SWAG + Nextcloud AIO + OnlyOffice + Openproject: Fullchain cert
connections required. I have the data but I'm not sure how to plug
this all together...
reddit / selfhosted

----------------------------------------------------------------------
cribbageSTARSHIP · 2023-12-07 20:51

Good day!

​

I'm trying to connect these three apps together:

1. SWAG: Swag is working to allow me to access all my programs from
the WAN. [The docker-swag
github](https://github.com/linuxserver/docker-swag#using-certs-in-
other-containers) states:

​

          Using certs in other containers

        This container includes auto-generated pfx and private-
fullchain-bundle pem certs that are needed by other apps like Emby and
Znc.
            To use these certs in other containers, do either of the
following:
            (Easier) Mount the container's config folder in other
containers (ie. -v /path-to-swag-config:/swag-ssl) and in the other
containers, use the cert location /swag-ssl/keys/letsencrypt/
            (More secure) Mount the SWAG folder etc that resides under
/config in other containers (ie. -v /path-to-swag-config/etc:/swag-
ssl) and in the other containers, use the cert location /swag-
ssl/letsencrypt/live// (This is more secure because the first method
shares the entire SWAG config folder with other containers, including
the www files, whereas the second method only shares the ssl certs)
            These certs include:
            cert.pem, chain.pem, fullchain.pem and privkey.pem, which
are generated by Certbot and used by nginx and various other apps
            privkey.pfx, a format supported by Microsoft and commonly
used by dotnet apps such as Emby Server (no password)
            priv-fullchain-bundle.pem, a pem cert that bundles the
private key and the fullchain, used by apps like ZNC


I can understand from the above \*how\* to mount the dir above, but I
would like to better understand what I'm connecting.

2. The [OnlyOffice github](https://github.com/ONLYOFFICE/Docker-
DocumentServer/tree/master#available-configuration-parameters)  has a
few Available Configuration Parameters which could be of use:

    -ONLYOFFICE_HTTPS_HSTS_ENABLED: Advanced configuration option for
turning off the HSTS configuration. Applicable only when SSL is in
use. Defaults to true.
    -ONLYOFFICE_HTTPS_HSTS_MAXAGE: Advanced configuration option for
setting the HSTS max-age in the onlyoffice nginx vHost configuration.
Applicable only when SSL is in use. Defaults to 31536000.
    -SSL_CERTIFICATE_PATH: The path to the SSL certificate to use.
Defaults to /var/www/onlyoffice/Data/certs/tls.crt.
    -SSL_KEY_PATH: The path to the SSL certificate's private key.
Defaults to /var/www/onlyoffice/Data/certs/tls.key.
    -SSL_DHPARAM_PATH: The path to the Diffie-Hellman parameter.
Defaults to /var/www/onlyoffice/Data/certs/dhparam.pem.
    -SSL_VERIFY_CLIENT: Enable verification of client certificates
using the CA_CERTIFICATES_PATH file. Defaults to false

The issue is that none of those are .pem or .pfx mention via the swag-
ssl volume.

Any help would be great, thank you!

----------------------------------------------------------------------
FlattusBlastus · 2023-12-07 21:09

What's SWAG?

----------------------------------------------------------------------
thekrautboy · 2023-12-07 21:35

OP is even linking the Github...
https://github.com/linuxserver/docker-swag

----------------------------------------------------------------------
thekrautboy · 2023-12-07 21:37

Simple enough to Google how to create fullchain pem with openssl...

And for SWAG support: https://www.linuxserver.io/support

Not sure what you mean by "connecting these apps together"... once
your certbot or whatever you want to use has created the certs for
you, you can re-use the same cert files for multiple services.

----------------------------------------------------------------------
cribbageSTARSHIP · 2023-12-07 21:48

The swag support response was to close my support question because
they didn't offer nextcloud or only office container.

The swag GitHub states that I can mount the swag dir with the full
chain right into the only office container.

The only office container comes with Apache bundled in for the purpose
of connecting a reverse proxy. So this is the flow:

Web--https-->swag --http-->Apache+OnlyOffice