update config file and add insecure option

deployments/examples/ocis_wopi/config/wopiserver/entrypoint-override.sh

@@ -1,4 +1,4 @@
-#/bin/sh!
+#!/bin/bash
 set -e
 
 echo "${WOPISECRET}" > /etc/wopi/wopisecret
@@ -11,6 +11,11 @@ sed -i 's/ocis.owncloud.test/'${OCIS_DOMAIN}'/g' /etc/wopi/wopiserver.conf
 sed -i 's/collabora.owncloud.test/'${COLLABORA_DOMAIN}'/g' /etc/wopi/wopiserver.conf
 sed -i 's/wopiserver.owncloud.test/'${WOPISERVER_DOMAIN}'/g' /etc/wopi/wopiserver.conf
 
+
+if [ "$WOPISERVER_INSECURE" == "true" ]; then
+    sed -i 's/sslverify\s=\sTrue/sslverify = False/g' /etc/wopi/wopiserver.conf
+fi
+
 touch /var/log/wopi/wopiserver.log
 
 /app/wopiserver.py &

deployments/examples/ocis_wopi/config/wopiserver/wopiserver.conf.dist

@@ -1,27 +1,23 @@
 #
+# This config is based on https://github.com/cs3org/wopiserver/blob/master/wopiserver.conf
+#
 # wopiserver.conf
 #
-# Default configuration file for the WOPI server for CERNBox
+# Default configuration file for the WOPI server for oCIS
 #
 ##############################################################
 
 [general]
 # Storage access layer to be loaded in order to operate this WOPI server
-# Supported values: local, xroot, cs3.
+# only "cs3" is supported with oCIS
 storagetype = cs3
 
 # Port where to listen for WOPI requests
 port = 8880
 
-# URL of your Microsoft Office Online service
-#oosurl = https://officeonline.owncloud.test
-
-# URL of your Collabora Online service
-#codeurl = https://collabora.owncloud.test
-
-# URL of your CodiMD service
-codimdurl = https://codimd.owncloud.test
-codimdinturl = http://codimd:3000
+# Logging level. Debug enables the Flask debug mode as well.
+# Valid values are: Debug, Info, Warning, Error.
+loglevel = Error
 
 # URL of your WOPI server or your HA proxy in front of it
 wopiurl = https://wopiserver.owncloud.test
@@ -30,15 +26,15 @@ wopiurl = https://wopiserver.owncloud.test
 # to clients will include the access_token argument
 downloadurl = https://wopiserver.owncloud.test/wopi/cbox/download
 
-# Optional URL prefix for WebDAV access to the files. This enables the
-# 'Edit in Desktop client' action on Windows-based clients
-webdavurl = https://ocis.owncloud.test/webdav
+# The internal server engine to use (defaults to flask).
+# Set to waitress for production installations.
+internalserver = waitress
 
 # List of file extensions deemed incompatible with LibreOffice:
 # interoperable locking will be disabled for such files
 nonofficetypes = .md .zmd .txt .epd
 
-# List of file extensions to be supported by Collabora
+# List of file extensions to be supported by Collabora (deprecated)
 codeofficetypes = .odt .ott .ods .ots .odp .otp .odg .otg .doc .dot .xls .xlt .xlm .ppt .pot .pps .vsd .dxf .wmf .cdr .pages .number .key
 
 # WOPI access token expiration time [seconds]
@@ -51,11 +47,12 @@ wopilockexpiration = 3600
 # that is their representation must match. False (default) allows for a more relaxed
 # comparison, which compensates incorrect lock requests from Microsoft Office Online
 # on-premise setups.
-#wopilockstrictcheck = False
+wopilockstrictcheck = False
 
 # Enable support of rename operations from WOPI apps. This is currently
 # disabled by default as it has been observed that both MS Office and Collabora
 # Online do not play well with this feature.
+# Not supported with oCIS, must always be set to "False"
 enablerename = False
 
 # Detection of external Microsoft Office or LibreOffice locks. By default, lock files
@@ -63,6 +60,7 @@ enablerename = False
 # underlying storage can be mounted as a remote filesystem: in this case, WOPI GetLock
 # and SetLock operations return such locks and prevent online apps from entering edit mode.
 # This feature can be disabled in order to operate a pure WOPI server for online apps.
+# Not supported with oCIS, must always be set to "False"
 detectexternallocks = False
 
 # Location of the webconflict files. By default, such files are stored in the same path
@@ -75,13 +73,9 @@ detectexternallocks = False
 #conflictpath = /
 
 # ownCloud's WOPI proxy configuration. Disabled by default.
-#wopiproxy = https://external-wopi-proxy.org
-#wopiproxykey = key_for_proxy_jwt_encoding
-#proxiedappname = name_of_your_proxied_app
-
-# Logging level. Debug enables the Flask debug mode as well.
-# Valid values are: Debug, Info, Warning, Error.
-loglevel = Info
+#wopiproxy = https://external-wopi-proxy.com
+#wopiproxysecretfile = /path/to/your/shared-key-file
+#proxiedappname = Name of your proxied app
 
 [security]
 # Location of the secret files. Requires a restart of the
@@ -100,7 +94,7 @@ wopikey = /etc/grid-security/host.key
 
 [bridge]
 # SSL certificate check for the connected apps
-sslverify = False
+sslverify = True
 
 # Minimal time interval between two consecutive save operations [seconds]
 #saveinterval = 200
@@ -108,39 +102,25 @@ sslverify = False
 # Minimal time interval before a closed file is WOPI-unlocked [seconds]
 #unlockinterval = 90
 
+# CodiMD: disable creating zipped bundles when files contain pictures
+#disablezip = False
 
 [io]
 # Size used for buffered reads [bytes]
 chunksize = 4194304
 
-
-[xroot]
-# URL of the default remote xroot storage server. This can be overridden
-# if the end-point is passed on the /wopi/cbox/open call
-#storageserver = root://your-xrootd-server.org
-
-# Optional EOS top-level path that will be prepended to all user paths. Useful
-# to map the CERNBox-exposed files in a subfolder of the EOS storage. By default,
-# this is not used and storagehomepath is empty.
-#storagehomepath = /your/top/storage/path
-
-
-[local]
-# Location of the folder or mount point used as local storage
-#storagehomepath = /mnt/your_local_storage
-
+# Path to a recovery space in case of I/O errors when reaching to the remote storage.
+# This is expected to be a local path, and it is provided in order to ease user support.
+# Defaults to the indicated spool folder.
+#recoverypath = /var/spool/wopirecovery
 
 [cs3]
 # Host and port of the Reva(-like) CS3-compliant GRPC gateway endpoint
 revagateway = ocis:9142
 
-# HTTP (WebDAV) endpoint for uploading files
-#datagateway = https://your-reva-server.org:port/data
-
 # Reva/gRPC authentication token expiration time [seconds]
 # The default value matches Reva's default
 authtokenvalidity = 3600
 
 # SSL certificate check for Reva
-# oCIS uses self signed certificate in this example
-sslverify = false
+sslverify = True

deployments/examples/ocis_wopi/docker-compose.yml

@@ -173,9 +173,10 @@ services:
     networks:
       ocis-net:
     entrypoint:
-      - /bin/sh
+      - /bin/bash
       - /entrypoint-override.sh
     environment:
+      WOPISERVER_INSECURE: "${INSECURE:-false}"
       WOPISECRET: ${WOPI_JWT_SECRET:-LoremIpsum567}
       IOPSECRET: ${WOPI_IOP_SECRET:-LoremIpsum123}
       CODIMDSECRET: ${CODIMD_SECRET:-LoremIpsum456}