nextcloud: keep onlyoffice's jwt off argv, and re-check a failed connection every tick (issues 1831, 1832) #446

Merged

mesh-tools merged 4 commits from fix/onlyoffice-followups into main 2026-10-22 14:52:00 +00:00

Conversation 2 Commits 4 Files Changed 3

+113 -11

4 Commits

Author	SHA1	Message	Date
jochen	6bf054b982	Take issue 1843's owner change back out: giving the converter the module root opens a link swap to root (review), so 1843 needs its own design	2026-10-22 16:37:35 +02:00
jochen	d0a3784be2	only-office: bar every account but the converter from the state root (issue 1843) ... lib (bind-mounted into the container at /var/lib/onlyoffice) was 0711 so nginx inside the container could reach App_Data/cache, and the module root above it stayed 0711 too, so any account on the machine could walk through the root into lib's 0755 directories and 0644 files to read converted documents. The container never passes through the root — only the converter process does, to read jwt.secret and broker-converter.secret — so the root is now 0710, owned by the converter account: only that account and root pass through it. lib stays 0711 (1837/AC3).	2026-10-22 16:34:06 +02:00
jochen	edb6d3b7d3	nextcloud: keep checking onlyoffice's connection while the last check failed (issue 1832) ... applyOnlyOffice only ran the connection check when a setting changed, so once it failed while settings matched, nothing checked again and the failure was logged once and forgotten. The client now remembers whether the last check failed and re-runs it on every tick until it passes; index.ts logs every failing tick and one line when it recovers.	2026-10-22 16:28:35 +02:00
jochen	8928e6f972	nextcloud: keep onlyoffice's jwt_secret off every argv (issue 1831) ... occ's config:app:set put the secret on the docker exec command line, so it sat in the docker CLI's argv, the container's php argv and docker's exec record. Apply jwt_secret through config:import on occ's stdin instead; the other three onlyoffice keys still go through config:app:set.	2026-10-22 16:27:15 +02:00