recipe-maintainer: public snapshot (secrets + deployment plans removed, single commit)

Sanitized single-commit public mirror of recipe-maintainer. - Removed test-ssh/.testenv (live creds); added test-ssh/.testenv.example placeholders. - Removed plans/ and planned-updates/ (deployment-planning docs) so no client/ deployment domains appear in the public repo. - All other secret stores were already gitignored. - docs.coopcloud.tech retained as a submodule (public upstream).
2026-06-16 20:18:24 +00:00
commit f283a371bb
253 changed files with 15975 additions and 0 deletions
@@ -0,0 +1,8 @@
+name = "lasuite-drive"
+
+[dependencies]
+requires = ["keycloak"]
+
+[sso]
+provider = "keycloak"
+setup_script = "setup/sso_integration.py"
@@ -0,0 +1,53 @@
+# La Suite Drive — First-Time Setup
+
+## Prerequisites
+
+- DNS: `lasuite-drive.<domain_suffix>` must resolve to the server
+- **Keycloak** must be deployed and running (dependency)
+
+## Steps
+
+1. **Create the app:**
+   ```bash
+   abra app new lasuite-drive --server <SERVER> --domain lasuite-drive.<DOMAIN_SUFFIX> --no-input
+   ```
+
+2. **Generate secrets:**
+   ```bash
+   abra app secret generate lasuite-drive.<DOMAIN_SUFFIX> --all -m --no-input
+   ```
+   Save output to `recipe-info/testsecrets/lasuite-drive.<DOMAIN_SUFFIX>`.
+
+3. **Deploy:**
+   ```bash
+   abra app deploy lasuite-drive.<DOMAIN_SUFFIX> --chaos --force --no-input
+   ```
+
+4. **Post-deploy — Migrations:**
+   ```bash
+   script -qefc 'abra app cmd lasuite-drive.<DOMAIN_SUFFIX> backend migrate --no-input' /dev/null
+   ```
+
+5. **Post-deploy — Minio buckets:**
+   ```bash
+   abra app restart lasuite-drive.<DOMAIN_SUFFIX> minio-createbuckets --no-input
+   ```
+   This will appear to hang — that is expected. Wait for it to complete.
+
+6. **Keycloak SSO integration:**
+   ```bash
+   python3 recipe-info/lasuite-drive/setup_keycloak_integration.py
+   ```
+   This creates a `lasuite-drive` realm, OIDC client, and test user in Keycloak. It also inserts the client secret and updates the env file.
+
+7. **Redeploy with SSO config:**
+   ```bash
+   abra app deploy lasuite-drive.<DOMAIN_SUFFIX> --chaos --force --no-input
+   ```
+
+8. **Verify:** curl `https://lasuite-drive.<DOMAIN_SUFFIX>` returns HTTP 200.
+
+## Notes
+
+- Credentials are saved to `recipe-info/lasuite-drive/keycloak-test-credentials.<DOMAIN_SUFFIX>.toml`.
+- OIDC test user: `testuser` / `testpass123`.
@@ -0,0 +1,107 @@
+#!/usr/bin/env python3
+"""Setup Keycloak OIDC integration for La Suite Drive.
+
+Creates a Keycloak realm, OIDC client, and test user, then inserts
+the client secret and updates the Drive env file with OIDC settings.
+"""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", ".."))
+
+from lib.abra import app_secret_insert
+from lib.env import apply_env_overrides, get_abra_env_path, read_env_file
+from lib.keycloak import KeycloakAdmin
+from lib.models import load_default_instance
+from lib.secrets import load_secrets
+
+# Configuration
+REALM = "lasuite-drive"
+CLIENT_ID = "drive"
+TEST_USER = "testuser"
+TEST_PASS = "testpass123"
+TEST_EMAIL = f"{TEST_USER}@test.example.com"
+
+
+def main():
+    inst = load_default_instance()
+    drive_domain = inst.default_domain("lasuite-drive")
+    kc_domain = inst.default_domain("keycloak")
+
+    # Get Keycloak admin password from synced secrets
+    kc_secrets = load_secrets(kc_domain)
+    kc_admin_pass = kc_secrets["admin_password"]
+
+    kc = KeycloakAdmin(f"https://{kc_domain}", "admin", kc_admin_pass)
+
+    # Step 1: Create realm
+    kc.ensure_realm(REALM)
+
+    # Step 2: Create OIDC client
+    _, client_secret = kc.ensure_client(
+        REALM, CLIENT_ID,
+        redirect_uris=[f"https://{drive_domain}/*"],
+        web_origins=[f"https://{drive_domain}"],
+    )
+
+    # Step 3: Create test user
+    kc.ensure_user(REALM, TEST_USER, TEST_EMAIL, TEST_PASS)
+
+    # Step 4: Insert client secret via abra
+    print("=== Insert OIDC client secret into Drive ===", flush=True)
+    env_path = get_abra_env_path(inst.server, drive_domain)
+    env_data = read_env_file(env_path)
+    current_version = env_data.get("SECRET_OIDC_RPCS_VERSION", "v1")
+    next_num = int(current_version.lstrip("v")) + 1
+    next_version = f"v{next_num}"
+    print(f"  Current secret version: {current_version}", flush=True)
+    print(f"  Inserting as: {next_version}", flush=True)
+    app_secret_insert(drive_domain, "oidc_rpcs", next_version, client_secret)
+
+    # Step 5: Update Drive env with OIDC settings
+    print("=== Update Drive OIDC settings in env file ===", flush=True)
+    apply_env_overrides(env_path, {
+        "SECRET_OIDC_RPCS_VERSION": next_version,
+        "OIDC_REALM": REALM,
+        "AUTH_DOMAIN": kc_domain,
+        "OIDC_RP_CLIENT_ID": CLIENT_ID,
+    })
+
+    # Step 6: Write credentials file
+    script_dir = os.path.dirname(os.path.abspath(__file__))
+    creds_file = os.path.join(script_dir, f"keycloak-test-credentials.{inst.domain_suffix}.toml")
+    print(f"=== Write credentials to {creds_file} ===", flush=True)
+    with open(creds_file, "w") as f:
+        f.write(f'# Keycloak OIDC credentials for lasuite-drive test instance\n')
+        f.write(f'#\n')
+        f.write(f'# Keycloak instance: {kc_domain}\n')
+        f.write(f'# Realm: {REALM}\n')
+        f.write(f'# Created by: setup_keycloak_integration.py\n')
+        f.write(f'\n')
+        f.write(f'# Keycloak admin (master realm)\n')
+        f.write(f'kc_admin_user = "admin"\n')
+        f.write(f'kc_admin_pass = "{kc_admin_pass}"\n')
+        f.write(f'\n')
+        f.write(f'# OIDC client\n')
+        f.write(f'kc_realm = "{REALM}"\n')
+        f.write(f'kc_client_id = "{CLIENT_ID}"\n')
+        f.write(f'kc_client_secret = "{client_secret}"\n')
+        f.write(f'\n')
+        f.write(f'# Test user (in {REALM} realm)\n')
+        f.write(f'kc_test_user = "{TEST_USER}"\n')
+        f.write(f'kc_test_pass = "{TEST_PASS}"\n')
+        f.write(f'kc_test_email = "{TEST_EMAIL}"\n')
+    print(f"  Written to {creds_file}", flush=True)
+
+    print("", flush=True)
+    print("=== Keycloak integration setup complete ===", flush=True)
+    print("", flush=True)
+    print("Next steps:", flush=True)
+    print(f"  1. Redeploy Drive:  abra app deploy {drive_domain} --chaos --force --no-input", flush=True)
+    print(f"  2. Run migrations:  script -qefc 'abra app cmd {drive_domain} backend migrate --no-input' /dev/null", flush=True)
+    print(f"  3. Run OIDC test:   python3 recipe-info/lasuite-drive/tests/oidc_login.py", flush=True)
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,100 @@
+# La Suite Drive Tests
+
+## Requires
+
+- keycloak
+
+## Target
+
+- **URL:** https://lasuite-drive.<DOMAIN_SUFFIX>
+- **Keycloak:** https://keycloak.<DOMAIN_SUFFIX> (realm: `lasuite-drive`)
+
+## Prerequisites
+
+Keycloak (`keycloak.<DOMAIN_SUFFIX>`) must be deployed before testing lasuite-drive. The OIDC login test and any manual authentication testing depend on it. If Keycloak is not running, deploy it first with `/recipe-deploy keycloak`.
+
+## Automated Checks
+
+Run the scripts in `tests/` to perform automated testing:
+
+- `tests/health_check.py` — Confirms the instance is reachable and returns HTTP 200.
+- `tests/wopi_configured.py` — Verifies WOPI discovery endpoints are reachable:
+  1. Checks Collabora discovery endpoint returns valid WOPI XML
+  2. Checks OnlyOffice discovery endpoint returns valid WOPI XML
+
+- `tests/wopi_on_startup.py` — Confirms WOPI configuration runs automatically on celery worker startup:
+  1. Checks celery worker container logs for the entrypoint WOPI trigger message
+  2. Verifies the trigger completed without errors
+
+- `tests/celery_beat_wopi.py` — Verifies Celery Beat WOPI scheduling:
+  1. Confirms the `celery-beat` service is running
+  2. Confirms the old `scheduler` service is removed
+  3. Waits up to 90s for the WOPI configuration task to fire and checks logs via SSH
+
+  **Thorough mode only.** This test sleeps ~15-90 seconds waiting for the Celery Beat scheduler to fire. Skip in quick mode. Requires the test instance to have `WOPI_CONFIGURATION_CRONTAB_MINUTE=*` and `WOPI_CONFIGURATION_CRONTAB_HOUR=*` set so the task fires every minute.
+
+- `tests/oidc_login.py` — Tests the full OIDC authentication flow end-to-end:
+  1. Verifies Drive's `/api/v1.0/authenticate/` redirects to Keycloak
+  2. Obtains an access token from Keycloak via direct access grant (password flow)
+  3. Calls Drive's `/api/v1.0/users/me/` with the token and verifies the correct user is returned
+
+  This test reads credentials from `keycloak-test-credentials.<DOMAIN_SUFFIX>.toml`.
+
+## Keycloak OIDC Integration
+
+La Suite Drive **requires** an OIDC provider. The test instance uses Keycloak at `keycloak.<DOMAIN_SUFFIX>`.
+
+### Setup
+
+Run `setup_keycloak_integration.py` to configure everything automatically. The script:
+
+1. Creates a `lasuite-drive` realm in Keycloak
+2. Creates a `drive` OIDC client (confidential, standard flow + direct access grants)
+3. Creates a test user (`testuser` / `testpass123`)
+4. Inserts the OIDC client secret into the Drive app via `abra app secret insert`
+5. Updates the Drive env file with `OIDC_REALM`, `AUTH_DOMAIN`, `OIDC_RP_CLIENT_ID`
+6. Writes all credentials to `keycloak-test-credentials.<DOMAIN_SUFFIX>.toml`
+
+After running the setup script, redeploy Drive:
+
+```
+abra app deploy lasuite-drive.<DOMAIN_SUFFIX> --chaos --force --no-input
+```
+
+The script is idempotent — it skips resources that already exist and resets the test user password.
+
+### Credentials
+
+All Keycloak credentials are stored in `keycloak-test-credentials.<DOMAIN_SUFFIX>.toml` (sourceable):
+
+| Variable | Description |
+|----------|-------------|
+| `KC_ADMIN_USER` / `KC_ADMIN_PASS` | Keycloak admin (master realm) |
+| `KC_REALM` | Keycloak realm name (`lasuite-drive`) |
+| `KC_CLIENT_ID` / `KC_CLIENT_SECRET` | OIDC client ID and secret |
+| `KC_TEST_USER` / `KC_TEST_PASS` | Test user credentials |
+| `KC_TEST_EMAIL` | Test user email |
+
+### Key Endpoints
+
+| Endpoint | Purpose |
+|----------|---------|
+| `https://lasuite-drive.<DOMAIN_SUFFIX>/api/v1.0/authenticate/` | Initiates OIDC login (302 redirect to Keycloak) |
+| `https://lasuite-drive.<DOMAIN_SUFFIX>/api/v1.0/callback/` | OIDC callback (Keycloak redirects here after login) |
+| `https://keycloak.<DOMAIN_SUFFIX>/realms/lasuite-drive/protocol/openid-connect/token` | Keycloak token endpoint |
+
+## Post-Deploy Steps
+
+After deploying Drive for the first time, run:
+
+1. **Migrations:** `script -qefc 'abra app cmd lasuite-drive.<DOMAIN_SUFFIX> backend migrate --no-input' /dev/null`
+2. **Minio buckets:** `abra app restart lasuite-drive.<DOMAIN_SUFFIX> minio-createbuckets --no-input` (will appear to hang — this is expected)
+3. **Keycloak integration:** `python3 setup_keycloak_integration.py` then redeploy
+
+## Manual Verification
+
+1. Open https://lasuite-drive.<DOMAIN_SUFFIX> in a browser.
+2. Confirm the La Suite Drive landing page loads without errors.
+3. Click "Login" and verify the OIDC redirect to Keycloak works.
+4. Log in with test credentials (`testuser` / `testpass123`).
+5. After logging in, verify you can create and open a document.
@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+"""Celery Beat WOPI scheduling test."""
+import argparse
+import json
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..', '..'))
+from utils.tests.helpers import run, resolve_domain, resolve_server
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--domain', default=os.environ.get('TEST_DOMAIN'))
+    args = parser.parse_args()
+    domain = args.domain or resolve_domain('lasuite-drive')
+    server = resolve_server()
+
+    print("Testing Celery Beat WOPI scheduling")
+    print()
+
+    # Step 1: Verify celery-beat service is running
+    print("Step 1: Checking celery-beat service is running ...")
+    result = run(f"abra app ps {domain} --chaos --no-input -m", check=False, timeout=60)
+    try:
+        data = json.loads(result.stdout)
+        if 'celery-beat' in data:
+            print("  PASS: celery-beat service is running")
+        else:
+            print("  FAIL: celery-beat service not found in running services")
+            sys.exit(1)
+    except (json.JSONDecodeError, TypeError):
+        print("  FAIL: Could not parse service list")
+        print(f"  Output: {result.stdout}")
+        sys.exit(1)
+
+    # Step 2: Verify old scheduler service is gone
+    print("Step 2: Checking old scheduler service is removed ...")
+    if 'scheduler' in data:
+        print("  FAIL: old scheduler service still appears in service list")
+        sys.exit(1)
+    print("  PASS: old scheduler service is not running")
+
+    # Step 3: Wait for WOPI task to fire and check logs
+    print("Step 3: Waiting for WOPI configuration task to fire (up to 90s) ...")
+    print("  (test instance should have WOPI_CONFIGURATION_CRONTAB_MINUTE=* for every-minute execution)")
+
+    found_task = False
+    beat_logs = ""
+    celery_logs = ""
+
+    for i in range(1, 7):
+        print(f"  Checking logs (attempt {i}/6, waiting 15s) ...")
+        time.sleep(15)
+
+        # Check celery-beat logs for the task being sent
+        result = run(
+            f"ssh {server} 'docker logs $(docker ps -q -f name=lasuite-drive.*celery-beat) 2>&1 | tail -20'",
+            check=False, timeout=30,
+        )
+        beat_logs = result.stdout
+
+        if any("sending due task configure_wopi_clients" in line.lower() for line in beat_logs.split('\n')):
+            print("  PASS: Celery Beat is sending the WOPI configuration task")
+            found_task = True
+            break
+
+        # Check celery worker logs for task execution
+        result = run(
+            f"ssh {server} 'docker logs $(docker ps -q -f name=lasuite-drive.*_celery\\.) 2>&1 | grep -i configure_wopi | tail -5'",
+            check=False, timeout=30,
+        )
+        celery_logs = result.stdout
+
+        if "configure_wopi" in celery_logs.lower() and "succeeded" in celery_logs.lower():
+            print("  PASS: WOPI configuration task executed successfully on celery worker")
+            found_task = True
+            break
+
+    if not found_task:
+        print("  FAIL: WOPI configuration task not found in logs after 90 seconds")
+        sys.exit(1)
+
+    print()
+    print("PASS: Celery Beat WOPI scheduling test passed")
+
+
+if __name__ == '__main__':
+    main()
@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+"""Health check for La Suite Drive."""
+import argparse
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..', '..'))
+from utils.tests.helpers import http_get, resolve_domain
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--domain', default=os.environ.get('TEST_DOMAIN'))
+    args = parser.parse_args()
+    domain = args.domain or resolve_domain('lasuite-drive')
+    url = f"https://{domain}"
+
+    print(f"Checking La Suite Drive at {url} ...")
+    status, _ = http_get(url)
+    if status == 200:
+        print(f"PASS: La Suite Drive returned HTTP {status}")
+    else:
+        print(f"FAIL: La Suite Drive returned HTTP {status} (expected 200)")
+        sys.exit(1)
+
+
+if __name__ == '__main__':
+    main()
@@ -0,0 +1,102 @@
+#!/usr/bin/env python3
+"""OIDC integration test for La Suite Drive + Keycloak."""
+import argparse
+import os
+import sys
+import urllib.request
+import urllib.error
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..', '..'))
+from utils.tests.helpers import (
+    http_get, http_post, load_toml_credentials, resolve_domain,
+)
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--domain', default=os.environ.get('TEST_DOMAIN'))
+    args = parser.parse_args()
+
+    recipe_dir = os.path.join(os.path.dirname(__file__), '..')
+    creds = load_toml_credentials(recipe_dir, 'keycloak')
+    if creds is None:
+        print("FAIL: Credentials file not found: keycloak-test-credentials.<domain_suffix>.toml")
+        print("Run setup_keycloak_integration.py first.")
+        sys.exit(1)
+
+    drive_domain = args.domain or resolve_domain('lasuite-drive')
+    kc_domain = resolve_domain('keycloak')
+    drive_url = f"https://{drive_domain}"
+    kc_url = f"https://{kc_domain}"
+
+    print("Testing OIDC integration: La Suite Drive <-> Keycloak")
+    print()
+
+    # Step 1: Verify Drive redirects to Keycloak
+    print("Step 1: Checking Drive OIDC redirect ...")
+    try:
+        req = urllib.request.Request(f"{drive_url}/api/v1.0/authenticate/")
+        opener = urllib.request.build_opener(NoRedirectHandler())
+        resp = opener.open(req, timeout=15)
+        redirect_url = resp.headers.get('Location', '')
+    except urllib.error.HTTPError as e:
+        redirect_url = e.headers.get('Location', '') if e.headers else ''
+
+    expected_prefix = f"{kc_url}/realms/{creds['kc_realm']}/protocol/openid-connect/auth"
+    if expected_prefix in (redirect_url or ''):
+        print(f"  PASS: Drive redirects to Keycloak realm '{creds['kc_realm']}'")
+    else:
+        print(f"  FAIL: Expected redirect to Keycloak, got: {redirect_url}")
+        sys.exit(1)
+
+    # Step 2: Obtain token from Keycloak
+    print("Step 2: Obtaining token from Keycloak ...")
+    token_url = f"{kc_url}/realms/{creds['kc_realm']}/protocol/openid-connect/token"
+    status, data = http_post(
+        token_url,
+        data={
+            "grant_type": "password",
+            "client_id": creds["kc_client_id"],
+            "client_secret": creds["kc_client_secret"],
+            "username": creds["kc_test_user"],
+            "password": creds["kc_test_pass"],
+            "scope": "openid email",
+        },
+        content_type="application/x-www-form-urlencoded",
+    )
+    access_token = (data or {}).get("access_token", "")
+    if not access_token:
+        error = (data or {}).get("error_description", (data or {}).get("error", "unknown"))
+        print(f"  FAIL: Could not obtain token from Keycloak: {error}")
+        sys.exit(1)
+    print(f"  PASS: Obtained access token from Keycloak ({len(access_token)} chars)")
+
+    # Step 3: Use token to access Drive API
+    print("Step 3: Accessing Drive API with Keycloak token ...")
+    status, body = http_get(
+        f"{drive_url}/api/v1.0/users/me/",
+        headers={"Authorization": f"Bearer {access_token}"},
+    )
+    if status != 200:
+        print(f"  FAIL: Drive API returned HTTP {status} (expected 200)")
+        sys.exit(1)
+
+    user_email = (body or {}).get("email", "")
+    expected_email = f"{creds['kc_test_user']}@test.example.com"
+    if user_email == expected_email:
+        print(f"  PASS: Drive API returned user with email '{user_email}'")
+    else:
+        print(f"  FAIL: Expected email '{expected_email}', got '{user_email}'")
+        sys.exit(1)
+
+    print()
+    print("PASS: OIDC integration test passed — Drive authenticates via Keycloak")
+
+
+class NoRedirectHandler(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        raise urllib.error.HTTPError(newurl, code, msg, headers, fp)
+
+
+if __name__ == '__main__':
+    main()
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+"""WOPI configuration verification test."""
+import argparse
+import os
+import sys
+import urllib.request
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..', '..'))
+from utils.tests.helpers import resolve_domain
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--domain', default=os.environ.get('TEST_DOMAIN'))
+    args = parser.parse_args()
+    domain = args.domain or resolve_domain('lasuite-drive')
+
+    collabora_url = f"https://collabora.{domain}/hosting/discovery"
+    onlyoffice_url = f"https://onlyoffice.{domain}/hosting/discovery"
+
+    print("Testing WOPI configuration")
+    print()
+
+    # Step 1: Check Collabora discovery endpoint
+    print("Step 1: Checking Collabora discovery endpoint ...")
+    try:
+        req = urllib.request.Request(collabora_url)
+        with urllib.request.urlopen(req, timeout=15) as resp:
+            body = resp.read().decode('utf-8', errors='replace')
+            status = resp.getcode()
+    except Exception as e:
+        print(f"  FAIL: Collabora discovery check failed: {e}")
+        sys.exit(1)
+
+    if status == 200 and 'wopi-discovery' in body:
+        print("  PASS: Collabora discovery returns valid WOPI XML")
+    else:
+        print(f"  FAIL: Collabora discovery check failed (HTTP {status})")
+        sys.exit(1)
+
+    # Step 2: Check OnlyOffice discovery endpoint
+    print("Step 2: Checking OnlyOffice discovery endpoint ...")
+    try:
+        req = urllib.request.Request(onlyoffice_url)
+        with urllib.request.urlopen(req, timeout=15) as resp:
+            body = resp.read().decode('utf-8', errors='replace')
+            status = resp.getcode()
+    except Exception as e:
+        print(f"  FAIL: OnlyOffice discovery check failed: {e}")
+        sys.exit(1)
+
+    if status == 200 and 'wopi-discovery' in body:
+        print("  PASS: OnlyOffice discovery returns valid WOPI XML")
+    else:
+        print(f"  FAIL: OnlyOffice discovery check failed (HTTP {status})")
+        sys.exit(1)
+
+    print()
+    print("PASS: WOPI discovery endpoints are reachable and returning valid XML")
+
+
+if __name__ == '__main__':
+    main()
@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+"""WOPI on startup test — verifies celery worker runs WOPI config on startup."""
+import argparse
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..', '..'))
+from utils.tests.helpers import run, resolve_server
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--domain', default=os.environ.get('TEST_DOMAIN'))
+    args = parser.parse_args()
+
+    server = resolve_server()
+
+    print("Testing WOPI configuration on startup")
+    print()
+
+    # Check celery worker logs for the entrypoint WOPI trigger message
+    print("Step 1: Checking celery worker logs for WOPI startup trigger ...")
+
+    result = run(
+        f'ssh {server} "docker ps -f name=lasuite-drive --format \'{{{{.Names}}}}\' | grep -E \'celery\\.\' | grep -v beat"',
+        check=False, timeout=30,
+    )
+    celery_name = result.stdout.strip().split('\n')[0].strip()
+
+    result = run(
+        f'ssh {server} "docker logs {celery_name} 2>&1 | head -5"',
+        check=False, timeout=30,
+    )
+    celery_logs = result.stdout
+
+    if "running WOPI configuration on startup" in celery_logs:
+        print("  PASS: Celery worker ran WOPI configuration on startup")
+    else:
+        print("  FAIL: WOPI startup trigger not found in celery worker logs")
+        print(f"  Logs: {celery_logs}")
+        sys.exit(1)
+
+    # Verify it didn't fail
+    if "WOPI configuration failed" in celery_logs:
+        print("  FAIL: WOPI configuration failed on startup")
+        print(f"  Logs: {celery_logs}")
+        sys.exit(1)
+    else:
+        print("  PASS: WOPI configuration completed without errors")
+
+    print()
+    print("PASS: WOPI on startup test passed")
+
+
+if __name__ == '__main__':
+    main()
@@ -0,0 +1,22 @@
+# La Suite Drive Upstream
+
+## Main Project
+
+- **Repository:** https://github.com/suitenumerique/drive
+- **Releases:** https://github.com/suitenumerique/drive/releases
+
+## Images
+
+| Service | Image | Release Notes |
+|---------|-------|---------------|
+| app | `lasuite/drive-frontend` | https://github.com/suitenumerique/drive/releases |
+| backend | `lasuite/drive-backend` | https://github.com/suitenumerique/drive/releases |
+| celery | `lasuite/drive-backend` | https://github.com/suitenumerique/drive/releases |
+| scheduler | `lasuite/drive-backend` | https://github.com/suitenumerique/drive/releases |
+| collabora | `collabora/code` | https://github.com/CollaboraOnline/online/releases |
+| onlyoffice | `onlyoffice/documentserver-de` | https://github.com/ONLYOFFICE/DocumentServer/releases |
+| db | `postgres` | https://www.postgresql.org/docs/release/ |
+| redis | `redis` | https://github.com/redis/redis/releases |
+| minio | `minio/minio` | https://github.com/minio/minio/releases |
+| web | `nginx` | https://nginx.org/en/CHANGES |
+| mailcatcher | `sj26/mailcatcher` | https://github.com/sj26/mailcatcher/releases |