From 3e7ec818af3f65908f0585a5b8745e001f2dd6ae Mon Sep 17 00:00:00 2001
From: autonomic-bot <autonomic-bot@git.autonomic.zone>
Date: Fri, 30 Oct 2026 02:13:35 +0000
Subject: [PATCH] chore: upgrade to 2026.10.0

---
 .env.sample       | 2 +-
 abra.sh           | 6 +++---
 compose.yml       | 6 +++---
 config.js.tmpl    | 4 ++--
 nginx.conf.tmpl   | 5 +++--
 sso-entrypoint.sh | 2 +-
 6 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/.env.sample b/.env.sample
index 7b1f51a..237e923 100644
--- a/.env.sample
+++ b/.env.sample
@@ -31,7 +31,7 @@ LETS_ENCRYPT_ENV=production
 #SSO_CLIENT_ID=cryptpad
 #SSO_CLIENT_SECRET_VERSION=v1
 #SSO_JWT_ALG=RS256
-#SSO_PLUGIN_VERSION=0.4.0
+#SSO_PLUGIN_VERSION=1.0.0
 
 ## Adding OnlyOffice to cryptpad
 #COMPOSE_FILE="$COMPOSE_FILE:compose.onlyoffice.yaml"
diff --git a/abra.sh b/abra.sh
index 814d000..b40f0ca 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,7 +1,7 @@
-export CONFIG_VERSION=v2
+export CONFIG_VERSION=v3
 export CONFIG_JS_VERSION=v2
-export NGINX_CONF_VERSION=v1
-export SSO_ENTRYPOINT_VERSION=v6
+export NGINX_CONF_VERSION=v2
+export SSO_ENTRYPOINT_VERSION=v7
 export SSO_JS_VERSION=v3
 export APP_CONFIG_JS_VERSION=v1
 export ONLYOFFICE_ENTRYPOINT_VERSION=v1
diff --git a/compose.yml b/compose.yml
index e3a555c..8b4cc6d 100644
--- a/compose.yml
+++ b/compose.yml
@@ -3,14 +3,14 @@ version: "3.8"
 
 services:
   app:
-    image: cryptpad/cryptpad:version-2026.5.1
+    image: cryptpad/cryptpad:version-2026.10.0
     command: ["npm", "start"]
     networks:
       - backend
     environment:
       - CRYPTPAD_ADMIN_KEYS
-      - "CPAD_MAIN_DOMAIN=${DOMAIN}"
-      - "CPAD_SANDBOX_DOMAIN=${SANDBOX_DOMAIN}"
+      - "CPAD_MAIN_DOMAIN=https://${DOMAIN}"
+      - "CPAD_SANDBOX_DOMAIN=https://${SANDBOX_DOMAIN}"
       # Traefik can't use HTTP2 to communicate with cryptpad_websocket
       # A workaroung is disabling HTTP2 in Nginx
       - "CPAD_HTTP2_DISABLE=true"
diff --git a/config.js.tmpl b/config.js.tmpl
index 0559779..295e2f3 100644
--- a/config.js.tmpl
+++ b/config.js.tmpl
@@ -46,7 +46,7 @@ module.exports = {
  *  cryptpad/docs/example.nginx.conf (see the $main_domain variable)
  *
  */
-    httpUnsafeOrigin: 'https://{{ env "CPAD_MAIN_DOMAIN" }}',
+    httpUnsafeOrigin: '{{ env "CPAD_MAIN_DOMAIN" }}',
 
 /*  httpSafeOrigin is the URL that is used for the 'sandbox' described above.
  *  If you're testing or developing with CryptPad on your local machine then
@@ -67,7 +67,7 @@ module.exports = {
  *
  *  CUSTOMIZE AND UNCOMMENT THIS FOR PRODUCTION INSTALLATIONS.
  */
-    httpSafeOrigin: 'https://{{ env "CPAD_SANDBOX_DOMAIN" }}',
+    httpSafeOrigin: '{{ env "CPAD_SANDBOX_DOMAIN" }}',
 
 /*  httpAddress specifies the address on which the nodejs server
  *  should be accessible. By default it will listen on 127.0.0.1
diff --git a/nginx.conf.tmpl b/nginx.conf.tmpl
index 3fee226..ac1043a 100644
--- a/nginx.conf.tmpl
+++ b/nginx.conf.tmpl
@@ -23,9 +23,10 @@ server {
         proxy_set_header Connection upgrade;
     }
 
-    # WebSocket endpoint
+    # WebSocket endpoint. CryptPad 2026.10+ serves HTTP and websocket on one
+    # port (public.httpPort); there is no separate websocket port any more.
     location ^~ /cryptpad_websocket {
-        proxy_pass http://{{ env "STACK_NAME" }}_app:3003;
+        proxy_pass http://{{ env "STACK_NAME" }}_app:3000;
 
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
diff --git a/sso-entrypoint.sh b/sso-entrypoint.sh
index 015976e..30b20b9 100644
--- a/sso-entrypoint.sh
+++ b/sso-entrypoint.sh
@@ -13,7 +13,7 @@ fi
 
 PLUGIN_DIR="/cryptpad/lib/plugins/sso"
 VERSION_FILE="${PLUGIN_DIR}/.version"
-SSO_PLUGIN_VERSION="${SSO_PLUGIN_VERSION:-0.4.0}"
+SSO_PLUGIN_VERSION="${SSO_PLUGIN_VERSION:-1.0.0}"
 
 # Copy SSO config template into place (mounted as Docker config)
 if [ -f /sso.js ]; then