chore: upgrade drive to v0.25.2, nginx to 1.31.8; fix collabora 26.04 runtime contract

The previous commit forgot to update the minio-version, which makes updates fail.

.env.sample

@@ -28,8 +28,6 @@ SECRET_MINIO_RU_VERSION=v1
 SECRET_POSTGRES_P_VERSION=v1
 # DJANGO_HOST_EMAIL_PASSWORD
 SECRET_EMAIL_PASS_VERSION=v1
-# COLLABORA_ADMIN_PASSWORD
-SECRET_COLLABORA_P_VERSION=v1
 
 ##############################################################################
 # EMAIL
@@ -77,9 +75,12 @@ LOGGING_LEVEL_LOGGERS_APP=INFO
 ##############################################################################
 # COLLABORA ADMIN PANEL
 ##############################################################################
-# Username for the Collabora admin panel (https://COLLABORA_DOMAIN/browser/dist/admin/admin.html)
+# Credentials for the Collabora admin panel (https://COLLABORA_DOMAIN/browser/dist/admin/admin.html)
-# Password is managed via Docker secret 'collabora_p'
+# Since collabora 26.04 (image execs coolwsd directly; no shell in the image), the panel
+# password moved from the retired Docker secret 'collabora_p' to this env var.
+# Empty/unset = panel stays locked.
 #COLLABORA_ADMIN_USERNAME=admin
+#COLLABORA_ADMIN_PASSWORD=
 
 ##############################################################################
 # BACKUPS

MAINTENANCE.md

@@ -0,0 +1,29 @@
+# Lasuite-Drive Recipe Maintenance
+
+All contributions should be made via pull requests.
+
+## Pull Requests
+
+A pull request can be merged directly into `main` by any maintainer. 
+No approval is needed, but pull requests should be tested as working before merge.
+
+## Dependency Updates
+
+- patch updates proposed from renovate bot are merged directly - 
+  if there is a CVE, also release a new patch version of this recipe
+- minor updates proposed from renovate bot are tested by one maintainer 
+  and merged if they don't break, then a new minor version of the recipe 
+  is released
+- major updates proposed form renovate bot are tested by two maintainers 
+  and merged if they don't break, then a major version of the recipe is 
+  released. 
+  If the renovate bot PR is older than one week, one maintainer can decide
+  to merge it anyway. 
+
+## Become a maintainer
+
+Everyone can apply to be a recipe maintainer:
+
+1. Watch the repository to get updates.
+2. Add yourself to the list in [README.md](./README.md) and open a pull request with the change.
+3. Once the pull request is merged, you will be added to the [La Suite maintainers team](https://git.coopcloud.tech/org/coop-cloud/teams/lasuite-maintainers).

README.md

@@ -3,7 +3,7 @@
 > [Drive](https://github.com/suitenumerique/drive) (part of [La Suite Numerique](https://lasuite.numerique.gouv.fr/en)) for Co-op Cloud
 
 <!-- metadata -->
-
+* **Maintainer**: [@trav](https://git.coopcloud.tech/trav), [@notplants](https://git.coopcloud.tech/notplants), [@ineiti](https://git.coopcloud.tech/ineiti)
 * **Category**: Apps
 * **Status**: 2
 * **Image**: [`lasuite/drive`](https://hub.docker.com/r/lasuite/drive), 4, upstream
@@ -92,8 +92,3 @@ You then need to insert the password for your smtp server as a secret:
 Then redeploy the app, and automated e-mail sending should work:
 
 `abra app deploy <app-name> --force`
-
-
-## Maintainers
-
-coop cloud recipe maintained by @notplants

abra.sh

@@ -5,7 +5,7 @@ export NGINX_CONF_VERSION=v6
 export ONLYOFFICE_CONF_VERSION=v2
 export PG_BACKUP_VERSION=v4
 export MIGRATE_VERSION=v1
-export MINIO_INITIALIZE_VERSION=v1
+export MINIO_INITIALIZE_VERSION=v2
 
 environment() {
   # this exports all the secrets as environment variables

compose.yml

@@ -95,14 +95,14 @@ services:
 
   app:
     user: "${DOCKER_USER:-1000}"
-    image: lasuite/drive-frontend:v0.19.0
+    image: lasuite/drive-frontend:v0.25.2
     networks:
       - backend
     deploy:
       labels:
         - "traefik.enable=false"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=0.10.1+v0.19.0"
+        - "coop-cloud.${STACK_NAME}.version=0.13.3+v0.22.0"
     environment:
       <<: [ *common-env ]
     healthcheck:
@@ -116,7 +116,7 @@ services:
 
   backend:
     user: ${DOCKER_USER:-1000}
-    image: lasuite/drive-backend:v0.19.0
+    image: lasuite/drive-backend:v0.25.2
     command: [ "gunicorn", "-c", "/usr/local/etc/gunicorn/drive.py", "drive.wsgi:application" ]
     entrypoint: >
       sh -c "if [ \"$$AUTO_MIGRATIONS\" = \"true\" ]; then /migrate.sh; fi && exec /abra-entrypoint.sh /usr/local/bin/entrypoint \"$$@\"" --
@@ -145,7 +145,7 @@ services:
 
   celery:
     user: ${DOCKER_USER:-1000}
-    image: lasuite/drive-backend:v0.19.0
+    image: lasuite/drive-backend:v0.25.2
     networks:
       - backend
     command: [ "celery", "-A", "drive.celery_app", "worker", "-l", "INFO" ]
@@ -167,7 +167,7 @@ services:
 
   celery-beat:
     user: ${DOCKER_USER:-1000}
-    image: lasuite/drive-backend:v0.19.0
+    image: lasuite/drive-backend:v0.25.2
     networks:
       - backend
     command: [ "celery", "-A", "drive.celery_app", "beat", "-l", "INFO", "--schedule", "/tmp/celerybeat-schedule" ]
@@ -214,7 +214,7 @@ services:
       - postgres_p
 
   redis:
-    image: redis:8.8.0
+    image: redis:8.10.2
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 10s
@@ -224,12 +224,13 @@ services:
       - backend
 
   mailcatcher:
-    image: sj26/mailcatcher:v0.10.0
+    image: sj26/mailcatcher:v0.11.0
     networks:
       - backend
 
   minio:
-    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
+    image: bitnamilegacy/minio:2025.7.23-debian-12-r5
+    user: root
     environment: *minio-env
     healthcheck:
       test: ["CMD", "mc", "ready", "local"]
@@ -239,11 +240,11 @@ services:
     networks:
       - backend
       - proxy
-    command: minio server /data
+    command: /opt/bitnami/scripts/minio/run.sh
     entrypoint: >
-      sh -c "/minio-initialize.sh & exec /usr/bin/docker-entrypoint.sh \"$$@\"" --
+      sh -c "/minio-initialize.sh & exec /opt/bitnami/scripts/minio/entrypoint.sh \"$$@\"" --
     volumes:
-      - minio:/data
+      - minio:/bitnami/minio/data
     configs:
       - source: abra_entrypoint
         target: /abra-entrypoint.sh
@@ -273,13 +274,12 @@ services:
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
 
   collabora:
-    image: collabora/code:25.04.9.4.1
+    image: collabora/code:26.04.5.1.1
-    entrypoint: >
+    # 26.04 images exec coolwsd directly (no shell in the image), so ssl options are passed as
-      sh -c "
+    # args and the panel password comes from the env instead of a Docker secret.
-      export password=\"$$(cat /run/secrets/collabora_p)\" &&
+    command: ["--o:ssl.enable=false", "--o:ssl.termination=true"]
-      exec /start-collabora-online.sh"
     healthcheck:
-      test: [ "CMD", "curl", "-f", "http://localhost:9980/hosting/discovery" ]
+      test: [ "CMD", "/usr/bin/coolwsd", "--probe", "--o:ssl.enable=false" ]
       interval: 30s
       retries: 5
       start_period: 60s
@@ -288,11 +288,9 @@ services:
       - backend
       - proxy
     environment:
-      - extra_params=--o:ssl.enable=false --o:ssl.termination=true
       - username=${COLLABORA_ADMIN_USERNAME:-admin}
       - server_name=${COLLABORA_DOMAIN}
-    secrets:
+      - password=${COLLABORA_ADMIN_PASSWORD:-}
-      - collabora_p
     deploy:
       labels:
       - "traefik.enable=true"
@@ -311,7 +309,7 @@ services:
       - "traefik.http.routers.${STACK_NAME}_collabora.middlewares=${STACK_NAME}_collabora-cors"
 
   onlyoffice:
-    image: onlyoffice/documentserver-de:9.3.1.2
+    image: onlyoffice/documentserver-de:10.0.0.1
     healthcheck:
       test: [ "CMD", "curl", "-f", "http://localhost/hosting/discovery" ]
       interval: 30s
@@ -350,7 +348,7 @@ services:
 
 
   web:
-    image: nginx:1.31.2
+    image: nginx:1.31.8
     configs:
       - source: nginx_conf
         target: /etc/nginx/conf.d/default.conf
@@ -422,9 +420,6 @@ secrets:
   minio_ru:
     external: true
     name: ${STACK_NAME}_minio_ru_${SECRET_MINIO_RU_VERSION}
-  collabora_p:
-    external: true
-    name: ${STACK_NAME}_collabora_p_${SECRET_COLLABORA_P_VERSION}
   email_pass:
     external: true
     name: ${STACK_NAME}_email_pass_${SECRET_EMAIL_PASS_VERSION}

minio-initialize.sh

@@ -1,6 +1,11 @@
 #!/bin/sh
 set -e
 
+# Use an isolated mc config dir: the bundled Bitnami image runs its own
+# internal mc client (as the "minio" user) against the default /.mc path,
+# which collides with this script running as root against the same path.
+export MC_CONFIG_DIR=/tmp/mc-drive-init
+
 # Wait for minio to be ready (up to 60 seconds)
 i=0
 while ! mc ready local 2>/dev/null; do

renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}