lasuite-drive

Drive (part of La Suite Numerique) for Co-op Cloud

• Maintainer: @trav, @notplants, @ineiti
• Category: Apps
• Status: 2
• Image: lasuite/drive, 4, upstream
• Healthcheck: Yes
• Backups: Yes
• Email: Yes
• Tests: No
• SSO: Yes

Quick start

Setting Up Domains

This recipe requires four domains. One domain for drive, one for the S3 object storage (RustFS) which also needs its own public endpoint (see https://github.com/suitenumerique/drive/issues/476), one domain for collabora, and one domain for onlyoffice. For example (drive.yourdomain.tld, rustfs.drive.yourdomain.tld, collabora.drive.yourdomain.tld, onlyoffice.drive.yourdomain.tld). All of these domains need to have an A record pointing the IP address of your server.

Installation Steps

• abra app new lasuite-drive --secrets
• abra app config <app-name>
  • make sure to set RUSTFS_DOMAIN, COLLABORA_DOMAIN, ONLY_OFFICE_DOMAIN to the domains you set up for each.
• abra app deploy <app-name>

You should then be able to visit the landing page of your app, but not yet to login. To login, you need to deploy and integrate single sign on (described below in the "Configure Authentication" section).

• Migrations run automatically on backend startup. To trigger manually: abra app cmd <app-name> backend migrate
• The S3 bucket is created automatically on backend startup. To manually trigger: abra app cmd <app-name> backend s3_initialize

Wopi discovery is supposed to happen automatically, but if collabora/onlyoffice are not connecting, you can try running:

• abra app cmd <app-name> backend trigger_wopi # connects only office & collabora (if they stop working, try running this again)

Maintenance tasks (cleaning unfinished uploads, purging the trash) are scheduled by celery beat, see CLEAN_PENDING_ITEMS_SCHEDULE and PURGE_DELETED_ITEMS_SCHEDULE in .env.sample.

Migrating from MinIO

Since upstream drive v0.24, and in this recipe since the version packaging drive v0.25, the S3 object storage is RustFS instead of MinIO. RustFS cannot read the MinIO data directory, so the media files have to be copied once. RustFS uses new secrets and a new domain variable.

1. abra app config <app-name> and add:

   RUSTFS_DOMAIN="${MINIO_DOMAIN}"
   SECRET_RUSTFS_RP_VERSION=v1
   SECRET_RUSTFS_RU_VERSION=v1
   COMPOSE_FILE="compose.yml:compose.minio-migration.yml"
   

   Keep MINIO_DOMAIN, SECRET_MINIO_RP_VERSION and SECRET_MINIO_RU_VERSION, they are still needed during the migration. The COMPOSE_FILE line temporarily runs the old MinIO service on the old minio volume, next to RustFS.

2. Generate the RustFS credentials:

   abra app secret generate <app-name> rustfs_ru v1
   abra app secret generate <app-name> rustfs_rp v1
   

3. abra app upgrade <app-name> (or abra app deploy <app-name> --force)

4. abra app cmd <app-name> backend migrate_from_minio

   This copies all objects (latest version only) from MinIO to RustFS. Objects that already exist on RustFS are never overwritten, so if the copy is interrupted, just run it again. Once a run has completed, further runs are refused: they would copy back files that users deleted in the meantime. If you really need to, run abra app cmd <app-name> backend migrate_from_minio -- --force.

5. Check that your files can be opened in drive, then remove the COMPOSE_FILE line from the config and redeploy: abra app deploy <app-name> --force. If you like, replace RUSTFS_DOMAIN="${MINIO_DOMAIN}" with the actual domain and remove MINIO_DOMAIN, SECRET_MINIO_RP_VERSION and SECRET_MINIO_RU_VERSION.

6. Once you are sure everything is there, you can remove the old volume and secrets on the server: docker volume rm <stack-name>_minio, abra app secret rm <app-name> minio_ru and abra app secret rm <app-name> minio_rp

Until step 4 is done, files uploaded before the upgrade will not be accessible.

Configure Authentication

lasuite-drive requires an OpenID Connect (OIDC) single sign-on provider; deployment has been tested with Keycloak, which we recommend, or you could also try Authentik, both of which are installable using Co-op Cloud.

Instructions for integrating keycloak with drive after deploying it, are below.

• In keycloak, create a realm (save the name of this realm, you will need it later)

• Within that realm, create a client

  • during client creation, ensure:
    • Standard flow: True
    • Direct access grants: True
    • Authorization: True
    • Client authentication: True
    • PKCE method: none

• Within the client tab, for your client, click on "Credentials". Click on the the copy button to copy "Client Secret" so you can insert this into your coop cloud deployment in the next step.

• abra app secret insert <app-name> oidc_rpcs v2 <yoursecret>

• abra app config <app-name> # set SECRET_OIDC_RPCS_VERSION=v2

• Now create a user for this client within keycloak. Within the Users tab, click "Add User". Any username and password works. Save this info.

You then additionally need to modify the config of drive to point to your keycloak deployment.

• abra app config <app-name>

OIDC_REALM=<the realm you configured in keycloak>
AUTH_DOMAIN=<the domain of your keycloak instance>
OIDC_RP_CLIENT_ID=<yourkeycloakclientid>

then redeploy drive: abra app deploy <app-name> --force

at this point, when you go to your drive url, you should then be able to click "login" and login with the username and password for the user you created in keycloak.

you can make additional users in keycloak for this "client" and they will all be able to login to drive and collaborate.

Configure E-Mail

Using abra app config <app-name> you need to set the following for your smtp server:

DJANGO_EMAIL_HOST="yourmailserver.com"
DJANGO_EMAIL_PORT=1025
DJANGO_EMAIL_FROM=noreply@example.com

You then need to insert the password for your smtp server as a secret:

• abra app secret insert <app-name> email_pass v2 <youremailpass>
• abra app config <app-name> # set SECRET_EMAIL_PASS_VERSION=v2

Then redeploy the app, and automated e-mail sending should work:

abra app deploy <app-name> --force

Configure the Collabora Admin Panel

Collabora has a web admin panel at https://<COLLABORA_DOMAIN>/browser/dist/admin/admin.html. It is disabled until a password is set. Using abra app config <app-name>, set:

COLLABORA_ADMIN_USERNAME=admin
COLLABORA_ADMIN_PASSWORD=<yourcollaborapass>

Then redeploy the app:

abra app deploy <app-name> --force

Since version 26.04, the Collabora image is distroless: there is no shell to read a Docker secret, so the password is passed as a plain environment variable. It is visible to anyone who can run docker service inspect on the swarm. Leave COLLABORA_ADMIN_PASSWORD unset if you don't need the admin panel.

If you are upgrading from a version that used the collabora_p secret, that secret is no longer used: remove SECRET_COLLABORA_P_VERSION from your config, and optionally the secret itself with abra app secret remove <app-name> collabora_p.