Onlyoffice on nextcloud reddit / selfhosted ---------------------------------------------------------------------- xervir-445 · 2023-12-15 15:33 If I configure my onlyoffice with my public address and stop there it works fine. However if I go and configure the addresses that the onlyoffice and nextcloud servers should use to talk to each other I get this error: Error: DNS lookup 172.19.0.5(family:4, host:app) is not allowed. Because, It is private IP address. Onlyoffice and nextcloud are running in the same docker stack and I would prefer onlyoffice be able to fetch documents directly from nextcloud instead of doing some sort of roundabout trip all the way to the WAN and back. Why is it that it's not allowed to connect through a private IP address? Does anyone know either a way to disable this restriction or else permit a specific address? ---------------------------------------------------------------------- StefanMcL-Pulseway2 · 2023-12-15 15:50 From the error message it seems OnlyOffice is confugured to prevent connections to private IP addresses as a security measure. This restriction is likely in place to prevent Server-Side Request Forgery (SSRF) attacks, where a server is tricked into accessing unauthorized internal resources. What version of Only Office are you on? as i know in some versions you can configure this to not be the case by heading to the local.json or something similar. You could also make sure that both OnlyOffice and NextCloud containers are on the same Docker network. This way, they can communicate directly using their Docker service names instead of IP addresses ---------------------------------------------------------------------- xervir-445 · 2023-12-15 16:17 Onlyoffice version 7.5.1 Nextcloud version 28 The two containers are definitely on the same network. I had put "http://app/" into the text field for the document server, not an IP address, since that is the name of the nextcloud service in the stack. I figured it logged the ip address since that's what "app" resolved to. This is the local.json, I hadn't touched it, so it should just be the default: { "services": { "CoAuthoring": { "sql": { "type": "postgres", "dbHost": "localhost", "dbPort": "5432", "dbName": "onlyoffice", "dbUser": "onlyoffice", "dbPass": "onlyoffice" }, "token": { "enable": { "request": { "inbox": false, "outbox": false }, "browser": false }, "inbox": { "header": "Authorization", "inBody": false }, "outbox": { "header": "Authorization", "inBody": false } }, "secret": { "inbox": { "string": "redacted" }, "outbox": { "string": "redacted" }, "session": { "string": "redacted" } } } }, "rabbitmq": { "url": "amqp://guest:guest@localhost" }, "storage": { "fs": { "secretString": "redacted" } } } I don't see anything about ssrf in there and the documentation is kinda confusing. ---------------------------------------------------------------------- StefanMcL-Pulseway2 · 2023-12-15 16:56 >Onlyoffice version 7.5.1 > >Nextcloud version 28 > >The two containers are definitely on the same network. I had put "http://app/" into the text field for the document server, not an IP address, since that is the name of the nextcloud service in the stack. I figured it logged the ip address since that's what "app" resolved to. > >This is the local.json, I hadn't touched it, so it should just be the default: > >{"services": {"CoAuthoring": {"sql": {"type": "postgres","dbHost": "localhost","dbPort": "5432","dbName": "onlyoffice","dbUser": "onlyoffice","dbPass": "onlyoffice"},"token": {"enable": {"request": {"inbox": false,"outbox": false},"browser": false},"inbox": {"header": "Authorization","inBody": false},"outbox": {"header": "Authorization","inBody": false}},"secret": {"inbox": {"string": "redacted"},"outbox": {"string": "redacted"},"session": {"string": "redacted"}}}},"rabbitmq": {"url": "amqp://guest:guest@localhost"},"storage": {"fs": {"secretString": "redacted"}}} > >I don't see anything about ssrf in there and the documentation is kinda confusing. So based off of this the issue is most definitley elated to the network configuration and how OnlyOffice resolves the Nextcloud service address within the Docker environment. In the version of OnlyOffice you're using, the ability to configure restrictions or allowances for private IP addresses is not explicitly mentioned in the local.json file. This could be a built-in security feature that is not exposed for configuration in this version. When using Docker, services within the same network should ideally be able to communicate using their service names (like app for Nextcloud). Make sure that DNS resolution is working correctly within the Docker network. You can test this by exec-ing into the OnlyOffice container and trying to ping app. Also instead of just http://app/, ensure you are using the full URL required by Nextcloud for access, including any necessary port numbers or paths. ---------------------------------------------------------------------- xervir-445 · 2023-12-15 18:23 I don't think it's related to the network configuration. If I exec bash into the onlyoffice container and I `wget http://app/` I get \--2023-12-15 18:18:50-- http://app/ Resolving app (app)... 172.19.0.5 Connecting to app (app)|172.19.0.5|:80... connected. HTTP request sent, awaiting response... 302 Found \* 302 sends me to the public address so everything after this point isn't relevant It's clearly accepting "app," resolving its dns to an ip address, and getting back good data from that address (a 302 response in this case) ---------------------------------------------------------------------- kdecherf · 2023-12-15 23:32 Using docker containers here, NC 27.1.4 and OODS 7.5 (through onlyoffice/documentserver image). Which docker image are you using for OnlyOffice? On NC side, there are dedicated fields for internal requests. How did you configure your integration?