chore: upgrade to 2026.10.0

Reviewed-on: https://git.coopcloud.tech/coop-cloud/cryptpad/pulls/16

.env.sample

@@ -31,4 +31,10 @@ LETS_ENCRYPT_ENV=production
 #SSO_CLIENT_ID=cryptpad
 #SSO_CLIENT_SECRET_VERSION=v1
 #SSO_JWT_ALG=RS256
-#SSO_PLUGIN_VERSION=0.4.0
+#SSO_PLUGIN_VERSION=1.0.0
+
+## Adding OnlyOffice to cryptpad
+#COMPOSE_FILE="$COMPOSE_FILE:compose.onlyoffice.yaml"
+## Enables installation of older onlyoffice versions so that older documents
+## can also be loaded and converted.
+#ONLYOFFICE_OLDEST=v6

README.md

@@ -4,6 +4,7 @@
 
 <!-- metadata -->
 
+* **Maintainer**: @trav, @notplants, @ineiti
 * **Category**: Apps
 * **Status**: 3
 * **Image**: cryptpad/cryptpad
@@ -66,5 +67,23 @@ abra app secret insert YOURAPPDOMAIN sso_client_s v1 YOUR_CLIENT_SECRET
 
 Then deploy (or redeploy) to apply: `abra app deploy YOURAPPDOMAIN --force`.
 
+## OnlyOffice
+
+OnlyOffice support is provided by `compose.onlyoffice.yaml`. Enable it by adding the compose file to your app config:
+
+```
+COMPOSE_FILE="compose.yml:compose.onlyoffice.yaml"
+```
+
+On the next deploy, an entrypoint wrapper (`onlyoffice-entrypoint.sh`) prepares the OnlyOffice config volume **before** CryptPad starts, then the app container runs `install-onlyoffice.sh` to download the OnlyOffice assets. Running the prep work inside the app container (rather than a separate init service) is necessary because Docker Swarm ignores `depends_on` at runtime — a sidecar init container would race the app.
+
+To support opening documents created with older OnlyOffice versions, set `ONLYOFFICE_OLDEST` in your app config. This writes (or updates) `oldest_needed_version` in `onlyoffice-conf/onlyoffice.properties`, which `install-onlyoffice.sh` reads to fetch older versions in addition to the latest:
+
+```
+ONLYOFFICE_OLDEST=v6
+```
+
+If `ONLYOFFICE_OLDEST` is unset, `onlyoffice.properties` is left untouched (CryptPad's own default applies). Only the `oldest_needed_version` key is touched on each deploy, so any other entries in `onlyoffice.properties` are preserved. If you change `ONLYOFFICE_OLDEST` after the assets have already been downloaded, you may need to drop the `cryptpad_oo_dist` volume so `install-onlyoffice.sh` re-runs and pulls the additional versions.
+
 [`abra`]: https://git.coopcloud.tech/coop-cloud/abra
 [`coop-cloud/traefik`]: https://git.coopcloud.tech/coop-cloud/traefik

abra.sh

@@ -1,6 +1,7 @@
-export CONFIG_VERSION=v2
+export CONFIG_VERSION=v3
 export CONFIG_JS_VERSION=v2
-export NGINX_CONF_VERSION=v1
+export NGINX_CONF_VERSION=v2
-export SSO_ENTRYPOINT_VERSION=v6
+export SSO_ENTRYPOINT_VERSION=v7
 export SSO_JS_VERSION=v3
 export APP_CONFIG_JS_VERSION=v1
+export ONLYOFFICE_ENTRYPOINT_VERSION=v1

compose.onlyoffice.yaml

@@ -0,0 +1,48 @@
+version: "3.8"
+
+services:
+  init-onlyoffice-dirs:
+    image: busybox
+    user: root
+    command:
+      - sh
+      - -eu
+      - -c
+      - |
+        mkdir -p /cryptpad/www/common/onlyoffice/dist /cryptpad/onlyoffice-conf
+        chown -R 4001:4001 \
+          /cryptpad/www/common/onlyoffice/dist \
+          /cryptpad/onlyoffice-conf
+        exec tail -f /dev/null
+    volumes:
+      - cryptpad_oo_dist:/cryptpad/www/common/onlyoffice/dist
+      - cryptpad_oo_conf:/cryptpad/onlyoffice-conf/
+
+  app:
+    # onlyoffice-entrypoint.sh auto-chains through /sso-entrypoint.sh if
+    # compose.sso.yml is also loaded, so order of COMPOSE_FILE doesn't matter.
+    entrypoint:
+      - /onlyoffice-entrypoint.sh
+      - /cryptpad/docker-entrypoint.sh
+    environment:
+      - "CPAD_INSTALL_ONLYOFFICE=yes"
+      - ONLYOFFICE_OLDEST
+    volumes:
+      - cryptpad_oo_dist:/cryptpad/www/common/onlyoffice/dist
+      - cryptpad_oo_conf:/cryptpad/onlyoffice-conf/
+    configs:
+      - source: onlyoffice_entrypoint
+        target: /onlyoffice-entrypoint.sh
+        mode: 0755
+    deploy:
+      labels:
+        - "backupbot.backup.volumes.cryptpad_oo_dist=false"
+
+volumes:
+  cryptpad_oo_dist:
+  cryptpad_oo_conf:
+
+configs:
+  onlyoffice_entrypoint:
+    name: ${STACK_NAME}_onlyoffice_entrypoint_${ONLYOFFICE_ENTRYPOINT_VERSION}
+    file: onlyoffice-entrypoint.sh

compose.yml

@@ -3,14 +3,14 @@ version: "3.8"
 
 services:
   app:
-    image: cryptpad/cryptpad:version-2026.2.0
+    image: cryptpad/cryptpad:version-2026.10.0
     command: ["npm", "start"]
     networks:
       - backend
     environment:
       - CRYPTPAD_ADMIN_KEYS
-      - "CPAD_MAIN_DOMAIN=${DOMAIN}"
+      - "CPAD_MAIN_DOMAIN=https://${DOMAIN}"
-      - "CPAD_SANDBOX_DOMAIN=${SANDBOX_DOMAIN}"
+      - "CPAD_SANDBOX_DOMAIN=https://${SANDBOX_DOMAIN}"
       # Traefik can't use HTTP2 to communicate with cryptpad_websocket
       # A workaroung is disabling HTTP2 in Nginx
       - "CPAD_HTTP2_DISABLE=true"
@@ -36,7 +36,7 @@ services:
       labels:
         - "traefik.enable=false"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=0.5.4+v2026.2.0"
+        - "coop-cloud.${STACK_NAME}.version=0.6.0+v2026.5.1"
         - "backupbot.backup=true"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:3000"]
@@ -46,7 +46,7 @@ services:
       start_period: 1m
 
   web:
-    image: nginx:1.29
+    image: nginx:1.31
     configs:
       - source: nginx_conf
         target: /etc/nginx/conf.d/default.conf

config.js.tmpl

@@ -46,7 +46,7 @@ module.exports = {
  *  cryptpad/docs/example.nginx.conf (see the $main_domain variable)
  *
  */
-    httpUnsafeOrigin: 'https://{{ env "CPAD_MAIN_DOMAIN" }}',
+    httpUnsafeOrigin: '{{ env "CPAD_MAIN_DOMAIN" }}',
 
 /*  httpSafeOrigin is the URL that is used for the 'sandbox' described above.
  *  If you're testing or developing with CryptPad on your local machine then
@@ -67,7 +67,7 @@ module.exports = {
  *
  *  CUSTOMIZE AND UNCOMMENT THIS FOR PRODUCTION INSTALLATIONS.
  */
-    httpSafeOrigin: 'https://{{ env "CPAD_SANDBOX_DOMAIN" }}',
+    httpSafeOrigin: '{{ env "CPAD_SANDBOX_DOMAIN" }}',
 
 /*  httpAddress specifies the address on which the nodejs server
  *  should be accessible. By default it will listen on 127.0.0.1

nginx.conf.tmpl

@@ -23,9 +23,10 @@ server {
         proxy_set_header Connection upgrade;
     }
 
-    # WebSocket endpoint
+    # WebSocket endpoint. CryptPad 2026.10+ serves HTTP and websocket on one
+    # port (public.httpPort); there is no separate websocket port any more.
     location ^~ /cryptpad_websocket {
-        proxy_pass http://{{ env "STACK_NAME" }}_app:3003;
+        proxy_pass http://{{ env "STACK_NAME" }}_app:3000;
 
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;

onlyoffice-entrypoint.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+set -e
+
+# OnlyOffice init — runs before the original CryptPad entrypoint.
+# Ensures oldest_needed_version in onlyoffice.properties matches
+# ONLYOFFICE_OLDEST before install-onlyoffice.sh / CryptPad reads it.
+
+CONF_DIR="/cryptpad/onlyoffice-conf"
+PROPS="${CONF_DIR}/onlyoffice.properties"
+
+# Wait for init-onlyoffice-dirs to chown the volumes. Swarm ignores
+# depends_on, so the init sidecar and this container start in parallel.
+waited=0
+while [ ! -w "${CONF_DIR}" ]; do
+  if [ "${waited}" -ge 60 ]; then
+    echo "[onlyoffice-entrypoint] timed out waiting for ${CONF_DIR} to become writable" >&2
+    exit 1
+  fi
+  echo "[onlyoffice-entrypoint] waiting for ${CONF_DIR} to be writable (${waited}s)"
+  sleep 1
+  waited=$((waited + 1))
+done
+
+if [ -n "${ONLYOFFICE_OLDEST:-}" ]; then
+  mkdir -p "${CONF_DIR}"
+  touch "${PROPS}"
+  if grep -q '^oldest_needed_version=' "${PROPS}"; then
+    sed -i "s|^oldest_needed_version=.*|oldest_needed_version=${ONLYOFFICE_OLDEST}|" "${PROPS}"
+  else
+    echo "oldest_needed_version=${ONLYOFFICE_OLDEST}" >> "${PROPS}"
+  fi
+  echo "[onlyoffice-entrypoint] oldest_needed_version=${ONLYOFFICE_OLDEST}"
+else
+  echo "[onlyoffice-entrypoint] ONLYOFFICE_OLDEST unset, leaving ${PROPS} untouched"
+fi
+
+# Chain through the SSO entrypoint if compose.sso.yml mounted it.
+if [ -x /sso-entrypoint.sh ]; then
+  exec /sso-entrypoint.sh "$@"
+fi
+
+exec "$@"

renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}

sso-entrypoint.sh

@@ -13,7 +13,7 @@ fi
 
 PLUGIN_DIR="/cryptpad/lib/plugins/sso"
 VERSION_FILE="${PLUGIN_DIR}/.version"
-SSO_PLUGIN_VERSION="${SSO_PLUGIN_VERSION:-0.4.0}"
+SSO_PLUGIN_VERSION="${SSO_PLUGIN_VERSION:-1.0.0}"
 
 # Copy SSO config template into place (mounted as Docker config)
 if [ -f /sso.js ]; then