chore: upgrade drive to v0.26.0

collabora 26.04 images exec coolwsd directly (--use-env-vars; no shell in the
image), so the sh/start-collabora-online.sh entrypoint and extra_params env are
gone: ssl options move to command args, the healthcheck switches to
coolwsd --probe, and the admin panel password moves from the collabora_p
docker secret to the COLLABORA_ADMIN_PASSWORD env var (empty = locked).

redis 8.10.2 is a security release (transaction ACL-revocation bypass,
unauthenticated cluster-bus join; cache sidecar, no cluster mode here).

.env.sample

@@ -1,8 +1,7 @@
 TYPE=lasuite-drive
 
 DOMAIN=lasuite-drive.example.com
-# public domain of the RustFS object storage (S3)
-RUSTFS_DOMAIN="rustfs.${DOMAIN}"
+MINIO_DOMAIN="minio.${DOMAIN}"
 COLLABORA_DOMAIN="collabora.${DOMAIN}"
 ONLY_OFFICE_DOMAIN="onlyoffice.${DOMAIN}"
 
@@ -21,10 +20,10 @@ SECRET_DJANGO_SK_VERSION=v1
 SECRET_OIDC_RPCS_VERSION=v1
 # DJANGO_SUPERUSER_PASSWORD
 SECRET_DJANGO_SP_VERSION=v1
-# RUSTFS_SECRET_KEY
-SECRET_RUSTFS_RP_VERSION=v1
-# RUSTFS_ACCESS_KEY
-SECRET_RUSTFS_RU_VERSION=v1
+# MINIO_ROOT_PASSWORD
+SECRET_MINIO_RP_VERSION=v1
+# MINIO_ROOT_USER
+SECRET_MINIO_RU_VERSION=v1
 # POSTGRES_PASSWORD
 SECRET_POSTGRES_P_VERSION=v1
 # DJANGO_HOST_EMAIL_PASSWORD
@@ -76,10 +75,10 @@ LOGGING_LEVEL_LOGGERS_APP=INFO
 ##############################################################################
 # COLLABORA ADMIN PANEL
 ##############################################################################
-# Username for the Collabora admin panel (https://COLLABORA_DOMAIN/browser/dist/admin/admin.html)
-# The distroless collabora image (>= 26.04) cannot read Docker secrets, so the
-# password is passed as a plain env var (visible in `docker service inspect`).
-# The admin panel is unusable while it is unset.
+# Credentials for the Collabora admin panel (https://COLLABORA_DOMAIN/browser/dist/admin/admin.html)
+# Since collabora 26.04 (image execs coolwsd directly; no shell in the image), the panel
+# password moved from the retired Docker secret 'collabora_p' to this env var.
+# Empty/unset = panel stays locked.
 #COLLABORA_ADMIN_USERNAME=admin
 #COLLABORA_ADMIN_PASSWORD=
 
@@ -89,31 +88,6 @@ LOGGING_LEVEL_LOGGERS_APP=INFO
 # Set to false to disable backup-bot labels (default: true)
 #ENABLE_BACKUPS=true
 
-##############################################################################
-# MAINTENANCE SCHEDULING
-##############################################################################
-# Celery Beat crontab (m h dom mon dow) followed by the command arguments
-# Clean up uploads that never finished (default: daily at 0:30)
-#CLEAN_PENDING_ITEMS_SCHEDULE="30 0 * * * --hours=48"
-# Permanently purge items deleted from the trash (default: daily at 0:45)
-#PURGE_DELETED_ITEMS_SCHEDULE="45 0 * * *"
-
-##############################################################################
-# SDK
-##############################################################################
-# Enable the SDK picker pages (/sdk) and relay API used by other La Suite apps
-#SDK_ENABLED=false
-
-##############################################################################
-# MINIO MIGRATION
-##############################################################################
-# Only needed once when upgrading from recipe versions using MinIO (<= 0.13.x),
-# see README "Migrating from MinIO"
-#COMPOSE_FILE="compose.yml:compose.minio-migration.yml"
-# versions of the old MinIO secrets, keep them from your previous config
-#SECRET_MINIO_RP_VERSION=v1
-#SECRET_MINIO_RU_VERSION=v1
-
 ##############################################################################
 # WOPI SCHEDULING
 ##############################################################################

README.md

@@ -19,53 +19,25 @@
 
 ### Setting Up Domains
 
-This recipe requires four domains. One domain for drive, one for the S3 object storage ([RustFS](https://rustfs.com)) which also needs its own public endpoint (see [https://github.com/suitenumerique/drive/issues/476](https://github.com/suitenumerique/drive/issues/476)), one domain for collabora, and one domain for onlyoffice. For example (`drive.yourdomain.tld`, `rustfs.drive.yourdomain.tld`, `collabora.drive.yourdomain.tld`, `onlyoffice.drive.yourdomain.tld`). All of these domains need to have an A record pointing the IP address of your server.
+This recipe requires four domains. One domain for drive, and one for minio which also needs its own public endpoint (see [https://github.com/suitenumerique/drive/issues/476](https://github.com/suitenumerique/drive/issues/476)), one domain for collabora, and one domain for onlyoffice. For example (`drive.yourdomain.tld`, `minio.drive.yourdomain.tld`, `collabora.drive.yourdomain.tld`, `onlyoffice.drive.yourdomain.tld`). All of these domains need to have an A record pointing the IP address of your server.
 
 ### Installation Steps
 
 * `abra app new lasuite-drive --secrets`
 * `abra app config <app-name>`
-     - make sure to set RUSTFS_DOMAIN, COLLABORA_DOMAIN, ONLY_OFFICE_DOMAIN to the domains you set up for each. 
+     - make sure to set MINIO_DOMAIN, COLLABORA_DOMAIN, ONLY_OFFICE_DOMAIN to the domains you set up for each. 
 * `abra app deploy <app-name>`
 
 You should then be able to visit the landing page of your app, but not yet to login. To login, you need to deploy and integrate single sign on (described below in the "Configure Authentication" section). 
 
 * Migrations run automatically on backend startup. To trigger manually: `abra app cmd <app-name> backend migrate`
-* The S3 bucket is created automatically on backend startup. To manually trigger: `abra app cmd <app-name> backend s3_initialize`
+* Minio buckets are created automatically on first deploy. To manually trigger: `abra app cmd <app-name> minio minio_initialize`
 
 Wopi discovery is supposed to happen automatically, but if collabora/onlyoffice are not connecting, you can try running:
 
 * `abra app cmd <app-name> backend trigger_wopi` # connects only office & collabora (if they stop working, try running this again)
 
 
-Maintenance tasks (cleaning unfinished uploads, purging the trash) are scheduled by celery beat, see `CLEAN_PENDING_ITEMS_SCHEDULE` and `PURGE_DELETED_ITEMS_SCHEDULE` in `.env.sample`.
-
-## Migrating from MinIO
-
-Since upstream drive v0.24, and in this recipe since the version packaging drive v0.25, the S3 object storage is [RustFS](https://rustfs.com) instead of MinIO. RustFS cannot read the MinIO data directory, so the media files have to be copied once. RustFS uses new secrets and a new domain variable.
-
-1. `abra app config <app-name>` and add:
-   ```
-   RUSTFS_DOMAIN="${MINIO_DOMAIN}"
-   SECRET_RUSTFS_RP_VERSION=v1
-   SECRET_RUSTFS_RU_VERSION=v1
-   COMPOSE_FILE="compose.yml:compose.minio-migration.yml"
-   ```
-   Keep `MINIO_DOMAIN`, `SECRET_MINIO_RP_VERSION` and `SECRET_MINIO_RU_VERSION`, they are still needed during the migration. The `COMPOSE_FILE` line temporarily runs the old MinIO service on the old `minio` volume, next to RustFS.
-2. Generate the RustFS credentials:
-   ```
-   abra app secret generate <app-name> rustfs_ru v1
-   abra app secret generate <app-name> rustfs_rp v1
-   ```
-3. `abra app upgrade <app-name>` (or `abra app deploy <app-name> --force`)
-4. `abra app cmd <app-name> backend migrate_from_minio`
-
-   This copies all objects (latest version only) from MinIO to RustFS. Objects that already exist on RustFS are never overwritten, so if the copy is interrupted, just run it again. Once a run has completed, further runs are refused: they would copy back files that users deleted in the meantime. If you really need to, run `abra app cmd <app-name> backend migrate_from_minio -- --force`.
-5. Check that your files can be opened in drive, then remove the `COMPOSE_FILE` line from the config and redeploy: `abra app deploy <app-name> --force`. If you like, replace `RUSTFS_DOMAIN="${MINIO_DOMAIN}"` with the actual domain and remove `MINIO_DOMAIN`, `SECRET_MINIO_RP_VERSION` and `SECRET_MINIO_RU_VERSION`.
-6. Once you are sure everything is there, you can remove the old volume and secrets on the server: `docker volume rm <stack-name>_minio`, `abra app secret rm <app-name> minio_ru` and `abra app secret rm <app-name> minio_rp`
-
-Until step 4 is done, files uploaded before the upgrade will not be accessible.
-
 ## Configure Authentication
 
 lasuite-drive **requires** an OpenID Connect (OIDC) single sign-on provider; deployment has been tested with [Keycloak](https://git.coopcloud.tech/coop-cloud/keycloak), which we recommend, or you could also try [Authentik](https://git.coopcloud.tech/coop-cloud/authentik), both of which are installable using Co-op Cloud.
@@ -120,20 +92,3 @@ You then need to insert the password for your smtp server as a secret:
 Then redeploy the app, and automated e-mail sending should work:
 
 `abra app deploy <app-name> --force`
-
-## Configure the Collabora Admin Panel
-
-Collabora has a web admin panel at `https://<COLLABORA_DOMAIN>/browser/dist/admin/admin.html`. It is disabled until a password is set. Using `abra app config <app-name>`, set:
-
-```
-COLLABORA_ADMIN_USERNAME=admin
-COLLABORA_ADMIN_PASSWORD=<yourcollaborapass>
-```
-
-Then redeploy the app:
-
-`abra app deploy <app-name> --force`
-
-Since version 26.04, the Collabora image is distroless: there is no shell to read a Docker secret, so the password is passed as a plain environment variable. It is visible to anyone who can run `docker service inspect` on the swarm. Leave `COLLABORA_ADMIN_PASSWORD` unset if you don't need the admin panel.
-
-If you are upgrading from a version that used the `collabora_p` secret, that secret is no longer used: remove `SECRET_COLLABORA_P_VERSION` from your config, and optionally the secret itself with `abra app secret remove <app-name> collabora_p`.

abra-entrypoint.sh

@@ -3,8 +3,8 @@ set -e
 
 [ -f /run/secrets/postgres_p ] && export DB_PASSWORD="$(cat /run/secrets/postgres_p)"
 [ -f /run/secrets/django_sk ] && export DJANGO_SECRET_KEY="$(cat /run/secrets/django_sk)"
-[ -f /run/secrets/rustfs_rp ] && export AWS_S3_SECRET_ACCESS_KEY="$(cat /run/secrets/rustfs_rp)"
-[ -f /run/secrets/rustfs_ru ] && export AWS_S3_ACCESS_KEY_ID="$(cat /run/secrets/rustfs_ru)"
+[ -f /run/secrets/minio_rp ] && export AWS_S3_SECRET_ACCESS_KEY="$(cat /run/secrets/minio_rp)"
+[ -f /run/secrets/minio_ru ] && export AWS_S3_ACCESS_KEY_ID="$(cat /run/secrets/minio_ru)"
 [ -f /run/secrets/django_sp ] && export DJANGO_SUPERUSER_PASSWORD="$(cat /run/secrets/django_sp)"
 [ -f /run/secrets/oidc_rpcs ] && export OIDC_RP_CLIENT_SECRET="$(cat /run/secrets/oidc_rpcs)"
 [ -f /run/secrets/email_pass ] && export DJANGO_EMAIL_HOST_PASSWORD="$(cat /run/secrets/email_pass)"

abra.sh

@@ -1,12 +1,11 @@
 # Set any config versions here
 # Docs: https://docs.coopcloud.tech/maintainers/handbook/#manage-configs
-export ABRA_ENTRYPOINT_VERSION=v12
-export NGINX_CONF_VERSION=v7
-export ONLYOFFICE_CONF_VERSION=v3
+export ABRA_ENTRYPOINT_VERSION=v11
+export NGINX_CONF_VERSION=v6
+export ONLYOFFICE_CONF_VERSION=v2
 export PG_BACKUP_VERSION=v4
 export MIGRATE_VERSION=v1
-export S3_INITIALIZE_VERSION=v1
-export MIGRATE_FROM_MINIO_VERSION=v1
+export MINIO_INITIALIZE_VERSION=v2
 
 environment() {
   # this exports all the secrets as environment variables
@@ -17,13 +16,8 @@ migrate() {
   /migrate.sh
 }
 
-s3_initialize() {
-  /s3-initialize.sh
-}
-
-# only available when deployed with compose.minio-migration.yml
-migrate_from_minio() {
-  /migrate-from-minio.sh "$@"
+minio_initialize() {
+  /minio-initialize.sh
 }
 
 trigger_wopi() {

compose.minio-migration.yml

@@ -1,47 +0,0 @@
----
-# Temporary overlay to migrate the media files from the old MinIO service
-# (recipe versions up to 0.13.x) to RustFS. See README "Migrating from MinIO".
-services:
-  minio:
-    image: bitnamilegacy/minio:2025.7.23-debian-12-r5
-    user: root
-    environment:
-      MINIO_ROOT_USER_FILE: /run/secrets/minio_ru
-      MINIO_ROOT_PASSWORD_FILE: /run/secrets/minio_rp
-    healthcheck:
-      test: ["CMD", "mc", "ready", "local"]
-      interval: 5s
-      timeout: 20s
-      retries: 60
-    networks:
-      - backend
-    volumes:
-      - minio:/bitnami/minio/data
-    secrets:
-      - minio_rp
-      - minio_ru
-
-  backend:
-    secrets:
-      - minio_rp
-      - minio_ru
-    configs:
-      - source: migrate_from_minio
-        target: /migrate-from-minio.sh
-        mode: 0555
-
-volumes:
-  minio:
-
-configs:
-  migrate_from_minio:
-    name: ${STACK_NAME}_migrate_from_minio_${MIGRATE_FROM_MINIO_VERSION}
-    file: migrate-from-minio.sh
-
-secrets:
-  minio_rp:
-    external: true
-    name: ${STACK_NAME}_minio_rp_${SECRET_MINIO_RP_VERSION}
-  minio_ru:
-    external: true
-    name: ${STACK_NAME}_minio_ru_${SECRET_MINIO_RU_VERSION}

compose.yml

@@ -34,10 +34,10 @@ x-common-env: &common-env
   DRIVE_BASE_URL: "https://${DOMAIN}"
   # Media
   STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
-  AWS_S3_ENDPOINT_URL: http://rustfs:9000
-  AWS_S3_DOMAIN_REPLACE: https://${RUSTFS_DOMAIN}
-  # AWS_S3_ACCESS_KEY_ID supplied via secret (this is same as RUSTFS_ACCESS_KEY)
-  # AWS_S3_SECRET_ACCESS_KEY supplied via secret (this is same as RUSTFS_SECRET_KEY)
+  AWS_S3_ENDPOINT_URL: http://minio:9000
+  AWS_S3_DOMAIN_REPLACE: https://${MINIO_DOMAIN}
+  # AWS_S3_ACCESS_KEY_ID supplied via secret (this is same MINIO_ROOT_USER)
+  # AWS_S3_SECRET_ACCESS_KEY supplied via secret (this is same as MINIO_ROOT_PASSWORD)
   MEDIA_BASE_URL: https://${DOMAIN}
   AWS_STORAGE_BUCKET_NAME: drive-media-storage
   # OIDC - settings from .env, see .env.sample
@@ -63,8 +63,6 @@ x-common-env: &common-env
   AI_MODEL: llama
   # Collaboration
   COLLABORATION_API_URL: https://$DOMAIN/collaboration/api/
-  # SDK picker pages (/sdk) and SDK relay API, used by other La Suite apps
-  SDK_ENABLED: ${SDK_ENABLED:-false}
 
   # WOPI
   WOPI_CLIENTS: "collabora,onlyoffice"
@@ -89,23 +87,22 @@ x-postgres-env: &postgres-env
   DB_PORT: 5432
   # DB_PASSWORD supplied via secrets (this is same as POSTGRES_PASSWORD)
 
-x-rustfs-env: &rustfs-env
-  RUSTFS_ACCESS_KEY_FILE: /run/secrets/rustfs_ru
-  RUSTFS_SECRET_KEY_FILE: /run/secrets/rustfs_rp
-  RUSTFS_CONSOLE_ENABLE: "false"
+x-minio-env: &minio-env
+  MINIO_ROOT_USER_FILE: /run/secrets/minio_ru
+  MINIO_ROOT_PASSWORD_FILE: /run/secrets/minio_rp
 
 services:
 
   app:
     user: "${DOCKER_USER:-1000}"
-    image: lasuite/drive-frontend:v0.25.3
+    image: lasuite/drive-frontend:v0.26.0
     networks:
       - backend
     deploy:
       labels:
         - "traefik.enable=false"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=1.0.0+v0.25.3"
+        - "coop-cloud.${STACK_NAME}.version=0.13.3+v0.22.0"
     environment:
       <<: [ *common-env ]
     healthcheck:
@@ -119,11 +116,10 @@ services:
 
   backend:
     user: ${DOCKER_USER:-1000}
-    image: lasuite/drive-backend:v0.25.3
+    image: lasuite/drive-backend:v0.26.0
     command: [ "gunicorn", "-c", "/usr/local/etc/gunicorn/drive.py", "drive.wsgi:application" ]
     entrypoint: >
-      sh -c "/s3-initialize.sh || echo '⚠ s3-initialize failed, run: abra app cmd <app> backend s3_initialize' ;
-      if [ \"$$AUTO_MIGRATIONS\" = \"true\" ]; then /migrate.sh; fi && exec /abra-entrypoint.sh /usr/local/bin/entrypoint \"$$@\"" --
+      sh -c "if [ \"$$AUTO_MIGRATIONS\" = \"true\" ]; then /migrate.sh; fi && exec /abra-entrypoint.sh /usr/local/bin/entrypoint \"$$@\"" --
     environment:
       <<: [ *common-env, *postgres-env ]
       AUTO_MIGRATIONS: "${AUTO_MIGRATIONS:-true}"
@@ -138,21 +134,18 @@ services:
       - source: migrate
         target: /migrate.sh
         mode: 0555
-      - source: s3_initialize
-        target: /s3-initialize.sh
-        mode: 0555
     secrets:
       - django_sk
       - django_sp
       - oidc_rpcs
-      - rustfs_rp
-      - rustfs_ru
+      - minio_rp
+      - minio_ru
       - postgres_p
       - email_pass
 
   celery:
     user: ${DOCKER_USER:-1000}
-    image: lasuite/drive-backend:v0.25.3
+    image: lasuite/drive-backend:v0.26.0
     networks:
       - backend
     command: [ "celery", "-A", "drive.celery_app", "worker", "-l", "INFO" ]
@@ -168,23 +161,19 @@ services:
       - django_sk
       - django_sp
       - oidc_rpcs
-      - rustfs_rp
-      - rustfs_ru
+      - minio_rp
       - postgres_p
       - email_pass
 
   celery-beat:
     user: ${DOCKER_USER:-1000}
-    image: lasuite/drive-backend:v0.25.3
+    image: lasuite/drive-backend:v0.26.0
     networks:
       - backend
     command: [ "celery", "-A", "drive.celery_app", "beat", "-l", "INFO", "--schedule", "/tmp/celerybeat-schedule" ]
     entrypoint: ["/abra-entrypoint.sh", "/usr/local/bin/entrypoint"]
     environment:
       <<: [*common-env, *postgres-env]
-      # Maintenance commands scheduled by celery beat: crontab expression followed by command arguments
-      CLEAN_PENDING_ITEMS_SCHEDULE: ${CLEAN_PENDING_ITEMS_SCHEDULE:-30 0 * * *}
-      PURGE_DELETED_ITEMS_SCHEDULE: ${PURGE_DELETED_ITEMS_SCHEDULE:-45 0 * * *}
     configs:
       - source: abra_entrypoint
         target: /abra-entrypoint.sh
@@ -193,8 +182,7 @@ services:
       - django_sk
       - django_sp
       - oidc_rpcs
-      - rustfs_rp
-      - rustfs_ru
+      - minio_rp
       - postgres_p
       - email_pass
 
@@ -240,48 +228,58 @@ services:
     networks:
       - backend
 
-  rustfs:
-    image: rustfs/rustfs:1.0.5
-    environment: *rustfs-env
+  minio:
+    image: bitnamilegacy/minio:2025.7.23-debian-12-r5
+    user: root
+    environment: *minio-env
     healthcheck:
-      test: ["CMD", "curl", "-sf", "http://localhost:9000/health"]
-      interval: 5s
+      test: ["CMD", "mc", "ready", "local"]
+      interval: 1s
       timeout: 20s
-      retries: 60
+      retries: 300
     networks:
       - backend
       - proxy
+    command: /opt/bitnami/scripts/minio/run.sh
+    entrypoint: >
+      sh -c "/minio-initialize.sh & exec /opt/bitnami/scripts/minio/entrypoint.sh \"$$@\"" --
     volumes:
-      - rustfs:/data
+      - minio:/bitnami/minio/data
+    configs:
+      - source: abra_entrypoint
+        target: /abra-entrypoint.sh
+        mode: 0555
+      - source: minio_initialize
+        target: /minio-initialize.sh
+        mode: 0555
     secrets:
-      - rustfs_rp
-      - rustfs_ru
+      - minio_rp
+      - minio_ru
     deploy:
       labels:
         - "traefik.enable=true"
         - "traefik.docker.network=proxy"
-        - "traefik.http.routers.${STACK_NAME}_rustfs.rule=Host(`${RUSTFS_DOMAIN}`)"
-        - "traefik.http.routers.${STACK_NAME}_rustfs.entrypoints=web-secure"
-        - "traefik.http.routers.${STACK_NAME}_rustfs.tls=true"
-        - "traefik.http.routers.${STACK_NAME}_rustfs.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "traefik.http.services.${STACK_NAME}_rustfs.loadbalancer.server.port=9000"
-        - "traefik.http.middlewares.${STACK_NAME}_rustfs-cors.headers.accessControlAllowOriginList=https://${DOMAIN}"
-        - "traefik.http.middlewares.${STACK_NAME}_rustfs-cors.headers.accessControlAllowMethods=GET,POST,PUT,DELETE,OPTIONS"
-        - "traefik.http.middlewares.${STACK_NAME}_rustfs-cors.headers.accessControlAllowHeaders=*"
-        - "traefik.http.middlewares.${STACK_NAME}_rustfs-cors.headers.accessControlExposeHeaders=ETag,Content-Length"
-        - "traefik.http.middlewares.${STACK_NAME}_rustfs-cors.headers.accessControlMaxAge=600"
-        - "traefik.http.middlewares.${STACK_NAME}_rustfs-cors.headers.addVaryHeader=true"
-        - "traefik.http.routers.${STACK_NAME}_rustfs.middlewares=${STACK_NAME}_rustfs-cors"
+        - "traefik.http.routers.${STACK_NAME}_minio.rule=Host(`${MINIO_DOMAIN}`)"
+        - "traefik.http.routers.${STACK_NAME}_minio.entrypoints=web-secure"
+        - "traefik.http.routers.${STACK_NAME}_minio.tls=true"
+        - "traefik.http.routers.${STACK_NAME}_minio.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.http.services.${STACK_NAME}_minio.loadbalancer.server.port=9000"
+        - "traefik.http.middlewares.${STACK_NAME}_minio-cors.headers.accessControlAllowOriginList=https://${DOMAIN}"
+        - "traefik.http.middlewares.${STACK_NAME}_minio-cors.headers.accessControlAllowMethods=GET,POST,PUT,DELETE,OPTIONS"
+        - "traefik.http.middlewares.${STACK_NAME}_minio-cors.headers.accessControlAllowHeaders=*"
+        - "traefik.http.middlewares.${STACK_NAME}_minio-cors.headers.accessControlExposeHeaders=ETag,Content-Length"
+        - "traefik.http.middlewares.${STACK_NAME}_minio-cors.headers.accessControlMaxAge=600"
+        - "traefik.http.middlewares.${STACK_NAME}_minio-cors.headers.addVaryHeader=true"
+        - "traefik.http.routers.${STACK_NAME}_minio.middlewares=${STACK_NAME}_minio-cors"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   collabora:
-    image: collabora/code:26.04.6.1.1
-    # Since 26.04 the image is distroless (no sh, no curl, no
-    # start-collabora-online.sh): keep the image entrypoint
-    # (coolwsd --use-env-vars), which reads the env vars below directly.
+    image: collabora/code:26.04.5.2.1
+    # 26.04 images exec coolwsd directly (no shell in the image), so ssl options are passed as
+    # args and the panel password comes from the env instead of a Docker secret.
+    command: ["--o:ssl.enable=false", "--o:ssl.termination=true"]
     healthcheck:
-      # --use-env-vars so the probe honours ssl.enable=false from extra_params
-      test: [ "CMD", "/usr/bin/coolwsd", "--probe", "--use-env-vars" ]
+      test: [ "CMD", "/usr/bin/coolwsd", "--probe", "--o:ssl.enable=false" ]
       interval: 30s
       retries: 5
       start_period: 60s
@@ -290,10 +288,9 @@ services:
       - backend
       - proxy
     environment:
-      - extra_params=--o:ssl.enable=false --o:ssl.termination=true
       - username=${COLLABORA_ADMIN_USERNAME:-admin}
-      - password=${COLLABORA_ADMIN_PASSWORD}
       - server_name=${COLLABORA_DOMAIN}
+      - password=${COLLABORA_ADMIN_PASSWORD:-}
     deploy:
       labels:
       - "traefik.enable=true"
@@ -323,9 +320,6 @@ services:
       TZ: "Europe/Berlin"
       USE_UNAUTHORIZED_STORAGE: "true"
       ONLY_OFFICE_DOMAIN: ${ONLY_OFFICE_DOMAIN} # need to make variable available for golang template
-      # onlyoffice >= 10.0.2 only sends WOPI requests to hosts named in an
-      # ipfilter rule (wopi.requireIpFilterRule), see onlyoffice-config.json.tmpl
-      DOMAIN: ${DOMAIN}
     networks:
       - backend
       - proxy
@@ -348,8 +342,9 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}_onlyoffice-cors.headers.accessControlExposeHeaders=ETag,Content-Length"
         - "traefik.http.middlewares.${STACK_NAME}_onlyoffice-cors.headers.accessControlMaxAge=600"
         - "traefik.http.middlewares.${STACK_NAME}_onlyoffice-cors.headers.addVaryHeader=true"
+        - "traefik.http.routers.${STACK_NAME}_onlyoffice.middlewares=${STACK_NAME}_onlyoffice-cors"
         - "traefik.http.middlewares.${STACK_NAME}_onlyoffice-fwdproto.headers.customRequestHeaders.X-Forwarded-Proto=https"
-        - "traefik.http.routers.${STACK_NAME}_onlyoffice.middlewares=${STACK_NAME}_onlyoffice-cors,${STACK_NAME}_onlyoffice-fwdproto"
+        - "traefik.http.routers.${STACK_NAME}_onlyoffice.middlewares=${STACK_NAME}_onlyoffice-fwdproto"
 
 
   web:
@@ -382,7 +377,7 @@ networks:
 
 volumes:
   postgres:
-  rustfs:
+  minio:
 
 configs:
   nginx_conf:
@@ -398,9 +393,9 @@ configs:
   migrate:
     name: ${STACK_NAME}_migrate_${MIGRATE_VERSION}
     file: migrate.sh
-  s3_initialize:
-    name: ${STACK_NAME}_s3_initialize_${S3_INITIALIZE_VERSION}
-    file: s3-initialize.sh
+  minio_initialize:
+    name: ${STACK_NAME}_minio_initialize_${MINIO_INITIALIZE_VERSION}
+    file: minio-initialize.sh
   onlyoffice_conf:
     name: ${STACK_NAME}_onlyoffice_conf_${ONLYOFFICE_CONF_VERSION}
     file: onlyoffice-config.json.tmpl
@@ -419,12 +414,12 @@ secrets:
   postgres_p:
     external: true
     name: ${STACK_NAME}_postgres_p_${SECRET_POSTGRES_P_VERSION}
-  rustfs_rp:
+  minio_rp:
     external: true
-    name: ${STACK_NAME}_rustfs_rp_${SECRET_RUSTFS_RP_VERSION}
-  rustfs_ru:
+    name: ${STACK_NAME}_minio_rp_${SECRET_MINIO_RP_VERSION}
+  minio_ru:
     external: true
-    name: ${STACK_NAME}_rustfs_ru_${SECRET_RUSTFS_RU_VERSION}
+    name: ${STACK_NAME}_minio_ru_${SECRET_MINIO_RU_VERSION}
   email_pass:
     external: true
-    name: ${STACK_NAME}_email_pass_${SECRET_EMAIL_PASS_VERSION}
+    name: ${STACK_NAME}_email_pass_${SECRET_EMAIL_PASS_VERSION}

migrate-from-minio.sh

@@ -1,96 +0,0 @@
-#!/bin/sh
-set -e
-
-# One-shot copy of all objects from the old MinIO service (deployed with
-# compose.minio-migration.yml) into the RustFS object storage.
-# Only the latest version of each object is copied, and only objects missing
-# on RustFS: objects changed on RustFS since (e.g. edited documents) are never
-# overwritten. Once a run completes, a marker object is written and further
-# runs are refused, unless called with --force.
-
-# Load secrets into environment
-source /abra-entrypoint.sh -e
-
-python - "$@" <<'PYEOF'
-import os
-import sys
-
-import boto3
-from botocore.exceptions import ClientError
-
-bucket = os.environ.get("AWS_STORAGE_BUCKET_NAME", "drive-media-storage")
-marker = "_minio-migration-done"
-force = "--force" in sys.argv[1:]
-
-
-def secret(name):
-    with open(f"/run/secrets/{name}") as f:
-        return f.read().strip()
-
-
-def client(endpoint, access_key, secret_key):
-    return boto3.client(
-        "s3",
-        endpoint_url=endpoint,
-        aws_access_key_id=access_key,
-        aws_secret_access_key=secret_key,
-        region_name=os.environ.get("AWS_S3_REGION_NAME", "us-east-1"),
-    )
-
-
-def exists(s3, key):
-    try:
-        s3.head_object(Bucket=bucket, Key=key)
-        return True
-    except ClientError as error:
-        if error.response["Error"]["Code"] in ("404", "NoSuchKey", "NotFound"):
-            return False
-        raise
-
-
-# the old MinIO uses the minio_* secrets, RustFS the rustfs_* secrets
-src = client(
-    os.environ.get("MINIO_MIGRATION_ENDPOINT_URL", "http://minio:9000"),
-    secret("minio_ru"),
-    secret("minio_rp"),
-)
-dst = client(
-    os.environ["AWS_S3_ENDPOINT_URL"],
-    os.environ["AWS_S3_ACCESS_KEY_ID"],
-    os.environ["AWS_S3_SECRET_ACCESS_KEY"],
-)
-
-if exists(dst, marker) and not force:
-    sys.exit(
-        "migrate-from-minio: the migration already completed, refusing to run again.\n"
-        "Objects deleted on RustFS since then would be copied back from MinIO.\n"
-        "Use 'migrate_from_minio --force' to run anyway (existing objects are never overwritten)."
-    )
-
-try:
-    src.head_bucket(Bucket=bucket)
-except Exception as error:
-    sys.exit(f"migrate-from-minio: cannot reach bucket '{bucket}' on minio: {error}")
-
-copied = skipped = 0
-for page in src.get_paginator("list_objects_v2").paginate(Bucket=bucket):
-    for obj in page.get("Contents", []):
-        key = obj["Key"]
-        # upload_fileobj is atomic: an object only exists once fully copied
-        if exists(dst, key):
-            skipped += 1
-            continue
-        source = src.get_object(Bucket=bucket, Key=key)
-        extra = {"ContentType": source.get("ContentType", "binary/octet-stream")}
-        if source.get("Metadata"):
-            extra["Metadata"] = source["Metadata"]
-        if source.get("ContentDisposition"):
-            extra["ContentDisposition"] = source["ContentDisposition"]
-        dst.upload_fileobj(source["Body"], bucket, key, ExtraArgs=extra)
-        copied += 1
-        if copied % 100 == 0:
-            print(f"migrate-from-minio: {copied} objects copied...")
-
-dst.put_object(Bucket=bucket, Key=marker, Body=b"")
-print(f"migrate-from-minio: done, {copied} copied, {skipped} already present")
-PYEOF

minio-initialize.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+# Use an isolated mc config dir: the bundled Bitnami image runs its own
+# internal mc client (as the "minio" user) against the default /.mc path,
+# which collides with this script running as root against the same path.
+export MC_CONFIG_DIR=/tmp/mc-drive-init
+
+# Wait for minio to be ready (up to 60 seconds)
+i=0
+while ! mc ready local 2>/dev/null; do
+  i=$((i+1))
+  if [ "$i" -ge 60 ]; then
+    echo "minio-initialize: timed out waiting for minio to be ready" >&2
+    exit 1
+  fi
+  sleep 1
+done
+
+MINIO_ROOT_USER="$(cat /run/secrets/minio_ru)"
+MINIO_ROOT_PASSWORD="$(cat /run/secrets/minio_rp)"
+
+mc alias set drive http://localhost:9000 "${MINIO_ROOT_USER}" "${MINIO_ROOT_PASSWORD}"
+
+# Idempotent: skip if bucket already exists
+if mc ls drive/drive-media-storage > /dev/null 2>&1; then
+  echo "minio-initialize: bucket 'drive-media-storage' already exists, skipping"
+  exit 0
+fi
+
+echo "minio-initialize: creating bucket 'drive-media-storage'..."
+mc mb drive/drive-media-storage
+mc version enable drive/drive-media-storage
+echo "minio-initialize: done"

nginx.conf.tmpl

@@ -56,9 +56,9 @@ server {
         proxy_set_header X-Amz-Date $authDate;
         proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
 
-        # Get resource from the RustFS object storage
-        proxy_pass http://rustfs:9000/drive-media-storage/;
-        proxy_set_header Host rustfs:9000;
+        # Get resource from Minio
+        proxy_pass http://minio:9000/drive-media-storage/;
+        proxy_set_header Host minio:9000;
     }
 
     # Proxy auth for media-preview
@@ -74,9 +74,9 @@ server {
         proxy_set_header X-Amz-Date $authDate;
         proxy_set_header X-Amz-Content-SHA256 $authContentSha256;
 
-        # Get resource from the RustFS object storage
-        proxy_pass http://rustfs:9000/drive-media-storage/;
-        proxy_set_header Host rustfs:9000;
+        # Get resource from Minio
+        proxy_pass http://minio:9000/drive-media-storage/;
+        proxy_set_header Host minio:9000;
     }
 
     location /media-auth {

onlyoffice-config.json.tmpl

@@ -1,14 +1,4 @@
 {
-    "services": {
-        "CoAuthoring": {
-            "ipfilter": {
-                "rules": [
-                    {"address": "{{ env "DOMAIN" }}", "allowed": true},
-                    {"address": "*", "allowed": true}
-                ]
-            }
-        }
-    },
     "wopi": {
         "enable": true,
         "host": "https://{{ env "ONLY_OFFICE_DOMAIN" }}",

release/1.0.0+v0.25.3

@@ -1,27 +0,0 @@
-Upgrade to drive v0.25.3.
-
-**Breaking change:** following upstream, the S3 object storage changed from MinIO (`bitnamilegacy/minio`, unmaintained) to RustFS (`rustfs/rustfs`). RustFS cannot read the MinIO data, so existing media files must be copied once:
-
-```
-abra app config <app-domain>   # add:
-                               #   RUSTFS_DOMAIN="${MINIO_DOMAIN}"
-                               #   SECRET_RUSTFS_RP_VERSION=v1
-                               #   SECRET_RUSTFS_RU_VERSION=v1
-                               #   COMPOSE_FILE="compose.yml:compose.minio-migration.yml"
-abra app secret generate <app-domain> rustfs_ru v1
-abra app secret generate <app-domain> rustfs_rp v1
-abra app upgrade <app-domain>
-abra app cmd <app-domain> backend migrate_from_minio
-abra app config <app-domain>   # remove the COMPOSE_FILE line
-abra app deploy <app-domain> --force
-```
-
-See README "Migrating from MinIO" for details. RustFS uses the new `rustfs_ru`/`rustfs_rp` secrets and `RUSTFS_DOMAIN`. The old `minio_ru`/`minio_rp` secrets and `MINIO_DOMAIN` are only needed during the migration.
-
-**Breaking change:** the Collabora image is distroless and cannot read Docker secrets, so the `collabora_p` secret is no longer used. The admin panel is unusable until you set `COLLABORA_ADMIN_PASSWORD` with `abra app config <app-domain>`. The password is passed as a plain environment variable, visible in `docker service inspect`. Remove `SECRET_COLLABORA_P_VERSION` from your config, and optionally the secret with `abra app secret remove <app-domain> collabora_p`. See README "Configure the Collabora Admin Panel".
-
-Other changes:
-- The S3 bucket is now created by the backend on startup (`abra app cmd <app-domain> backend s3_initialize`), the `minio_initialize` command is gone.
-- Maintenance commands `clean_pending_items` (daily 0:30) and `purge_deleted_items` (daily 0:45) are now scheduled by celery beat. Configure with `CLEAN_PENDING_ITEMS_SCHEDULE` / `PURGE_DELETED_ITEMS_SCHEDULE`. Note that this permanently purges items deleted from the trash after the upstream grace periods (30 + 7 days).
-- New `SDK_ENABLED` setting (default `false`) for the SDK picker used by other La Suite apps.
-- The celery workers now get the S3 access key secret too.

s3-initialize.sh

@@ -1,51 +0,0 @@
-#!/bin/sh
-set -e
-
-# Creates the media bucket on the RustFS object storage, with versioning
-# enabled. Runs inside the backend container, which ships boto3.
-
-# Load secrets into environment
-source /abra-entrypoint.sh -e
-
-python - <<'PYEOF'
-import os
-import sys
-import time
-
-import boto3
-from botocore.exceptions import ClientError, EndpointConnectionError
-
-bucket = os.environ.get("AWS_STORAGE_BUCKET_NAME", "drive-media-storage")
-s3 = boto3.client(
-    "s3",
-    endpoint_url=os.environ["AWS_S3_ENDPOINT_URL"],
-    aws_access_key_id=os.environ["AWS_S3_ACCESS_KEY_ID"],
-    aws_secret_access_key=os.environ["AWS_S3_SECRET_ACCESS_KEY"],
-    region_name=os.environ.get("AWS_S3_REGION_NAME", "us-east-1"),
-)
-
-# Wait for the object storage to be ready (up to 60 seconds)
-for i in range(60):
-    try:
-        s3.list_buckets()
-        break
-    except (ClientError, EndpointConnectionError):
-        time.sleep(1)
-else:
-    sys.exit("s3-initialize: timed out waiting for the object storage")
-
-# Idempotent: skip if bucket already exists
-try:
-    s3.head_bucket(Bucket=bucket)
-    print(f"s3-initialize: bucket '{bucket}' already exists, skipping")
-    sys.exit(0)
-except ClientError:
-    pass
-
-print(f"s3-initialize: creating bucket '{bucket}'...")
-s3.create_bucket(Bucket=bucket)
-s3.put_bucket_versioning(
-    Bucket=bucket, VersioningConfiguration={"Status": "Enabled"}
-)
-print("s3-initialize: done")
-PYEOF