Configuring a reverse proxy for LOOL

Configuring a reverse proxy for LibreOffice Online

Getting a Let's Encrypt SSL certificate

The Docker container works with a self-signed SSL certificate. To make your instance available from outside, however, your reverse proxy needs a proper SSL certificate, e.g. from Let's Encrypt. To assist with that process, various clients are available. In the following quick sample, we'll use acme.sh, which is a bash script handling certificate creation. To install acme.sh on Debian 10, you can run the following commands (although installation as root is discouraged!):

apt -y install socat
cd ~
git clone https://github.com/Neilpang/acme.sh.git
cd acme.sh
./acme.sh --install --home /opt/acme.sh --config-home /etc/acme.sh --accountemail your@mail.address

To actually create the certificates, the following commands can be used:

acme.sh --issue --keylength ec-384 --domain your.cloud.domain --domain your.other.cloud.domain --standalone --cert-file /etc/ssl/certs/your.cloud.domain.ecc.cert.pem --key-file /etc/ssl/private/your.cloud.domain.ecc.key.pem --ca-file /etc/ssl/certs/your.cloud.domain.ecc.ca.pem --fullchain-file /etc/ssl/certs/your.cloud.domain.ecc.chain.pem --reloadcmd "service nginx force-reload"

acme.sh --issue --keylength 4096 --domain your.cloud.domain --domain your.other.cloud.domain --standalone --cert-file /etc/ssl/certs/your.cloud.domain.cert.pem --key-file /etc/ssl/private/your.cloud.domain.key.pem --ca-file /etc/ssl/certs/your.cloud.domain.ca.pem --fullchain-file /etc/ssl/certs/your.cloud.domain.chain.pem --reloadcmd "service nginx force-reload"

You can add as many --domain statements as needed, to have a certificate that covers several hostnames.

Much more convenient than using the reloadcmd is the stateless mode. In any case, don't forget to add a cron job for automated certificate renewal.

nginx

On Debian 10, the nginx-light package is sufficient to act as reverse proxy. If you strengthened your SSL parameter configuration with the help of https://bettercrypto.org or https://github.com/RaymiiOrg/cipherli.st and you have the server-wide ssl_ecdh_curve directive set, the highest value supported seems to be secp384r1.

A sample nginx configuration (/etc/nginx/nginx.conf) that seems to be working is as follows:

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
 worker_connections 768;
}

http {
 sendfile on;
 tcp_nopush on;
 keepalive_timeout 65;
 types_hash_max_size 2048;

 server_tokens off;
 index index.html index.php;
 autoindex off;
 disable_symlinks on;
 client_max_body_size 512m;

 include /etc/nginx/mime.types;
 default_type application/octet-stream;

 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_prefer_server_ciphers on;
 ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
 ssl_ecdh_curve secp384r1;
 ssl_session_timeout 10m;
 ssl_session_cache shared:SSL:10m;
 ssl_session_tickets off;
 ssl_stapling on;
 ssl_stapling_verify on;

 access_log /var/log/nginx/access.log;
 error_log /var/log/nginx/error.log;

 gzip on;
 gzip_vary on;

 include /etc/nginx/conf.d/*.conf;
 include /etc/nginx/sites-enabled/*;
}

For the virtual site definition, the following template needs to be filled with the actual proxying (see the articles at [1] and [2]) to your LOOL instance:

server {
 server_name your.cloud.domain;
 root /var/www/your.cloud.domain;

 access_log /var/log/nginx/your.cloud.domain.access.log;
 error_log /var/log/nginx/your.cloud.domain.error.log error;

 listen 80;
 listen [::]:80;
 return 301 https://$host$request_uri;
}

server {
 server_name your.cloud.domain;
 root /var/www/your.cloud.domain;

 access_log /var/log/nginx/your.cloud.domain.access.log;
 error_log /var/log/nginx/your.cloud.domain.error.log error;

 listen 443 ssl http2;
 listen [::]:443 ssl http2;
 add_header Strict-Transport-Security "max-age=15768000" always;

 ssl_certificate /etc/ssl/certs/your.cloud.domain.chain.pem;
 ssl_certificate_key /etc/ssl/private/your.cloud.domain.key.pem;
 ssl_certificate /etc/ssl/certs/your.cloud.domain.ecc.chain.pem;
 ssl_certificate_key /etc/ssl/private/your.cloud.domain.ecc.key.pem;

 # Add proxying to your LOOL instance here

}

You also might want to setup a robots.txt file to prevent search engines from indexing your site:

User-Agent: *
Disallow: /

haproxy

No special configuration is needed to run LOOL behind HAProxy. Something like this should perfectly fit:

frontend https_in
	bind *:443 ssl crt /etc/letsencrypt/live/lool.domain.tld/haproxy.pem
	option httplog
	option forwardfor

	acl host_lool hdr(host) -i lool.domain.tld
	use_backend lool if host_lool



backend lool
	server lool1 127.0.0.1:9980 check ssl verify none