recipe-maintainers/lasuite-drive
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Upgrade to drive v0.25.3, replace MinIO with RustFS

Browse Source 
- use rustfs instead of minio and provide migration script
- Schedule clean_pending_items/purge_deleted_items with celery beat
- Give celery workers the S3 access key secret
- Collabora admin access needs setting a password

Following the [C4DT AI Policy](https://git.coopcloud.tech/c4dt/ai-policy/src/branch/main/AI-POLICY.md):

 #LLM_vibe
 #LLM_model Claude Opus 5.5

- [x] I take full responsibility for this code
- [x] I understand every line of this code
- [x] I tested this code thoroughly on my own computer / servers
- [x] None of the commit messages were created using LLMs
- [x] I will participate in any discussion on my own and will not use an LLM for the discussion

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Linus Gasser
2026-11-12 16:07:05 +00:00
committed by Linus Gasser
co-authored by Claude Opus 5.5
parent a09d912312
commit e7aaf18d2d
12 changed files with 399 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+48 -3
View File
@@ -19,25 +19,53 @@
### Setting Up Domains
This recipe requires four domains. One domain for drive, and one for minio which also needs its own public endpoint (see [https://github.com/suitenumerique/drive/issues/476](https://github.com/suitenumerique/drive/issues/476)), one domain for collabora, and one domain for onlyoffice. For example (`drive.yourdomain.tld`, `minio.drive.yourdomain.tld`, `collabora.drive.yourdomain.tld`, `onlyoffice.drive.yourdomain.tld`). All of these domains need to have an A record pointing the IP address of your server.
This recipe requires four domains. One domain for drive, one for the S3 object storage ([RustFS](https://rustfs.com)) which also needs its own public endpoint (see [https://github.com/suitenumerique/drive/issues/476](https://github.com/suitenumerique/drive/issues/476)), one domain for collabora, and one domain for onlyoffice. For example (`drive.yourdomain.tld`, `rustfs.drive.yourdomain.tld`, `collabora.drive.yourdomain.tld`, `onlyoffice.drive.yourdomain.tld`). All of these domains need to have an A record pointing the IP address of your server.
### Installation Steps
* `abra app new lasuite-drive --secrets`
* `abra app config <app-name>`
- make sure to set MINIO_DOMAIN, COLLABORA_DOMAIN, ONLY_OFFICE_DOMAIN to the domains you set up for each.
- make sure to set RUSTFS_DOMAIN, COLLABORA_DOMAIN, ONLY_OFFICE_DOMAIN to the domains you set up for each.
* `abra app deploy <app-name>`
You should then be able to visit the landing page of your app, but not yet to login. To login, you need to deploy and integrate single sign on (described below in the "Configure Authentication" section).
* Migrations run automatically on backend startup. To trigger manually: `abra app cmd <app-name> backend migrate`
* Minio buckets are created automatically on first deploy. To manually trigger: `abra app cmd <app-name> minio minio_initialize`
* The S3 bucket is created automatically on backend startup. To manually trigger: `abra app cmd <app-name> backend s3_initialize`
Wopi discovery is supposed to happen automatically, but if collabora/onlyoffice are not connecting, you can try running:
* `abra app cmd <app-name> backend trigger_wopi` # connects only office & collabora (if they stop working, try running this again)
Maintenance tasks (cleaning unfinished uploads, purging the trash) are scheduled by celery beat, see `CLEAN_PENDING_ITEMS_SCHEDULE` and `PURGE_DELETED_ITEMS_SCHEDULE` in `.env.sample`.
## Migrating from MinIO
Since upstream drive v0.24, and in this recipe since the version packaging drive v0.25, the S3 object storage is [RustFS](https://rustfs.com) instead of MinIO. RustFS cannot read the MinIO data directory, so the media files have to be copied once. RustFS uses new secrets and a new domain variable.
1. `abra app config <app-name>` and add:
```
RUSTFS_DOMAIN="${MINIO_DOMAIN}"
SECRET_RUSTFS_RP_VERSION=v1
SECRET_RUSTFS_RU_VERSION=v1
COMPOSE_FILE="compose.yml:compose.minio-migration.yml"
```
Keep `MINIO_DOMAIN`, `SECRET_MINIO_RP_VERSION` and `SECRET_MINIO_RU_VERSION`, they are still needed during the migration. The `COMPOSE_FILE` line temporarily runs the old MinIO service on the old `minio` volume, next to RustFS.
2. Generate the RustFS credentials:
```
abra app secret generate <app-name> rustfs_ru v1
abra app secret generate <app-name> rustfs_rp v1
```
3. `abra app upgrade <app-name>` (or `abra app deploy <app-name> --force`)
4. `abra app cmd <app-name> backend migrate_from_minio`
This copies all objects (latest version only) from MinIO to RustFS. Objects that already exist on RustFS are never overwritten, so if the copy is interrupted, just run it again. Once a run has completed, further runs are refused: they would copy back files that users deleted in the meantime. If you really need to, run `abra app cmd <app-name> backend migrate_from_minio -- --force`.
5. Check that your files can be opened in drive, then remove the `COMPOSE_FILE` line from the config and redeploy: `abra app deploy <app-name> --force`. If you like, replace `RUSTFS_DOMAIN="${MINIO_DOMAIN}"` with the actual domain and remove `MINIO_DOMAIN`, `SECRET_MINIO_RP_VERSION` and `SECRET_MINIO_RU_VERSION`.
6. Once you are sure everything is there, you can remove the old volume and secrets on the server: `docker volume rm <stack-name>_minio`, `abra app secret rm <app-name> minio_ru` and `abra app secret rm <app-name> minio_rp`
Until step 4 is done, files uploaded before the upgrade will not be accessible.
## Configure Authentication
lasuite-drive **requires** an OpenID Connect (OIDC) single sign-on provider; deployment has been tested with [Keycloak](https://git.coopcloud.tech/coop-cloud/keycloak), which we recommend, or you could also try [Authentik](https://git.coopcloud.tech/coop-cloud/authentik), both of which are installable using Co-op Cloud.
@@ -92,3 +120,20 @@ You then need to insert the password for your smtp server as a secret:
Then redeploy the app, and automated e-mail sending should work:
`abra app deploy <app-name> --force`
## Configure the Collabora Admin Panel
Collabora has a web admin panel at `https://<COLLABORA_DOMAIN>/browser/dist/admin/admin.html`. It is disabled until a password is set. Using `abra app config <app-name>`, set:
```
COLLABORA_ADMIN_USERNAME=admin
COLLABORA_ADMIN_PASSWORD=<yourcollaborapass>
```
Then redeploy the app:
`abra app deploy <app-name> --force`
Since version 26.04, the Collabora image is distroless: there is no shell to read a Docker secret, so the password is passed as a plain environment variable. It is visible to anyone who can run `docker service inspect` on the swarm. Leave `COLLABORA_ADMIN_PASSWORD` unset if you don't need the admin panel.
If you are upgrading from a version that used the `collabora_p` secret, that secret is no longer used: remove `SECRET_COLLABORA_P_VERSION` from your config, and optionally the secret itself with `abra app secret remove <app-name> collabora_p`.