chore: upgrade to 2026.10.0

README.md

@@ -75,15 +75,15 @@ OnlyOffice support is provided by `compose.onlyoffice.yaml`. Enable it by adding
 COMPOSE_FILE="compose.yml:compose.onlyoffice.yaml"
 ```
 
-On the next deploy, an entrypoint wrapper (`onlyoffice-entrypoint.sh`) prepares the OnlyOffice config volume **before** CryptPad starts, then the app container runs `install-office.sh` to download the OnlyOffice assets. Running the prep work inside the app container (rather than a separate init service) is necessary because Docker Swarm ignores `depends_on` at runtime — a sidecar init container would race the app.
+On the next deploy, an entrypoint wrapper (`onlyoffice-entrypoint.sh`) prepares the OnlyOffice config volume **before** CryptPad starts, then the app container runs `install-onlyoffice.sh` to download the OnlyOffice assets. Running the prep work inside the app container (rather than a separate init service) is necessary because Docker Swarm ignores `depends_on` at runtime — a sidecar init container would race the app.
 
-To support opening documents created with older OnlyOffice versions, set `ONLYOFFICE_OLDEST` in your app config. This writes (or updates) `oldest_needed_version` in `onlyoffice-conf/onlyoffice.properties`, which `install-office.sh` reads to fetch older versions in addition to the latest:
+To support opening documents created with older OnlyOffice versions, set `ONLYOFFICE_OLDEST` in your app config. This writes (or updates) `oldest_needed_version` in `onlyoffice-conf/onlyoffice.properties`, which `install-onlyoffice.sh` reads to fetch older versions in addition to the latest:
 
 ```
 ONLYOFFICE_OLDEST=v6
 ```
 
-If `ONLYOFFICE_OLDEST` is unset, `onlyoffice.properties` is left untouched (CryptPad's own default applies). Only the `oldest_needed_version` key is touched on each deploy, so any other entries in `onlyoffice.properties` are preserved. If you change `ONLYOFFICE_OLDEST` after the assets have already been downloaded, you may need to drop the `cryptpad_oo_dist` volume so `install-office.sh` re-runs and pulls the additional versions.
+If `ONLYOFFICE_OLDEST` is unset, `onlyoffice.properties` is left untouched (CryptPad's own default applies). Only the `oldest_needed_version` key is touched on each deploy, so any other entries in `onlyoffice.properties` are preserved. If you change `ONLYOFFICE_OLDEST` after the assets have already been downloaded, you may need to drop the `cryptpad_oo_dist` volume so `install-onlyoffice.sh` re-runs and pulls the additional versions.
 
 [`abra`]: https://git.coopcloud.tech/coop-cloud/abra
 [`coop-cloud/traefik`]: https://git.coopcloud.tech/coop-cloud/traefik

abra.sh

@@ -1,8 +1,7 @@
 export CONFIG_VERSION=v3
 export CONFIG_JS_VERSION=v2
 export NGINX_CONF_VERSION=v2
-export INFRA_JS_VERSION=v1
+export SSO_ENTRYPOINT_VERSION=v7
-export SSO_ENTRYPOINT_VERSION=v8
 export SSO_JS_VERSION=v3
 export APP_CONFIG_JS_VERSION=v1
-export ONLYOFFICE_ENTRYPOINT_VERSION=v2
+export ONLYOFFICE_ENTRYPOINT_VERSION=v1

compose.sso.yml

@@ -21,7 +21,7 @@ services:
         target: /sso-entrypoint.sh
         mode: 0755
       - source: sso_js
-        target: /cryptpad/config/sso.js
+        target: /sso.js
 
 volumes:
   cryptpad_plugins:

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: cryptpad/cryptpad:version-2026.10.1
+    image: cryptpad/cryptpad:version-2026.10.0
     command: ["npm", "start"]
     networks:
       - backend
@@ -27,8 +27,6 @@ services:
     configs:
       - source: config_js
         target: /cryptpad/config/config.js
-      - source: infra_js
-        target: /cryptpad/config/infra.js
       - source: app_config_js
         target: /cryptpad/customize/application_config.js
 
@@ -87,10 +85,6 @@ configs:
     name: ${STACK_NAME}_config_${CONFIG_VERSION}
     file: config.js.tmpl
     template_driver: golang
-  infra_js:
-    name: ${STACK_NAME}_infra_js_${INFRA_JS_VERSION}
-    file: infra.js.tmpl
-    template_driver: golang
   nginx_conf:
     name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION}
     file: nginx.conf.tmpl

infra.js.tmpl

@@ -1,32 +0,0 @@
-// CryptPad infrastructure configuration (cryptpad-server, since 2026.10.0)
-// Based on config.local/infra.example.js from the image.
-//
-// Provided as a Docker config because /cryptpad/config is root-owned in the
-// image: docker-entrypoint.sh cannot create this file itself.
-// Note: lib/load-config.js additionally overrides origin/sandboxOrigin and
-// binds all nodes to 0.0.0.0 when CPAD_MAIN_DOMAIN is set.
-
-module.exports = {
-    "public": {
-        origin: "{{ env "CPAD_MAIN_DOMAIN" }}",
-        sandboxOrigin: "{{ env "CPAD_SANDBOX_DOMAIN" }}",
-        httpHost: "0.0.0.0",
-        httpPort: 3000,
-        httpSafePort: 3001,
-        externalWebsocketURL: undefined,
-        fileHost: undefined,
-        httpServerId: "",
-    },
-    "front": [
-        { host: "0.0.0.0", port: 3010 },
-        { host: "0.0.0.0", port: 3011 },
-    ],
-    "core": [
-        { host: "0.0.0.0", port: 3020 },
-        { host: "0.0.0.0", port: 3021 },
-    ],
-    "storage": [
-        { host: "0.0.0.0", port: 3030, wsPort: 3040 },
-        { host: "0.0.0.0", port: 3031, wsPort: 3041 },
-    ]
-};

onlyoffice-entrypoint.sh

@@ -3,7 +3,7 @@ set -e
 
 # OnlyOffice init — runs before the original CryptPad entrypoint.
 # Ensures oldest_needed_version in onlyoffice.properties matches
-# ONLYOFFICE_OLDEST before install-office.sh / CryptPad reads it.
+# ONLYOFFICE_OLDEST before install-onlyoffice.sh / CryptPad reads it.
 
 CONF_DIR="/cryptpad/onlyoffice-conf"
 PROPS="${CONF_DIR}/onlyoffice.properties"

sso-entrypoint.sh

@@ -15,8 +15,11 @@ PLUGIN_DIR="/cryptpad/lib/plugins/sso"
 VERSION_FILE="${PLUGIN_DIR}/.version"
 SSO_PLUGIN_VERSION="${SSO_PLUGIN_VERSION:-1.0.0}"
 
-# sso.js is mounted directly at /cryptpad/config/sso.js as a Docker config:
+# Copy SSO config template into place (mounted as Docker config)
-# since CryptPad 2026.10.0, /cryptpad/config is root-owned and not writable.
+if [ -f /sso.js ]; then
+  cp /sso.js /cryptpad/config/sso.js
+  echo "[sso-entrypoint] Copied sso.js config into /cryptpad/config/sso.js"
+fi
 
 # Install/update the SSO plugin
 if [ -f "${VERSION_FILE}" ] && [ "$(cat "${VERSION_FILE}")" = "${SSO_PLUGIN_VERSION}" ]; then
@@ -26,11 +29,6 @@ else
   rm -rf "${PLUGIN_DIR}"
   git clone --depth 1 --branch "${SSO_PLUGIN_VERSION}" \
     https://github.com/cryptpad/sso.git "${PLUGIN_DIR}"
-  # Since CryptPad 2026.10.0 the plugin's dependencies (openid-client,
-  # node-saml, ...) are no longer bundled with CryptPad itself.
-  if [ -f "${PLUGIN_DIR}/package.json" ]; then
-    (cd "${PLUGIN_DIR}" && npm ci --omit=dev)
-  fi
   echo "${SSO_PLUGIN_VERSION}" > "${VERSION_FILE}"
   echo "[sso-entrypoint] SSO plugin installed"
 fi