bump to 0.5.1+v2026.2.0

.env.sample

@@ -1,6 +1,5 @@
 TYPE=cryptpad
 
-COMPOSE_FILE="compose.yml"
 
 DOMAIN=cryptpad.example.com
 
@@ -18,12 +17,7 @@ SANDBOX_DOMAIN=sandbox.cryptpad.example.com
 #EXTRA_DOMAINS=', `www.cryptpad.example.com`'
 LETS_ENCRYPT_ENV=production
 
-## Set to true to block unregistered users from accessing any CryptPad applications
+## SSO / OIDC (optional — defaults to false)
-## See https://docs.cryptpad.org/en/admin_guide/customization.html#restricting-guest-access
-#RESTRICT_GUEST_ACCESS=false
-
-## SSO / OIDC (optional — uncomment below and add compose.sso.yml to COMPOSE_FILE to enable)
-# COMPOSE_FILE="$COMPOSE_FILE:compose.sso.yml"
 #SSO_ENABLED=true
 #SSO_ENFORCED=false
 #SSO_PROVIDER_NAME=Authentik
@@ -31,10 +25,4 @@ LETS_ENCRYPT_ENV=production
 #SSO_CLIENT_ID=cryptpad
 #SSO_CLIENT_SECRET_VERSION=v1
 #SSO_JWT_ALG=RS256
-#SSO_PLUGIN_VERSION=1.0.0
+#SSO_PLUGIN_VERSION=0.4.0
-
-## Adding OnlyOffice to cryptpad
-#COMPOSE_FILE="$COMPOSE_FILE:compose.onlyoffice.yaml"
-## Enables installation of older onlyoffice versions so that older documents
-## can also be loaded and converted.
-#ONLYOFFICE_OLDEST=v6

README.md

@@ -4,7 +4,6 @@
 
 <!-- metadata -->
 
-* **Maintainer**: @trav, @notplants, @ineiti
 * **Category**: Apps
 * **Status**: 3
 * **Image**: cryptpad/cryptpad
@@ -12,7 +11,7 @@
 * **Backups**: Yes
 * **Email**: No
 * **Tests**: No
-* **SSO**: Yes
+* **SSO**: No
 
 <!-- endmetadata -->
 
@@ -41,49 +40,5 @@ Then redeploy with `abra app deploy YOURAPPDOMAIN --force`.
 Now when you login as your user, and visit https://cryptpad.cctest.autonomic.zone/admin/,
 you should be able to access the admin interface for this cryptpad instance. 
 
-## SSO
-
-SSO support is provided by `compose.sso.yml`. To enable it, add the SSO compose file and set the SSO variables in your app config:
-
-```
-COMPOSE_FILE="compose.yml:compose.sso.yml"
-SSO_ENABLED=true
-```
-
-On the next deploy, the [CryptPad SSO plugin](https://github.com/cryptpad/sso) will be installed automatically.
-
-You also need to configure the remaining SSO environment variables for your OIDC provider:
-
-- `SSO_PROVIDER_NAME` — display name shown on the login button (e.g. `Keycloak`, `Authentik`)
-- `SSO_OIDC_URL` — OIDC discovery URL for your provider
-- `SSO_CLIENT_ID` — OAuth2 client ID
-- `SSO_JWT_ALG` — JWT signing algorithm (e.g. `RS256`)
-
-The client secret is stored as a Docker secret. Insert it with:
-
-```
-abra app secret insert YOURAPPDOMAIN sso_client_s v1 YOUR_CLIENT_SECRET
-```
-
-Then deploy (or redeploy) to apply: `abra app deploy YOURAPPDOMAIN --force`.
-
-## OnlyOffice
-
-OnlyOffice support is provided by `compose.onlyoffice.yaml`. Enable it by adding the compose file to your app config:
-
-```
-COMPOSE_FILE="compose.yml:compose.onlyoffice.yaml"
-```
-
-On the next deploy, an entrypoint wrapper (`onlyoffice-entrypoint.sh`) prepares the OnlyOffice config volume **before** CryptPad starts, then the app container runs `install-office.sh` to download the OnlyOffice assets. Running the prep work inside the app container (rather than a separate init service) is necessary because Docker Swarm ignores `depends_on` at runtime — a sidecar init container would race the app.
-
-To support opening documents created with older OnlyOffice versions, set `ONLYOFFICE_OLDEST` in your app config. This writes (or updates) `oldest_needed_version` in `onlyoffice-conf/onlyoffice.properties`, which `install-office.sh` reads to fetch older versions in addition to the latest:
-
-```
-ONLYOFFICE_OLDEST=v6
-```
-
-If `ONLYOFFICE_OLDEST` is unset, `onlyoffice.properties` is left untouched (CryptPad's own default applies). Only the `oldest_needed_version` key is touched on each deploy, so any other entries in `onlyoffice.properties` are preserved. If you change `ONLYOFFICE_OLDEST` after the assets have already been downloaded, you may need to drop the `cryptpad_oo_dist` volume so `install-office.sh` re-runs and pulls the additional versions.
-
 [`abra`]: https://git.coopcloud.tech/coop-cloud/abra
 [`coop-cloud/traefik`]: https://git.coopcloud.tech/coop-cloud/traefik

abra.sh

@@ -1,8 +1,5 @@
-export CONFIG_VERSION=v3
+export CONFIG_VERSION=v2
 export CONFIG_JS_VERSION=v2
-export NGINX_CONF_VERSION=v2
+export NGINX_CONF_VERSION=v1
-export INFRA_JS_VERSION=v1
+export SSO_ENTRYPOINT_VERSION=v6
-export SSO_ENTRYPOINT_VERSION=v8
 export SSO_JS_VERSION=v3
-export APP_CONFIG_JS_VERSION=v1
-export ONLYOFFICE_ENTRYPOINT_VERSION=v2

application_config.js.tmpl

@@ -1,24 +0,0 @@
-// CryptPad application customization — generated from environment variables
-// See https://docs.cryptpad.org/en/admin_guide/customization.html
-// For default file, see: https://github.com/cryptpad/cryptpad/blob/main/customize.dist/application_config.js
-
-(() => {
-const factory = (AppConfig) => {
-    {{ if eq (env "RESTRICT_GUEST_ACCESS") "true" }}
-    // Block unregistered users from accessing any applications
-    AppConfig.registeredOnlyTypes = AppConfig.availablePadTypes.slice();
-    {{ end }}
-
-    return AppConfig;
-};
-
-// Do not change code below
-if (typeof(module) !== 'undefined' && module.exports) {
-    module.exports = factory(
-        require('../www/common/application_config_internal.js')
-    );
-} else if ((typeof(define) !== 'undefined' && define !== null) && (define.amd !== null)) {
-    define(['/common/application_config_internal.js'], factory);
-}
-
-})();

compose.onlyoffice.yaml

@@ -1,48 +0,0 @@
-version: "3.8"
-
-services:
-  init-onlyoffice-dirs:
-    image: busybox
-    user: root
-    command:
-      - sh
-      - -eu
-      - -c
-      - |
-        mkdir -p /cryptpad/www/common/onlyoffice/dist /cryptpad/onlyoffice-conf
-        chown -R 4001:4001 \
-          /cryptpad/www/common/onlyoffice/dist \
-          /cryptpad/onlyoffice-conf
-        exec tail -f /dev/null
-    volumes:
-      - cryptpad_oo_dist:/cryptpad/www/common/onlyoffice/dist
-      - cryptpad_oo_conf:/cryptpad/onlyoffice-conf/
-
-  app:
-    # onlyoffice-entrypoint.sh auto-chains through /sso-entrypoint.sh if
-    # compose.sso.yml is also loaded, so order of COMPOSE_FILE doesn't matter.
-    entrypoint:
-      - /onlyoffice-entrypoint.sh
-      - /cryptpad/docker-entrypoint.sh
-    environment:
-      - "CPAD_INSTALL_ONLYOFFICE=yes"
-      - ONLYOFFICE_OLDEST
-    volumes:
-      - cryptpad_oo_dist:/cryptpad/www/common/onlyoffice/dist
-      - cryptpad_oo_conf:/cryptpad/onlyoffice-conf/
-    configs:
-      - source: onlyoffice_entrypoint
-        target: /onlyoffice-entrypoint.sh
-        mode: 0755
-    deploy:
-      labels:
-        - "backupbot.backup.volumes.cryptpad_oo_dist=false"
-
-volumes:
-  cryptpad_oo_dist:
-  cryptpad_oo_conf:
-
-configs:
-  onlyoffice_entrypoint:
-    name: ${STACK_NAME}_onlyoffice_entrypoint_${ONLYOFFICE_ENTRYPOINT_VERSION}
-    file: onlyoffice-entrypoint.sh

compose.sso.yml

@@ -1,41 +0,0 @@
----
-version: "3.8"
-
-services:
-  app:
-    entrypoint: ["/sso-entrypoint.sh", "/cryptpad/docker-entrypoint.sh"]
-    environment:
-      - SSO_PLUGIN_VERSION
-      - "SSO_ENABLED=${SSO_ENABLED:-false}"
-      - SSO_ENFORCED
-      - SSO_PROVIDER_NAME
-      - SSO_OIDC_URL
-      - SSO_CLIENT_ID
-      - SSO_JWT_ALG
-    secrets:
-      - sso_client_s
-    volumes:
-      - cryptpad_plugins:/cryptpad/lib/plugins
-    configs:
-      - source: sso_entrypoint
-        target: /sso-entrypoint.sh
-        mode: 0755
-      - source: sso_js
-        target: /cryptpad/config/sso.js
-
-volumes:
-  cryptpad_plugins:
-
-secrets:
-  sso_client_s:
-    external: true
-    name: ${STACK_NAME}_sso_client_s_${SSO_CLIENT_SECRET_VERSION}
-
-configs:
-  sso_entrypoint:
-    name: ${STACK_NAME}_sso_entrypoint_${SSO_ENTRYPOINT_VERSION}
-    file: sso-entrypoint.sh
-  sso_js:
-    name: ${STACK_NAME}_sso_js_${SSO_JS_VERSION}
-    file: sso.js.tmpl
-    template_driver: golang

compose.yml

@@ -3,20 +3,30 @@ version: "3.8"
 
 services:
   app:
-    image: cryptpad/cryptpad:version-2026.10.1
+    image: cryptpad/cryptpad:version-2026.2.0
+    entrypoint: ["/sso-entrypoint.sh", "/cryptpad/docker-entrypoint.sh"]
     command: ["npm", "start"]
     networks:
       - backend
     environment:
       - CRYPTPAD_ADMIN_KEYS
-      - "CPAD_MAIN_DOMAIN=https://${DOMAIN}"
+      - "CPAD_MAIN_DOMAIN=${DOMAIN}"
-      - "CPAD_SANDBOX_DOMAIN=https://${SANDBOX_DOMAIN}"
+      - "CPAD_SANDBOX_DOMAIN=${SANDBOX_DOMAIN}"
       # Traefik can't use HTTP2 to communicate with cryptpad_websocket
       # A workaroung is disabling HTTP2 in Nginx
       - "CPAD_HTTP2_DISABLE=true"
       - "CPAD_TRUST_PROXY=1"
       - "CPAD_CONF=/cryptpad/config/config.js"
-      - "RESTRICT_GUEST_ACCESS=${RESTRICT_GUEST_ACCESS:-false}"
+      # SSO plugin
+      - SSO_PLUGIN_VERSION
+      - "SSO_ENABLED=${SSO_ENABLED:-false}"
+      - SSO_ENFORCED
+      - SSO_PROVIDER_NAME
+      - SSO_OIDC_URL
+      - SSO_CLIENT_ID
+      - SSO_JWT_ALG
+    secrets:
+      - sso_client_s
     volumes:
       - cryptpad_blob:/cryptpad/blob
       - cryptpad_block:/cryptpad/block
@@ -24,13 +34,15 @@ services:
       - cryptpad_data:/cryptpad/data
       - cryptpad_files:/cryptpad/datastore
       - cryptpad_config:/cryptpad/config/
+      - cryptpad_plugins:/cryptpad/lib/plugins
     configs:
       - source: config_js
         target: /cryptpad/config/config.js
-      - source: infra_js
+      - source: sso_entrypoint
-        target: /cryptpad/config/infra.js
+        target: /sso-entrypoint.sh
-      - source: app_config_js
+        mode: 0755
-        target: /cryptpad/customize/application_config.js
+      - source: sso_js
+        target: /sso.js
 
     deploy:
       restart_policy:
@@ -38,7 +50,7 @@ services:
       labels:
         - "traefik.enable=false"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=0.6.0+v2026.5.1"
+        - "coop-cloud.${STACK_NAME}.version=0.5.1+v2026.2.0"
         - "backupbot.backup=true"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:3000"]
@@ -48,7 +60,7 @@ services:
       start_period: 1m
 
   web:
-    image: nginx:1.31
+    image: nginx:1.29
     configs:
       - source: nginx_conf
         target: /etc/nginx/conf.d/default.conf
@@ -81,21 +93,26 @@ volumes:
   cryptpad_data:
   cryptpad_files:
   cryptpad_config:
+  cryptpad_plugins:
+
+secrets:
+  sso_client_s:
+    external: true
+    name: ${STACK_NAME}_sso_client_s_${SSO_CLIENT_SECRET_VERSION}
 
 configs:
   config_js:
     name: ${STACK_NAME}_config_${CONFIG_VERSION}
     file: config.js.tmpl
     template_driver: golang
-  infra_js:
-    name: ${STACK_NAME}_infra_js_${INFRA_JS_VERSION}
-    file: infra.js.tmpl
-    template_driver: golang
   nginx_conf:
     name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION}
     file: nginx.conf.tmpl
     template_driver: golang
-  app_config_js:
+  sso_entrypoint:
-    name: ${STACK_NAME}_app_config_js_${APP_CONFIG_JS_VERSION}
+    name: ${STACK_NAME}_sso_entrypoint_${SSO_ENTRYPOINT_VERSION}
-    file: application_config.js.tmpl
+    file: sso-entrypoint.sh
+  sso_js:
+    name: ${STACK_NAME}_sso_js_${SSO_JS_VERSION}
+    file: sso.js.tmpl
     template_driver: golang

config.js.tmpl

@@ -46,7 +46,7 @@ module.exports = {
  *  cryptpad/docs/example.nginx.conf (see the $main_domain variable)
  *
  */
-    httpUnsafeOrigin: '{{ env "CPAD_MAIN_DOMAIN" }}',
+    httpUnsafeOrigin: 'https://{{ env "CPAD_MAIN_DOMAIN" }}',
 
 /*  httpSafeOrigin is the URL that is used for the 'sandbox' described above.
  *  If you're testing or developing with CryptPad on your local machine then
@@ -67,7 +67,7 @@ module.exports = {
  *
  *  CUSTOMIZE AND UNCOMMENT THIS FOR PRODUCTION INSTALLATIONS.
  */
-    httpSafeOrigin: '{{ env "CPAD_SANDBOX_DOMAIN" }}',
+    httpSafeOrigin: 'https://{{ env "CPAD_SANDBOX_DOMAIN" }}',
 
 /*  httpAddress specifies the address on which the nodejs server
  *  should be accessible. By default it will listen on 127.0.0.1

infra.js.tmpl

@@ -1,32 +0,0 @@
-// CryptPad infrastructure configuration (cryptpad-server, since 2026.10.0)
-// Based on config.local/infra.example.js from the image.
-//
-// Provided as a Docker config because /cryptpad/config is root-owned in the
-// image: docker-entrypoint.sh cannot create this file itself.
-// Note: lib/load-config.js additionally overrides origin/sandboxOrigin and
-// binds all nodes to 0.0.0.0 when CPAD_MAIN_DOMAIN is set.
-
-module.exports = {
-    "public": {
-        origin: "{{ env "CPAD_MAIN_DOMAIN" }}",
-        sandboxOrigin: "{{ env "CPAD_SANDBOX_DOMAIN" }}",
-        httpHost: "0.0.0.0",
-        httpPort: 3000,
-        httpSafePort: 3001,
-        externalWebsocketURL: undefined,
-        fileHost: undefined,
-        httpServerId: "",
-    },
-    "front": [
-        { host: "0.0.0.0", port: 3010 },
-        { host: "0.0.0.0", port: 3011 },
-    ],
-    "core": [
-        { host: "0.0.0.0", port: 3020 },
-        { host: "0.0.0.0", port: 3021 },
-    ],
-    "storage": [
-        { host: "0.0.0.0", port: 3030, wsPort: 3040 },
-        { host: "0.0.0.0", port: 3031, wsPort: 3041 },
-    ]
-};

nginx.conf.tmpl

@@ -23,10 +23,9 @@ server {
         proxy_set_header Connection upgrade;
     }
 
-    # WebSocket endpoint. CryptPad 2026.10+ serves HTTP and websocket on one
+    # WebSocket endpoint
-    # port (public.httpPort); there is no separate websocket port any more.
     location ^~ /cryptpad_websocket {
-        proxy_pass http://{{ env "STACK_NAME" }}_app:3000;
+        proxy_pass http://{{ env "STACK_NAME" }}_app:3003;
 
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;

onlyoffice-entrypoint.sh

@@ -1,42 +0,0 @@
-#!/bin/bash
-set -e
-
-# OnlyOffice init — runs before the original CryptPad entrypoint.
-# Ensures oldest_needed_version in onlyoffice.properties matches
-# ONLYOFFICE_OLDEST before install-office.sh / CryptPad reads it.
-
-CONF_DIR="/cryptpad/onlyoffice-conf"
-PROPS="${CONF_DIR}/onlyoffice.properties"
-
-# Wait for init-onlyoffice-dirs to chown the volumes. Swarm ignores
-# depends_on, so the init sidecar and this container start in parallel.
-waited=0
-while [ ! -w "${CONF_DIR}" ]; do
-  if [ "${waited}" -ge 60 ]; then
-    echo "[onlyoffice-entrypoint] timed out waiting for ${CONF_DIR} to become writable" >&2
-    exit 1
-  fi
-  echo "[onlyoffice-entrypoint] waiting for ${CONF_DIR} to be writable (${waited}s)"
-  sleep 1
-  waited=$((waited + 1))
-done
-
-if [ -n "${ONLYOFFICE_OLDEST:-}" ]; then
-  mkdir -p "${CONF_DIR}"
-  touch "${PROPS}"
-  if grep -q '^oldest_needed_version=' "${PROPS}"; then
-    sed -i "s|^oldest_needed_version=.*|oldest_needed_version=${ONLYOFFICE_OLDEST}|" "${PROPS}"
-  else
-    echo "oldest_needed_version=${ONLYOFFICE_OLDEST}" >> "${PROPS}"
-  fi
-  echo "[onlyoffice-entrypoint] oldest_needed_version=${ONLYOFFICE_OLDEST}"
-else
-  echo "[onlyoffice-entrypoint] ONLYOFFICE_OLDEST unset, leaving ${PROPS} untouched"
-fi
-
-# Chain through the SSO entrypoint if compose.sso.yml mounted it.
-if [ -x /sso-entrypoint.sh ]; then
-  exec /sso-entrypoint.sh "$@"
-fi
-
-exec "$@"

renovate.json

@@ -1,6 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended"
-  ]
-}

sso-entrypoint.sh

@@ -13,10 +13,13 @@ fi
 
 PLUGIN_DIR="/cryptpad/lib/plugins/sso"
 VERSION_FILE="${PLUGIN_DIR}/.version"
-SSO_PLUGIN_VERSION="${SSO_PLUGIN_VERSION:-1.0.0}"
+SSO_PLUGIN_VERSION="${SSO_PLUGIN_VERSION:-0.4.0}"
 
-# sso.js is mounted directly at /cryptpad/config/sso.js as a Docker config:
+# Copy SSO config template into place (mounted as Docker config)
-# since CryptPad 2026.10.0, /cryptpad/config is root-owned and not writable.
+if [ -f /sso.js ]; then
+  cp /sso.js /cryptpad/config/sso.js
+  echo "[sso-entrypoint] Copied sso.js config into /cryptpad/config/sso.js"
+fi
 
 # Install/update the SSO plugin
 if [ -f "${VERSION_FILE}" ] && [ "$(cat "${VERSION_FILE}")" = "${SSO_PLUGIN_VERSION}" ]; then
@@ -26,11 +29,6 @@ else
   rm -rf "${PLUGIN_DIR}"
   git clone --depth 1 --branch "${SSO_PLUGIN_VERSION}" \
     https://github.com/cryptpad/sso.git "${PLUGIN_DIR}"
-  # Since CryptPad 2026.10.0 the plugin's dependencies (openid-client,
-  # node-saml, ...) are no longer bundled with CryptPad itself.
-  if [ -f "${PLUGIN_DIR}/package.json" ]; then
-    (cd "${PLUGIN_DIR}" && npm ci --omit=dev)
-  fi
   echo "${SSO_PLUGIN_VERSION}" > "${VERSION_FILE}"
   echo "[sso-entrypoint] SSO plugin installed"
 fi