From 5fe67775bf3da9c23757ecd31284096c83e76bea Mon Sep 17 00:00:00 2001
From: Alexandre Aubin <alex.aubin@mailoo.org>
Date: Sat, 9 Jan 2021 22:44:51 +0100
Subject: [PATCH 01/10] Finding an available port

---
 scripts/install | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/install b/scripts/install
index a19f196..ff9ab9b 100644
--- a/scripts/install
+++ b/scripts/install
@@ -53,7 +53,7 @@ ynh_app_setting_set --app=$app --key=nextcloud_domain --value=$nextcloud_domain
 #=================================================
 # FIND AND OPEN A PORT
 #=================================================
-ynh_script_progression --message="Configuring firewall..."
+ynh_script_progression --message="Finding an available port..."
 
 # Find a free port
 port=$(ynh_find_port --port=9980)

From ca1b291b491a9428b6bb420ddc78e22031e1ea5c Mon Sep 17 00:00:00 2001
From: Alexandre Aubin <alex.aubin@mailoo.org>
Date: Sat, 9 Jan 2021 23:59:37 +0100
Subject: [PATCH 02/10] Fix installation and config handling ...

---
 conf/nginx.conf |  6 ++++++
 manifest.json   |  2 +-
 scripts/install | 31 +++++++++++++------------------
 scripts/restore |  2 +-
 scripts/upgrade | 14 ++------------
 5 files changed, 23 insertions(+), 32 deletions(-)

diff --git a/conf/nginx.conf b/conf/nginx.conf
index 2fecb65..30217dd 100644
--- a/conf/nginx.conf
+++ b/conf/nginx.conf
@@ -1,3 +1,9 @@
+rewrite ^$ /;
+location ~ ^/$ {
+    default_type text/plain;
+    return 200 "This is where Collabora Online is installed. To actually be useful, this needs to be integrated in a front-end such as Nextcloud for example.";
+}
+
 # static files
 location ^~ /loleaflet {
     proxy_pass http://localhost:__PORT__;
diff --git a/manifest.json b/manifest.json
index e4f2b19..3faac8c 100644
--- a/manifest.json
+++ b/manifest.json
@@ -14,7 +14,7 @@
         "email": "rafi59_dev@srvmaison.fr.nf"
     },
     "requirements": {
-        "yunohost": ">= 3.8.1"
+        "yunohost": ">= 4.1.4.4"
     },
     "multi_instance": false,
     "services": [
diff --git a/scripts/install b/scripts/install
index ff9ab9b..3478e2a 100644
--- a/scripts/install
+++ b/scripts/install
@@ -60,6 +60,17 @@ port=$(ynh_find_port --port=9980)
 
 ynh_app_setting_set --app=$app --key=port --value=$port
 
+#=================================================
+# CONFIGURE ONLYOFFICE
+#=================================================
+
+# Turns out we need to create/copy this file BEFORE the actual .deb install,
+# otherwise stupid collabora will expect to find a certificate file in its own
+# config directory which of course doesn't exists and we want to disable SSL
+# because we're in a reverse proxy context...
+mkdir -p /etc/loolwsd
+ynh_add_config ../conf/loolwsd.xml /etc/loolwsd/loolwsd.xml
+
 #=================================================
 # INSTALL DEPENDENCIES
 #=================================================
@@ -79,23 +90,6 @@ ynh_add_nginx_config
 #=================================================
 # SPECIFIC SETUP
 #=================================================
-# MODIFY A CONFIG FILE
-#=================================================
-
-config="/etc/loolwsd/loolwsd.xml"
-
-cp -f ../conf/loolwsd.xml $config
-
-ynh_replace_string --match_string="__NEXTCLOUD_DOMAIN__" --replace_string="$nextcloud_domain" --target_file="$config"
-ynh_replace_string --match_string="__PASSWORD__" --replace_string="$password" --target_file="$config"
-
-#=================================================
-# STORE THE CONFIG FILE CHECKSUM
-#=================================================
-
-# Calculate and store the config file checksum into the app settings
-ynh_store_file_checksum "/etc/loolwsd/loolwsd.xml"
-
 #=================================================
 # GENERIC FINALIZATION
 #=================================================
@@ -104,7 +98,8 @@ ynh_store_file_checksum "/etc/loolwsd/loolwsd.xml"
 ynh_script_progression --message="Starting a systemd service..."
 
 # Start a systemd service
-ynh_systemd_action --service_name="loolwsd" --action="start" --log_path="systemd" --line_match="Started LibreOffice Online WebSocket Daemon"
+# NB. : we need a stupid *re*start because the service is in fact already started during the damn package install ... so it won't find a recent "Ready to accept connection" match ...
+ynh_systemd_action --service_name="loolwsd" --action="restart" --log_path="systemd" --line_match="Ready to accept connections"
 
 #=================================================
 # SETUP SSOWAT
diff --git a/scripts/restore b/scripts/restore
index 045bc9b..5078f9f 100644
--- a/scripts/restore
+++ b/scripts/restore
@@ -68,7 +68,7 @@ ynh_restore_file --origin_path="/etc/loolwsd/loolwsd.xml"
 #=================================================
 ynh_script_progression --message="Starting a systemd service..."
 
-ynh_systemd_action --service_name="loolwsd" --action="restart" --log_path="systemd" --line_match="Started LibreOffice Online WebSocket Daemon"
+ynh_systemd_action --service_name="loolwsd" --action="restart" --log_path="systemd" --line_match="Ready to accept connections"
 
 #=================================================
 # GENERIC FINALIZATION
diff --git a/scripts/upgrade b/scripts/upgrade
index 3bad87d..e755dff 100644
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -89,17 +89,7 @@ ynh_install_extra_app_dependencies --repo="deb https://collaboraoffice.com/repos
 # UPGRADE CONFIG
 #=================================================
 
-config="/etc/loolwsd/loolwsd.xml"
-
-ynh_backup_if_checksum_is_different --file="$config"
-
-cp -f ../conf/loolwsd.xml $config
-
-ynh_replace_string "__NEXTCLOUD_DOMAIN__" "$nextcloud_domain" "$config"
-ynh_replace_string "__PASSWORD__" "$password" "$config"
-
-# Recalculate and store the checksum of the file for the next upgrade.
-ynh_store_file_checksum --file="$config"
+ynh_add_config "../conf/loolwsd.xml" "/etc/loolwsd/loolwsd.xml"
 
 #=================================================
 # GENERIC FINALIZATION
@@ -117,7 +107,7 @@ ynh_app_setting_set --app=$app --key=unprotected_uris --value="/"
 #=================================================
 ynh_script_progression --message="Starting a systemd service..."
 
-ynh_systemd_action --service_name="loolwsd" --action="restart" --log_path="systemd" --line_match="Started LibreOffice Online WebSocket Daemon"
+ynh_systemd_action --service_name="loolwsd" --action="restart" --log_path="systemd" --line_match="Ready to accept connections"
 
 #=================================================
 # RELOAD NGINX

From 893aa1bf1297e950818803fbda0f8638e93742ca Mon Sep 17 00:00:00 2001
From: Alexandre Aubin <alex.aubin@mailoo.org>
Date: Sun, 10 Jan 2021 02:11:51 +0100
Subject: [PATCH 03/10] Fix version requirement

---
 manifest.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/manifest.json b/manifest.json
index 3faac8c..f0ba25a 100644
--- a/manifest.json
+++ b/manifest.json
@@ -14,7 +14,7 @@
         "email": "rafi59_dev@srvmaison.fr.nf"
     },
     "requirements": {
-        "yunohost": ">= 4.1.4.4"
+        "yunohost": ">= 4.1.4.3"
     },
     "multi_instance": false,
     "services": [

From 88f6682a4e559ca43468b04a42430e551a7c6160 Mon Sep 17 00:00:00 2001
From: ericgaspar <junk.eg@free.fr>
Date: Wed, 3 Feb 2021 22:39:15 +0100
Subject: [PATCH 04/10] Update loolwsd.xml

---
 conf/loolwsd.xml | 111 ++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 96 insertions(+), 15 deletions(-)

diff --git a/conf/loolwsd.xml b/conf/loolwsd.xml
index d1c74b1..916a0a6 100644
--- a/conf/loolwsd.xml
+++ b/conf/loolwsd.xml
@@ -3,27 +3,41 @@
     <!-- Note: 'default' attributes are used to document a setting's default value as well as to use as fallback. -->
     <!-- Note: When adding a new entry, a default must be set in WSD in case the entry is missing upon deployment. -->
 
-    <tile_cache_path desc="Path to a directory where to keep the tile cache." type="path" relative="false" default="/var/cache/loolwsd"></tile_cache_path>
-    <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path>
-    <lo_template_path desc="Path to a LibreOffice installation tree to be copied (linked) into the jails for child processes. Should be on the same file system as systemplate." type="path" relative="false" default="/opt/collaboraoffice5.3"></lo_template_path>
-    <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path>
+    <allowed_languages desc="List of supported languages of Writing Aids (spell checker, grammar checker, thesaurus, hyphenation) on this instance. Allowing too many has negative effect on startup performance." default="de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru">de_DE en_GB en_US es_ES fr_FR it nl pt_BR pt_PT ru</allowed_languages>
 
-    <server_name desc="Hostname:port of the server running loolwsd. If empty, it's derived from the request." type="string" default=""></server_name>
+    <sys_template_path desc="Path to a template tree with shared libraries etc to be used as source for chroot jails for child processes." type="path" relative="true" default="systemplate"></sys_template_path>
+    <child_root_path desc="Path to the directory under which the chroot jails for the child processes will be created. Should be on the same file system as systemplate and lotemplate. Must be an empty directory." type="path" relative="true" default="jails"></child_root_path>
+    <mount_jail_tree desc="Controls whether the systemplate and lotemplate contents are mounted or not, which is much faster than the default of linking/copying each file." type="bool" default="true"></mount_jail_tree>
+
+    <server_name desc="Hostname:port of the server running loolwsd. If empty, it's derived from the request (please set it if this doesn't work). Must be specified when behind a reverse-proxy or when the hostname is not reachable directly." type="string" default=""></server_name>
     <file_server_root_path desc="Path to the directory that should be considered root for the file server. This should be the directory containing loleaflet." type="path" relative="true" default="loleaflet/../"></file_server_root_path>
 
-    <memproportion desc="The maximum percentage of system memory consumed by all of the LibreOffice Online, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion>
+    <memproportion desc="The maximum percentage of system memory consumed by all of the Collabora Online Development Edition, after which we start cleaning up idle documents" type="double" default="80.0"></memproportion>
     <num_prespawn_children desc="Number of child processes to keep started in advance and waiting for new clients." type="uint" default="1">1</num_prespawn_children>
     <per_document desc="Document-specific settings, including LO Core settings.">
         <max_concurrency desc="The maximum number of threads to use while processing a document." type="uint" default="4">4</max_concurrency>
+        <batch_priority desc="A (lower) priority for use by batch eg. convert-to processes to avoid starving interactive ones" type="uint" default="5">5</batch_priority>
+        <document_signing_url desc="The endpoint URL of signing server, if empty the document signing is disabled" type="string" default=""></document_signing_url>
+        <redlining_as_comments desc="If true show red-lines as comments" type="bool" default="false">false</redlining_as_comments>
         <idle_timeout_secs desc="The maximum number of seconds before unloading an idle document. Defaults to 1 hour." type="uint" default="3600">3600</idle_timeout_secs>
         <!-- Idle save and auto save are checked every 30 seconds -->
-        <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="uint" default="30">30</idlesave_duration_secs>
-        <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="uint" default="300">300</autosave_duration_secs>
-        <limit_virt_mem_kb desc="The maximum virtual memory allowed to each document process. 0 for unlimited, 1700 min." type="uint">0</limit_virt_mem_kb>
-        <limit_data_mem_kb desc="The maximum memory data segment allowed to each document process. 0 for unlimited." type="uint">0</limit_data_mem_kb>
+        <!-- They are disabled when the value is zero or negative. -->
+        <idlesave_duration_secs desc="The number of idle seconds after which document, if modified, should be saved. Defaults to 30 seconds." type="int" default="30">30</idlesave_duration_secs>
+        <autosave_duration_secs desc="The number of seconds after which document, if modified, should be saved. Defaults to 5 minutes." type="int" default="300">300</autosave_duration_secs>
+        <always_save_on_exit desc="On exiting the last editor, always perform the save, even if the document is not modified." type="bool" default="false">false</always_save_on_exit>
+        <limit_virt_mem_mb desc="The maximum virtual memory allowed to each document process. 0 for unlimited." type="uint">0</limit_virt_mem_mb>
         <limit_stack_mem_kb desc="The maximum stack size allowed to each document process. 0 for unlimited." type="uint">8000</limit_stack_mem_kb>
         <limit_file_size_mb desc="The maximum file size allowed to each document process to write. 0 for unlimited." type="uint">0</limit_file_size_mb>
         <limit_num_open_files desc="The maximum number of files allowed to each document process to open. 0 for unlimited." type="uint">0</limit_num_open_files>
+        <limit_load_secs desc="Maximum number of seconds to wait for a document load to succeed. 0 for unlimited." type="uint" default="100">100</limit_load_secs>
+        <limit_convert_secs desc="Maximum number of seconds to wait for a document conversion to succeed. 0 for unlimited." type="uint" default="100">100</limit_convert_secs>
+        <cleanup desc="Checks for resource consuming (bad) documents and kills associated kit process. A document is considered resource consuming (bad) if is in idle state for idle_time_secs period and memory usage passed limit_dirty_mem_mb or CPU usage passed limit_cpu_per" enable="false">
+            <cleanup_interval_ms desc="Interval between two checks" type="uint" default="10000">10000</cleanup_interval_ms>
+            <bad_behavior_period_secs desc="Minimum time period for a document to be in bad state before associated kit process is killed. If in this period the condition for bad document is not met once then this period is reset" type="uint" default="60">60</bad_behavior_period_secs>
+            <idle_time_secs desc="Minimum idle time for a document to be candidate for bad state" type="uint" default="300">300</idle_time_secs>
+            <limit_dirty_mem_mb desc="Minimum memory usage for a document to be candidate for bad state" type="uint" default="3072">3072</limit_dirty_mem_mb>
+            <limit_cpu_per desc="Minimum CPU usage for a document to be candidate for bad state" type="uint" default="85">85</limit_cpu_per>
+        </cleanup>
     </per_document>
 
     <per_view desc="View-specific settings.">
@@ -36,7 +50,12 @@
     <logging>
         <color type="bool">true</color>
         <level type="string" desc="Can be 0-8, or none (turns off logging), fatal, critical, error, warning, notice, information, debug, trace" default="warning">warning</level>
+        <protocol type="bool" desc="Enable minimal client-site JS protocol logging from the start">false</protocol>
+        <!-- lokit_sal_log example: Log WebDAV-related messages, that is interesting for debugging Insert - Image operation: "+TIMESTAMP+INFO.ucb.ucp.webdav+WARN.ucb.ucp.webdav"
+             See also: https://docs.libreoffice.org/sal/html/sal_log.html -->
+        <lokit_sal_log type="string" desc="Fine tune log messages from LOKit. Default is to suppress log messages from LOKit." default="-INFO-WARN">-INFO-WARN</lokit_sal_log>
         <file enable="false">
+            <!-- If you use other path than /var/log and you run loolwsd from systemd, make sure that you enable that path in loolwsd.service (ReadWritePaths). -->
             <property name="path" desc="Log file path.">/var/log/loolwsd.log</property>
             <property name="rotation" desc="Log file rotation strategy. See Poco FileChannel.">never</property>
             <property name="archive" desc="Append either timestamp or number to the archived log filename.">timestamp</property>
@@ -46,12 +65,16 @@
             <property name="rotateOnOpen" desc="Enable/disable log file rotation on opening.">true</property>
             <property name="flush" desc="Enable/disable flushing after logging each line. May harm performance. Note that without flushing after each line, the log lines from the different processes will not appear in chronological order.">false</property>
         </file>
+        <anonymize>
+            <anonymize_user_data type="bool" desc="Enable to anonymize/obfuscate of user-data in logs. If default is true, it was forced at compile-time and cannot be disabled." default="false">false</anonymize_user_data>
+            <anonymization_salt type="uint" desc="The salt used to anonymize/obfuscate user-data in logs. Use a secret 64-bit random number." default="82589933">82589933</anonymization_salt>
+        </anonymize>
     </logging>
 
     <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging>
 
     <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="true">
-        <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting." compress="true" snapshot="false">/tmp/looltrace-%.gz</path>
+        <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /tmp/looltrace-%.gz" compress="true" snapshot="false"></path>
         <filter>
             <message desc="Regex pattern of messages to exclude"></message>
         </filter>
@@ -60,12 +83,33 @@
         </outgoing>
     </trace>
 
+    <net desc="Network settings">
+      <!-- On systems where localhost resolves to IPv6 [::1] address first, when net.proto is all and net.listen is loopback, loolwsd unexpectedly listens on [::1] only.
+           You need to change net.proto to IPv4, if you want to use 127.0.0.1. -->
+      <proto type="string" default="all" desc="Protocol to use IPv4, IPv6 or all for both">all</proto>
+      <listen type="string" default="any" desc="Listen address that loolwsd binds to. Can be 'any' or 'loopback'.">any</listen>
+      <service_root type="path" default="" desc="Prefix all the pages, websockets, etc. with this path."></service_root>
+      <proxy_prefix type="bool" default="false" desc="Enable a ProxyPrefix to be passed int through which to redirect requests"></proxy_prefix>
+      <post_allow desc="Allow/deny client IP address for POST(REST)." allow="true">
+        <host desc="The IPv4 private 192.168 block as plain IPv4 dotted decimal addresses.">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
+        <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
+        <host desc="The IPv4 loopback (localhost) address.">127\.0\.0\.1</host>
+        <host desc="Ditto, but as IPv4-mapped IPv6 address">::ffff:127\.0\.0\.1</host>
+        <host desc="The IPv6 loopback (localhost) address.">::1</host>
+        <host desc="The IPv4 private 172.17.0.0/16 subnet (Docker).">172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host>
+        <host desc="Ditto, but as IPv4-mapped IPv6 addresses">::ffff:172\.17\.[0-9]{1,3}\.[0-9]{1,3}</host>
+      </post_allow>
+      <frame_ancestors desc="Specify who is allowed to embed the LO Online iframe (loolwsd and WOPI host are always allowed). Separate multiple hosts by space."></frame_ancestors>
+      <connection_timeout_secs desc="Specifies the connection, send, recv timeout in seconds for connections initiated by loolwsd (such as WOPI connections)." type="int" default="30"></connection_timeout_secs>
+    </net>
+
     <ssl desc="SSL settings">
-        <enable type="bool" default="true">false</enable>
-        <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>
+        <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable>
+        <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination>
         <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path>
         <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path>
         <ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path>
+        <cipher_list desc="List of OpenSSL ciphers to accept" default="ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"></cipher_list>
         <hpkp desc="Enable HTTP Public key pinning" enable="false" report_only="false">
             <max_age desc="HPKP's max-age directive - time in seconds browser should remember the pins" enable="true">1000</max_age>
             <report_uri desc="HPKP's report-uri directive - pin validation failure are reported at this URL" enable="false"></report_uri>
@@ -75,6 +119,26 @@
         </hpkp>
     </ssl>
 
+    <security desc="Altering these defaults potentially opens you to significant risk">
+      <seccomp desc="Should we use the seccomp system call filtering." type="bool" default="true">true</seccomp>
+      <capabilities desc="Should we require capabilities to isolate processes into chroot jails" type="bool" default="true">true</capabilities>
+    </security>
+
+    <watermark>
+      <opacity desc="Opacity of on-screen watermark from 0.0 to 1.0" type="double" default="0.2"></opacity>
+      <text desc="Watermark text to be displayed on the document if entered" type="string"></text>
+    </watermark>
+
+    <welcome>
+      <enable type="bool" desc="Controls whether the welcome screen should be shown to the users on new install and updates." default="true">true</enable>
+      <enable_button type="bool" desc="Controls whether the welcome screen should have an explanatory button instead of an X button to close the dialog." default="false">false</enable_button>
+      <path desc="Path to 'welcome-$lang.html' files served on first start or when the version changes. When empty, defaults to the Release notes." type="path" relative="true" default="loleaflet/welcome"></path>
+    </welcome>
+
+    <user_interface>
+      <mode type="string" desc="Controls the user interface style (classic|notebookbar)" default="classic">classic</mode>
+    </user_interface>
+
     <storage desc="Backend storage">
         <filesystem allow="false" />
         <wopi desc="Allow/deny wopi storage. Mutually exclusive with webdav." allow="true">
@@ -86,17 +150,34 @@
             <host desc="Regex pattern of hostname to allow or deny." allow="true">192\.168\.[0-9]{1,3}\.[0-9]{1,3}</host>
             <host desc="Regex pattern of hostname to allow or deny." allow="false">192\.168\.1\.1</host>
             <max_file_size desc="Maximum document size in bytes to load. 0 for unlimited." type="uint">0</max_file_size>
+            <reuse_cookies desc="When enabled, cookies from the browser will be captured and set on WOPI requests." type="bool" default="false">false</reuse_cookies>
+            <locking desc="Locking settings">
+                <refresh desc="How frequently we should re-acquire a lock with the storage server, in seconds (default 15 mins) or 0 for no refresh" type="int" default="900">900</refresh>
+            </locking>
         </wopi>
         <webdav desc="Allow/deny webdav storage. Mutually exclusive with wopi." allow="false">
             <host desc="Hostname to allow" allow="false">__NEXTCLOUD_DOMAIN__</host>
         </webdav>
+        <ssl desc="SSL settings">
+        <as_scheme type="bool" default="true" desc="When set we exclusively use the WOPI URI's scheme to enable SSL for storage">true</as_scheme>
+            <enable type="bool" desc="If as_scheme is false or not set, this can be set to force SSL encryption between storage and loolwsd. When empty this defaults to following the ssl.enable setting"></enable>
+            <cert_file_path desc="Path to the cert file" relative="false"></cert_file_path>
+            <key_file_path desc="Path to the key file" relative="false"></key_file_path>
+            <ca_file_path desc="Path to the ca file. If this is not empty, then SSL verification will be strict, otherwise cert of storage (WOPI-like host) will not be verified." relative="false"></ca_file_path>
+            <cipher_list desc="List of OpenSSL ciphers to accept. If empty the defaults are used. These can be overriden only if absolutely needed."></cipher_list>
+        </ssl>
     </storage>
 
     <tile_cache_persistent desc="Should the tiles persist between two editing sessions of the given document?" type="bool" default="true">true</tile_cache_persistent>
 
     <admin_console desc="Web admin console settings.">
-        <username desc="The username of the admin console. Must be set.">admin</username>
-        <password desc="The password of the admin console. Must be set.">__PASSWORD__</password>
+        <enable desc="Enable the admin console functionality" type="bool" default="true">true</enable>
+        <enable_pam desc="Enable admin user authentication with PAM" type="bool" default="false">false</enable_pam>
+        <username desc="The username of the admin console. Ignored if PAM is enabled.">admin</username>
+        <password desc="The password of the admin console. Deprecated on most platforms. Instead, use PAM or loolconfig to set up a secure password.">__PASSWORD__</password>
     </admin_console>
 
+    <monitors desc="Addresses of servers we connect to on start for monitoring">
+    </monitors>
+
 </config>

From d9f1dd6ef62b3a290215a04631eef0a821f165cc Mon Sep 17 00:00:00 2001
From: ericgaspar <junk.eg@free.fr>
Date: Thu, 4 Feb 2021 09:04:11 +0100
Subject: [PATCH 05/10] Update loolwsd.xml

---
 conf/loolwsd.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/conf/loolwsd.xml b/conf/loolwsd.xml
index 916a0a6..06b91b5 100644
--- a/conf/loolwsd.xml
+++ b/conf/loolwsd.xml
@@ -104,7 +104,7 @@
     </net>
 
     <ssl desc="SSL settings">
-        <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">true</enable>
+        <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>
         <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination>
         <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path>
         <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path>

From f5094e9c36095e5c3e50f7e474bd8c3e783b7389 Mon Sep 17 00:00:00 2001
From: ericgaspar <junk.eg@free.fr>
Date: Thu, 4 Feb 2021 12:36:52 +0100
Subject: [PATCH 06/10] Update version

---
 README.md                | 2 +-
 manifest.json            | 2 +-
 pull_request_template.md | 4 +---
 3 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 83adeac..ecae06a 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@ If you don't have YunoHost, please see [here](https://yunohost.org/#/install) to
 
 [Collabora](https://www.collaboraoffice.com/code/) is an online office suite usable with Nextcloud.
 
-**Shipped version:** 4.0.0 RC2
+**Shipped version:** 6.4.0
 
 ## Screenshots
 
diff --git a/manifest.json b/manifest.json
index f0ba25a..c813759 100644
--- a/manifest.json
+++ b/manifest.json
@@ -6,7 +6,7 @@
         "en": "LibreOffice-based online office suite with collaborative editing",
         "fr": "Suite office en ligne et collaborative, basée sur LibreOffice"
     },
-    "version": "4.0.0~ynh2",
+    "version": "6.4.0~ynh1",
     "url": "https://collaboraoffice.com",
     "license": "MPL-2.0",
     "maintainer": {
diff --git a/pull_request_template.md b/pull_request_template.md
index f6155d6..6c28fc5 100644
--- a/pull_request_template.md
+++ b/pull_request_template.md
@@ -13,6 +13,4 @@
 
 ## Package_check results
 ---
-*If you have access to [App Continuous Integration for packagers](https://yunohost.org/#/packaging_apps_ci) you can provide a link to the package_check results like below, replacing '-NUM-' in this link by the PR number and USERNAME by your username on the ci-apps-dev. Or you provide a screenshot or a pastebin of the results*
-
-[![Build Status](https://ci-apps-dev.yunohost.org/jenkins/job/collabora_ynh%20PR-NUM-%20(USERNAME)/badge/icon)](https://ci-apps-dev.yunohost.org/jenkins/job/collabora_ynh%20PR-NUM-%20(USERNAME)/)  
+* An automatic package_check will be launch at https://ci-apps-dev.yunohost.org/, when you add a specific comment to your Pull Request: "!testme", "!gogogadgetoci" or "By the power of systemd, I invoke The Great App CI to test this Pull Request!"*

From 69e2ac84b0454a5159187d1f65f1d51a498622df Mon Sep 17 00:00:00 2001
From: ericgaspar <junk.eg@free.fr>
Date: Thu, 4 Feb 2021 12:44:49 +0100
Subject: [PATCH 07/10] Add permissions

---
 scripts/install | 10 +++++++---
 scripts/remove  | 11 +++++++++++
 scripts/restore |  7 +++++++
 scripts/upgrade | 14 +++++++++-----
 4 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/scripts/install b/scripts/install
index 3478e2a..2ee8492 100644
--- a/scripts/install
+++ b/scripts/install
@@ -88,8 +88,12 @@ ynh_script_progression --message="Configuring NGINX web server..."
 ynh_add_nginx_config
 
 #=================================================
-# SPECIFIC SETUP
+# INTEGRATE SERVICE IN YUNOHOST
 #=================================================
+ynh_script_progression --message="Integrating service in YunoHost..."
+
+yunohost service add $app --description="LibreOffice-based online office suite" --log="/var/log/$app/$app.log"
+
 #=================================================
 # GENERIC FINALIZATION
 #=================================================
@@ -104,11 +108,11 @@ ynh_systemd_action --service_name="loolwsd" --action="restart" --log_path="syste
 #=================================================
 # SETUP SSOWAT
 #=================================================
-ynh_script_progression --message="Configuring SSOwat..."
+ynh_script_progression --message="Configuring permissions..."
 
 # Make app public
 # unprotected_uris allows SSO credentials to be passed anyway.
-ynh_app_setting_set $app unprotected_uris "/"
+ynh_permission_update --permission="main" --add="visitors" --show_tile="false"
 
 #=================================================
 # RELOAD NGINX
diff --git a/scripts/remove b/scripts/remove
index ecd3650..66c8507 100644
--- a/scripts/remove
+++ b/scripts/remove
@@ -21,6 +21,17 @@ port=$(ynh_app_setting_get --app=$app --key=port)
 
 #=================================================
 # STANDARD REMOVE
+#=================================================
+# REMOVE SERVICE INTEGRATION IN YUNOHOST
+#=================================================
+
+# Remove the service from the list of services known by YunoHost (added from `yunohost service add`)
+if ynh_exec_warn_less yunohost service status $app >/dev/null
+then
+	ynh_script_progression --message="Removing $app service integration..."
+	yunohost service remove $app
+fi
+
 #=================================================
 # REMOVE DEPENDENCIES
 #=================================================
diff --git a/scripts/restore b/scripts/restore
index 5078f9f..55ed06f 100644
--- a/scripts/restore
+++ b/scripts/restore
@@ -63,6 +63,13 @@ ynh_script_progression --message="Restoring the configuration..."
 
 ynh_restore_file --origin_path="/etc/loolwsd/loolwsd.xml"
 
+#=================================================
+# INTEGRATE SERVICE IN YUNOHOST
+#=================================================
+ynh_script_progression --message="Integrating service in YunoHost..."
+
+yunohost service add $app --description="LibreOffice-based online office suite" --log="/var/log/$app/$app.log"
+
 #=================================================
 # START SYSTEMD SERVICE
 #=================================================
diff --git a/scripts/upgrade b/scripts/upgrade
index e755dff..e658ae3 100644
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -42,6 +42,12 @@ if [ -z "$path_url" ]; then
 	ynh_app_setting_set --app=$app --key=path_url --value=$path_url
 fi
 
+if ynh_legacy_permissions_exists; then
+	ynh_legacy_permissions_delete_all
+
+	ynh_app_setting_delete --app=$app --key=is_public
+fi
+
 #=================================================
 # BACKUP BEFORE UPGRADE THEN ACTIVE TRAP
 #=================================================
@@ -94,13 +100,11 @@ ynh_add_config "../conf/loolwsd.xml" "/etc/loolwsd/loolwsd.xml"
 #=================================================
 # GENERIC FINALIZATION
 #=================================================
-# SETUP SSOWAT
+# INTEGRATE SERVICE IN YUNOHOST
 #=================================================
-ynh_script_progression --message="Upgrading SSOwat configuration..."
+ynh_script_progression --message="Integrating service in YunoHost..."
 
-# Make app public
-# unprotected_uris allows SSO credentials to be passed anyway
-ynh_app_setting_set --app=$app --key=unprotected_uris --value="/"
+yunohost service add $app --description="LibreOffice-based online office suite" --log="/var/log/$app/$app.log"
 
 #=================================================
 # START SYSTEMD SERVICE

From 2c20bff1a3c2de4acff2aeaa84d9d1317af57ea5 Mon Sep 17 00:00:00 2001
From: ericgaspar <junk.eg@free.fr>
Date: Thu, 4 Feb 2021 12:52:42 +0100
Subject: [PATCH 08/10] Fix

---
 scripts/install |  7 -------
 scripts/remove  | 11 -----------
 scripts/restore |  7 -------
 scripts/upgrade |  7 -------
 4 files changed, 32 deletions(-)

diff --git a/scripts/install b/scripts/install
index 2ee8492..8f75917 100644
--- a/scripts/install
+++ b/scripts/install
@@ -87,13 +87,6 @@ ynh_script_progression --message="Configuring NGINX web server..."
 # Create a dedicated NGINX config
 ynh_add_nginx_config
 
-#=================================================
-# INTEGRATE SERVICE IN YUNOHOST
-#=================================================
-ynh_script_progression --message="Integrating service in YunoHost..."
-
-yunohost service add $app --description="LibreOffice-based online office suite" --log="/var/log/$app/$app.log"
-
 #=================================================
 # GENERIC FINALIZATION
 #=================================================
diff --git a/scripts/remove b/scripts/remove
index 66c8507..ecd3650 100644
--- a/scripts/remove
+++ b/scripts/remove
@@ -21,17 +21,6 @@ port=$(ynh_app_setting_get --app=$app --key=port)
 
 #=================================================
 # STANDARD REMOVE
-#=================================================
-# REMOVE SERVICE INTEGRATION IN YUNOHOST
-#=================================================
-
-# Remove the service from the list of services known by YunoHost (added from `yunohost service add`)
-if ynh_exec_warn_less yunohost service status $app >/dev/null
-then
-	ynh_script_progression --message="Removing $app service integration..."
-	yunohost service remove $app
-fi
-
 #=================================================
 # REMOVE DEPENDENCIES
 #=================================================
diff --git a/scripts/restore b/scripts/restore
index 55ed06f..5078f9f 100644
--- a/scripts/restore
+++ b/scripts/restore
@@ -63,13 +63,6 @@ ynh_script_progression --message="Restoring the configuration..."
 
 ynh_restore_file --origin_path="/etc/loolwsd/loolwsd.xml"
 
-#=================================================
-# INTEGRATE SERVICE IN YUNOHOST
-#=================================================
-ynh_script_progression --message="Integrating service in YunoHost..."
-
-yunohost service add $app --description="LibreOffice-based online office suite" --log="/var/log/$app/$app.log"
-
 #=================================================
 # START SYSTEMD SERVICE
 #=================================================
diff --git a/scripts/upgrade b/scripts/upgrade
index e658ae3..d2a5fe4 100644
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -99,13 +99,6 @@ ynh_add_config "../conf/loolwsd.xml" "/etc/loolwsd/loolwsd.xml"
 
 #=================================================
 # GENERIC FINALIZATION
-#=================================================
-# INTEGRATE SERVICE IN YUNOHOST
-#=================================================
-ynh_script_progression --message="Integrating service in YunoHost..."
-
-yunohost service add $app --description="LibreOffice-based online office suite" --log="/var/log/$app/$app.log"
-
 #=================================================
 # START SYSTEMD SERVICE
 #=================================================

From eb38c3ba55ac8ce22793342ac66730d35a6830dd Mon Sep 17 00:00:00 2001
From: ericgaspar <junk.eg@free.fr>
Date: Thu, 4 Feb 2021 13:00:32 +0100
Subject: [PATCH 09/10] Fix version

---
 README.md     | 2 +-
 manifest.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index ecae06a..2b43238 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@ If you don't have YunoHost, please see [here](https://yunohost.org/#/install) to
 
 [Collabora](https://www.collaboraoffice.com/code/) is an online office suite usable with Nextcloud.
 
-**Shipped version:** 6.4.0
+**Shipped version:** 6.4.4
 
 ## Screenshots
 
diff --git a/manifest.json b/manifest.json
index c813759..937b0fc 100644
--- a/manifest.json
+++ b/manifest.json
@@ -6,7 +6,7 @@
         "en": "LibreOffice-based online office suite with collaborative editing",
         "fr": "Suite office en ligne et collaborative, basée sur LibreOffice"
     },
-    "version": "6.4.0~ynh1",
+    "version": "6.4.4~ynh1",
     "url": "https://collaboraoffice.com",
     "license": "MPL-2.0",
     "maintainer": {

From 2701da0d67f93da82eb08364b50e089cac32fbed Mon Sep 17 00:00:00 2001
From: ericgaspar <junk.eg@free.fr>
Date: Sat, 6 Feb 2021 19:28:55 +0100
Subject: [PATCH 10/10] Update loolwsd.xml

---
 conf/loolwsd.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/conf/loolwsd.xml b/conf/loolwsd.xml
index 06b91b5..ddd1a43 100644
--- a/conf/loolwsd.xml
+++ b/conf/loolwsd.xml
@@ -74,7 +74,7 @@
     <loleaflet_logging desc="Logging in the browser console" default="false">false</loleaflet_logging>
 
     <trace desc="Dump commands and notifications for replay. When 'snapshot' is true, the source file is copied to the path first." enable="true">
-        <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /tmp/looltrace-%.gz" compress="true" snapshot="false"></path>
+        <path desc="Output path to hold trace file and docs. Use '%' for timestamp to avoid overwriting. For example: /tmp/looltrace-%.gz" compress="true" snapshot="false">/tmp/looltrace-%.gz</path>
         <filter>
             <message desc="Regex pattern of messages to exclude"></message>
         </filter>
@@ -105,7 +105,7 @@
 
     <ssl desc="SSL settings">
         <enable type="bool" desc="Controls whether SSL encryption between browser and loolwsd is enabled (do not disable for production deployment). If default is false, must first be compiled with SSL support to enable." default="true">false</enable>
-        <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">false</termination>
+        <termination desc="Connection via proxy where loolwsd acts as working via https, but actually uses http." type="bool" default="true">true</termination>
         <cert_file_path desc="Path to the cert file" relative="false">/etc/loolwsd/cert.pem</cert_file_path>
         <key_file_path desc="Path to the key file" relative="false">/etc/loolwsd/key.pem</key_file_path>
         <ca_file_path desc="Path to the ca file" relative="false">/etc/loolwsd/ca-chain.cert.pem</ca_file_path>