LOOL instance:

    server {
     server_name your.cloud.domain;
     root /var/www/your.cloud.domain;
    
     access_log /var/log/nginx/your.cloud.domain.access.log;
     error_log /var/log/nginx/your.cloud.domain.error.log error;
    
     listen 80;
     listen [::]:80;
     return 301 https://$host$request_uri;
    }
    
    server {
     server_name your.cloud.domain;
     root /var/www/your.cloud.domain;
    
     access_log /var/log/nginx/your.cloud.domain.access.log;
     error_log /var/log/nginx/your.cloud.domain.error.log error;
    
     listen 443 ssl http2;
     listen [::]:443 ssl http2;
     add_header Strict-Transport-Security "max-age=15768000" always;
    
     ssl_certificate /etc/ssl/certs/your.cloud.domain.chain.pem;
     ssl_certificate_key /etc/ssl/private/your.cloud.domain.key.pem;
     ssl_certificate /etc/ssl/certs/your.cloud.domain.ecc.chain.pem;
     ssl_certificate_key /etc/ssl/private/your.cloud.domain.ecc.key.pem;
    
     # Add proxying to your LOOL instance here
    
    }

    You also might want to setup a robots.txt file to prevent search engines from indexing your site:

    User-Agent: *
    Disallow: /
    

    haproxy

    No special configuration is needed to run LOOL behind HAProxy. Something like this should perfectly fit:

    frontend https_in
    	bind *:443 ssl crt /etc/letsencrypt/live/lool.domain.tld/haproxy.pem
    	option httplog
    	option forwardfor
    
    	acl host_lool hdr(host) -i lool.domain.tld
    	use_backend lool if host_lool
    
    
    
    backend lool
    	server lool1 127.0.0.1:9980 check ssl verify none