ENVIRONMENT.md documents OWNCLOUD_WOPI_TOKEN_KEY, OWNCLOUD_WOPI_PROXY_URL,
OWNCLOUD_WOPI_GROUP, OWNCLOUD_WOPI_OFFICE_ONLINE_SERVER and
OWNCLOUD_WOPI_BUSINESS_FLOW_ENABLED without a variant caveat, but only v24.04
implements them. On v22.04 — which backs the 10.16.4, 10.16, 10 and
latest tags — setting them has no effect at all, so admins configure WOPI from a
custom hook instead:
occ config:system:set wopi.token.key --value "${MY_WOPI_TOKEN_KEY}"
That is a secret disclosure: occ config:system:set echoes the value back to
stdout, and the admin_audit app records the full argument list in
owncloud.log, so the signing key lands in the log twice per container start
(three times with DEBUG=true, which also traces the hook's own command line).
There is also no environment variable for wopi.proxy.key in either variant, even
though the app requires it for the business flow and reads it through
getSystemValue() exactly like wopi.token.key.
Two things are needed:
- add
OWNCLOUD_WOPI_PROXY_KEY for the wopi.proxy.key config key
- make the whole
OWNCLOUD_WOPI_* family work on v22.04
Both keys then reach the generated config file, which is never echoed or traced,
and no hook is required.
ENVIRONMENT.mddocumentsOWNCLOUD_WOPI_TOKEN_KEY,OWNCLOUD_WOPI_PROXY_URL,OWNCLOUD_WOPI_GROUP,OWNCLOUD_WOPI_OFFICE_ONLINE_SERVERandOWNCLOUD_WOPI_BUSINESS_FLOW_ENABLEDwithout a variant caveat, but onlyv24.04implements them. On
v22.04— which backs the10.16.4,10.16,10andlatesttags — setting them has no effect at all, so admins configure WOPI from acustom hook instead:
occ config:system:set wopi.token.key --value "${MY_WOPI_TOKEN_KEY}"That is a secret disclosure:
occ config:system:setechoes the value back tostdout, and the
admin_auditapp records the full argument list inowncloud.log, so the signing key lands in the log twice per container start(three times with
DEBUG=true, which also traces the hook's own command line).There is also no environment variable for
wopi.proxy.keyin either variant, eventhough the app requires it for the business flow and reads it through
getSystemValue()exactly likewopi.token.key.Two things are needed:
OWNCLOUD_WOPI_PROXY_KEYfor thewopi.proxy.keyconfig keyOWNCLOUD_WOPI_*family work onv22.04Both keys then reach the generated config file, which is never echoed or traced,
and no hook is required.