From 0e57dec9a96a0edf4966da0edd3d195bff40fbf1 Mon Sep 17 00:00:00 2001
From: encode42 <me@encode42.dev>
Date: Fri, 26 Dec 2025 01:01:58 -0500
Subject: [PATCH] Make Collabora proxy work over SSL

---
 hosts/index/config/groupware/cells.nix  |  9 ++++++++-
 packages/server/groupware/collabora.nix | 10 ++++++++--
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/hosts/index/config/groupware/cells.nix b/hosts/index/config/groupware/cells.nix
index 43568f8..940bdfd 100644
--- a/hosts/index/config/groupware/cells.nix
+++ b/hosts/index/config/groupware/cells.nix
@@ -1,6 +1,9 @@
 { flakeRoot, ... }:
 
 let
+  hostname = "drive.encrypted.group";
+  localHostname = "drive.local.encrypted.group"; # TODO: this can change
+
   cellsModule = import (flakeRoot + /packages/server/groupware/cells.nix) {
     hosts = [
       {
@@ -8,7 +11,7 @@ let
         ssl = "internal";
       }
       {
-        name = "drive.encrypted.group";
+        name = hostname;
         ssl = "cloudflare";
 
         useLocal = true;
@@ -36,4 +39,8 @@ in
     "/mnt/apps/pydio"
     "/mnt/data/pydio"
   ];
+
+  services.collabora-online = {
+    aliasGroups = [ { host = "https://${hostname}:443"; } { host = "https://${localHostname}:443"; } ]; # TODO: messy
+  };
 }
diff --git a/packages/server/groupware/collabora.nix b/packages/server/groupware/collabora.nix
index df12120..19f6c95 100644
--- a/packages/server/groupware/collabora.nix
+++ b/packages/server/groupware/collabora.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, pkgs-personal, ... }:
 
 # Socket support: https://github.com/CollaboraOnline/online/issues/7156
 
@@ -10,6 +10,8 @@
   services.collabora-online = {
     enable = true;
 
+    package = pkgs-personal.collabora-online;
+
     settings = {
       languagetool = {
         enabled = true;
@@ -38,7 +40,11 @@
       };
 
       ssl = {
-        enable = false;
+        # SSL is not needed as Collabora will always be run locally and/or reverse proxied with SSL.
+        # However, SSL is still required by some services (Pydio Cells) in order to connect through secure websockets.
+        enable = true;
+        termination = true;
+        ssl_verification = false;
       };
 
       wasm = {
-- 
2.54.0