From 76c8cc3d2df86c38e13b68afa25fd3481ba8a4c2 Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Thu, 27 Aug 2026 15:11:21 +0200 Subject: [PATCH 1/8] fix(scripts): update build.js js with correct path from `load-config` --- scripts/build.js | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/scripts/build.js b/scripts/build.js index 5cb823286..dc88fb1b2 100644 --- a/scripts/build.js +++ b/scripts/build.js @@ -7,7 +7,7 @@ var Fse = require("fs-extra"); var Path = require("path"); var OS = require("os"); -var config = require("../lib/load-config"); +const { config, infra } = require("../lib/load-config"); var swap = function (s, o) { return s @@ -108,7 +108,7 @@ var imagePath = `/customize/images/opengraph_preview/`; var appImagePath = a => { var partial = previewExists(`og-${a}.png`) && `og-${a}.png` || `og-default.png`; - return new URL(imagePath + partial, config.httpUnsafeOrigin).href; + return new URL(imagePath + partial, infra.public.origin).href; }; var buildPath = Path.resolve('./customize'); @@ -218,7 +218,7 @@ appIndexesToBuild.forEach(function (app) { var type = types[app]; var built = processPage(src.replace(patt, (current) => { return current + swap(ogData, { - url: new URL(`/${app}/`, config.httpUnsafeOrigin).href, + url: new URL(`/${app}/`, infra.public.origin).href, title: type && `Encrypted ${type}` || 'CryptPad', image: appImagePath(app), description: Messages.og_default, @@ -237,7 +237,7 @@ appIndexesToBuild.forEach(function (app) { var instance; try { - instance = new URL(config.httpUnsafeOrigin).hostname; + instance = new URL(infra.public.origin).hostname; } catch (err) { console.error("Failed to parse instance domain name\nAborting..."); return void process.exit(1); @@ -284,12 +284,12 @@ try { console.log(`Parsing ${srcPath}`); var src = Fs.readFileSync(srcPath, 'utf8'); var patt = /<\/title>/; - var href = new URL(obj.url, config.httpUnsafeOrigin).href; + var href = new URL(obj.url, infra.public.origin).href; var built = processPage(src.replace(patt, (current) => { return current + swap(ogData, { url: href, title: obj.title || "CryptPad", - image: new URL(imagePath + 'og-default.png', config.httpUnsafeOrigin).href, + image: new URL(imagePath + 'og-default.png', infra.public.origin).href, description: Messages.og_default, }); })); From e1e038da8da23101758695ef1bde11bee0290624 Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Thu, 27 Aug 2026 15:24:50 +0200 Subject: [PATCH 2/8] docs(config): update `example.nginx.conf` to be compatible with the new cryptpad-server --- docs/example.nginx.conf | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf index 23ccf2182..ba6f4cf91 100644 --- a/docs/example.nginx.conf +++ b/docs/example.nginx.conf @@ -8,6 +8,17 @@ # installation (http server by the Nodejs process). If you are using CryptPad # in production and require professional support please contact sales@cryptpad.fr +# CryptPad possesses several nodes that can answer websocket requests. The +# following allows nginx to load-balance between them. +# The different `server` corresponds to the location of the different front +# nodes specified in your CryptPad `config/infra.js` file. If you change this +# setting, don’t forget to update the following list of servers +# The following works with config/infra.example.js: +upstream fronts { + server localhost:3010; + server localhost:3011; +} + server { listen 80; listen [::]:80; @@ -78,7 +89,7 @@ server { } location ^~ /cryptpad_websocket { - proxy_pass http://localhost:3003; + proxy_pass http://fronts; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; From e7173f5ec36672cd4266b771ff351816aea8ecac Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Fri, 28 Aug 2026 17:09:29 +0200 Subject: [PATCH 3/8] docs(config): simplify the simplified nginx example and update the advanced one --- docs/example-advanced.nginx.conf | 13 ++++++++++++- docs/example.nginx.conf | 6 +----- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/docs/example-advanced.nginx.conf b/docs/example-advanced.nginx.conf index 13ab79678..c8472c569 100644 --- a/docs/example-advanced.nginx.conf +++ b/docs/example-advanced.nginx.conf @@ -8,6 +8,17 @@ # installation (http server by the Nodejs process). If you are using CryptPad # in production and require professional support please contact sales@cryptpad.fr +# CryptPad possesses several nodes that can answer websocket requests. The +# following allows nginx to load-balance between them. +# The different `server` corresponds to the location of the different front +# nodes specified in your CryptPad `config/infra.js` file. If you change this +# setting, don’t forget to update the following list of servers +# The following works with config/infra.example.js: +upstream fronts { + server localhost:3010; + server localhost:3011; +} + server { listen 80; listen [::]:80; @@ -202,7 +213,7 @@ server { # Websocket traffic still needs to be handled by the main process, which means it needs # to be hosted on a different port. By default 3003 will be used, though this is configurable # via config.websocketPort - proxy_pass http://localhost:3003; + proxy_pass http://fronts; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf index ba6f4cf91..134bc48e9 100644 --- a/docs/example.nginx.conf +++ b/docs/example.nginx.conf @@ -14,10 +14,6 @@ # nodes specified in your CryptPad `config/infra.js` file. If you change this # setting, don’t forget to update the following list of servers # The following works with config/infra.example.js: -upstream fronts { - server localhost:3010; - server localhost:3011; -} server { listen 80; @@ -89,7 +85,7 @@ server { } location ^~ /cryptpad_websocket { - proxy_pass http://fronts; + proxy_pass http://localhost:3000; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; From da2cd6b78832fe43e4fe0cb3e42fdb129c5076b5 Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Tue, 1 Sep 2026 14:15:26 +0200 Subject: [PATCH 4/8] dist(docker): unexpose port 3003 (no longer in use for ws connections) --- Dockerfile | 2 +- docker-compose.yml | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 2d02c00c7..6c7be3878 100644 --- a/Dockerfile +++ b/Dockerfile @@ -55,7 +55,7 @@ ENTRYPOINT ["/bin/bash", "/cryptpad/docker-entrypoint.sh"] HEALTHCHECK --interval=1m CMD curl -f http://localhost:3000/ || exit 1 # Ports -EXPOSE 3000 3003 +EXPOSE 3000 # Run cryptpad on startup CMD ["npm", "start"] diff --git a/docker-compose.yml b/docker-compose.yml index 868823dbe..df51c9c3f 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -28,7 +28,6 @@ services: ports: - "3000:3000" - - "3003:3003" ulimits: nofile: From 48dea24019a5f6e1d400c28cc9d789070ae3a9bc Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Tue, 1 Sep 2026 14:16:41 +0200 Subject: [PATCH 5/8] docs(nginx): simplify nginx config + remove unused comment --- docs/example.nginx.conf | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf index 134bc48e9..5e2a3bae9 100644 --- a/docs/example.nginx.conf +++ b/docs/example.nginx.conf @@ -8,13 +8,6 @@ # installation (http server by the Nodejs process). If you are using CryptPad # in production and require professional support please contact sales@cryptpad.fr -# CryptPad possesses several nodes that can answer websocket requests. The -# following allows nginx to load-balance between them. -# The different `server` corresponds to the location of the different front -# nodes specified in your CryptPad `config/infra.js` file. If you change this -# setting, don’t forget to update the following list of servers -# The following works with config/infra.example.js: - server { listen 80; listen [::]:80; @@ -83,15 +76,4 @@ server { proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection upgrade; } - - location ^~ /cryptpad_websocket { - proxy_pass http://localhost:3000; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection upgrade; - } } From c7003700cfc183d5db6d8d6c08442e55cc100ed0 Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Thu, 3 Sep 2026 10:53:56 +0200 Subject: [PATCH 6/8] fix(docker): switch back to debian for glibc + remove localhost from infra --- Dockerfile | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 6c7be3878..41a8c3f81 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,7 @@ # SPDX-License-Identifier: AGPL-3.0-or-later # Multistage build to reduce image size and increase security -FROM node:lts-alpine AS build +FROM node:lts-slim AS build # Create folder for CryptPad RUN mkdir /cryptpad @@ -14,20 +14,25 @@ COPY . /cryptpad RUN sed -i "s@//httpAddress: 'localhost'@httpAddress: '0.0.0.0'@" /cryptpad/config/config.example.js RUN sed -i "s@installMethod: 'unspecified'@installMethod: 'docker'@" /cryptpad/config/config.example.js +RUN sed -i 's@host: "localhost"@host: "0.0.0.0"@' /cryptpad/config/infra.example.js # Install dependencies RUN npm install --production \ && npm run install:components # Create actual CryptPad image -FROM node:lts-alpine +FROM node:lts-slim +ENV DEBIAN_FRONTEND=noninteractive # Create user and group for CryptPad so it does not run as root -RUN addgroup -S cryptpad -g 4001 && adduser -S cryptpad -G cryptpad --uid 4001 -h /cryptpad +RUN groupadd cryptpad -g 4001 && useradd cryptpad -u 4001 -g 4001 -d /cryptpad # Install curl for healthcheck # Install git, rdfind and unzip for install-onlyoffice.sh -RUN apk add --no-cache ca-certificates git rdfind unzip bash curl +RUN apt-get update && apt-get install --no-install-recommends -y \ + curl ca-certificates git rdfind unzip && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* # Copy cryptpad with installed modules COPY --from=build --chown=cryptpad /cryptpad /cryptpad From ed90be2bc323f2b28da87883b8b140498cae3673 Mon Sep 17 00:00:00 2001 From: Fabrice Mouhartem Date: Thu, 3 Sep 2026 10:55:31 +0200 Subject: [PATCH 7/8] chore(deps): update cryptpad-server to fix issues with Docker --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index c37a8c76e..c1d0ea80c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -25,7 +25,7 @@ "connect-gzip-static": "^4.2.1", "cookie-parser": "^1.4.7", "croppie": "^2.5.0", - "cryptpad-server": "^0.0.1", + "cryptpad-server": "^0.0.2", "dragula": "3.7.2", "drawio": "github:cryptpad/drawio-npm#npm-29.6.7+3", "express": "~4.22.1", @@ -1819,9 +1819,9 @@ } }, "node_modules/cryptpad-server": { - "version": "0.0.1", - "resolved": "https://registry.npmjs.org/cryptpad-server/-/cryptpad-server-0.0.1.tgz", - "integrity": "sha512-qWhs6zKLbwK58V2nJBj2hkIaexljOgmte0+KKxyprVnaZeE9Qkwg4hyPrSKmKh5EssDtu/1/ol6TodzNPR6OcA==", + "version": "0.0.2", + "resolved": "https://registry.npmjs.org/cryptpad-server/-/cryptpad-server-0.0.2.tgz", + "integrity": "sha512-JpU7Q3N+wtb2Eafy9GEOuBeXk5cy7tqT3VyMyTfj16JT4DyxH7EuvpmzjcgGYomsxYt5xS/dViZ4eGOUp4uXlQ==", "license": "AGPL-3.0+", "dependencies": { "body-parser": "^2.2.0", diff --git a/package.json b/package.json index 30274dfc3..8f4d64f4a 100644 --- a/package.json +++ b/package.json @@ -28,7 +28,7 @@ "connect-gzip-static": "^4.2.1", "cookie-parser": "^1.4.7", "croppie": "^2.5.0", - "cryptpad-server": "^0.0.1", + "cryptpad-server": "^0.0.2", "dragula": "3.7.2", "drawio": "github:cryptpad/drawio-npm#npm-29.6.7+3", "express": "~4.22.1", From 09867cc05634d93b09fdcea3ef45f490a31fedfa Mon Sep 17 00:00:00 2001 From: yflory Date: Tue, 8 Sep 2026 16:22:26 +0200 Subject: [PATCH 8/8] chore: remove unused dependencies --- package-lock.json | 2 -- package.json | 2 -- 2 files changed, 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index c1d0ea80c..9c0a2c454 100644 --- a/package-lock.json +++ b/package-lock.json @@ -12,7 +12,6 @@ "@mcrowe/minibloom": "^0.2.0", "@node-saml/node-saml": "^5.1.0", "alertify.js": "1.0.11", - "body-parser": "^1.20.4", "bootstrap": "^4.0.0", "bootstrap-tokenfield": "^0.12.0", "chainpad": "^5.3.1", @@ -28,7 +27,6 @@ "cryptpad-server": "^0.0.2", "dragula": "3.7.2", "drawio": "github:cryptpad/drawio-npm#npm-29.6.7+3", - "express": "~4.22.1", "file-saver": "1.3.1", "fs-extra": "^7.0.0", "get-folder-size": "^2.0.1", diff --git a/package.json b/package.json index 8f4d64f4a..63a7defad 100644 --- a/package.json +++ b/package.json @@ -15,7 +15,6 @@ "@mcrowe/minibloom": "^0.2.0", "@node-saml/node-saml": "^5.1.0", "alertify.js": "1.0.11", - "body-parser": "^1.20.4", "bootstrap": "^4.0.0", "bootstrap-tokenfield": "^0.12.0", "chainpad": "^5.3.1", @@ -31,7 +30,6 @@ "cryptpad-server": "^0.0.2", "dragula": "3.7.2", "drawio": "github:cryptpad/drawio-npm#npm-29.6.7+3", - "express": "~4.22.1", "file-saver": "1.3.1", "fs-extra": "^7.0.0", "get-folder-size": "^2.0.1",