Port: www/onlyoffice-documentserver Version: onlyoffice-documentserver-9.4.0 OS: FreeBSD 15.0-RELEASE amd64 Environment: Bastille jail, IPv4-only jail, pkg latest repository Summary ======= The www/onlyoffice-documentserver 9.4.0 package appears to have two configuration issues on a clean install: 1. /usr/local/etc/onlyoffice/documentserver/local.json is invalid JSON immediately after installation. 2. documentserver-update-securelink.sh updates nginx/ds.conf but does not update or add the corresponding storage.fs.secretString override in local.json, causing 403 errors for cached editor files such as Editor.bin. Steps to reproduce ================== 1. Create a clean FreeBSD 15.0-RELEASE jail. 2. Install the package: pkg install onlyoffice-documentserver 3. Check the installed local.json: python3.12 -m json.tool /usr/local/etc/onlyoffice/documentserver/local.json Actual result ============= local.json is not valid JSON. The installed file contains missing commas after _comment fields, for example: "openpgpjs": { "_comment": "https://helpcenter.onlyoffice.com/docs/installation/docs-developer-configuring.aspx#openpgpprotocol_block" "encrypt": { "passwords": ["PGPguardsecretstring"] }, and: "aesEncrypt": { "_comment": "https://helpcenter.onlyoffice.com/docs/installation/docs-developer-configuring.aspx#aes256gcmalgorithm_block" "secret": "docpasswordsecretstring" } Expected result =============== The package should install a valid local.json, for example: "openpgpjs": { "_comment": "https://helpcenter.onlyoffice.com/docs/installation/docs-developer-configuring.aspx#openpgpprotocol_block", "encrypt": { "passwords": ["PGPguardsecretstring"] }, and: "aesEncrypt": { "_comment": "https://helpcenter.onlyoffice.com/docs/installation/docs-developer-configuring.aspx#aes256gcmalgorithm_block", "secret": "docpasswordsecretstring" } Second issue: secure link secret mismatch ======================================== After running: documentserver-update-securelink.sh the script updates: /usr/local/etc/onlyoffice/documentserver/nginx/ds.conf For example: set $secure_link_secret ORhSgP8mzBplNqVt9Aad; However, it does not update local.json and does not add a storage.fs.secretString override. The default value remains only in: /usr/local/etc/onlyoffice/documentserver/default.json as: "storage": { "fs": { "secretString": "verysecretstring" } } Since default.json should not be edited, local.json should receive an override such as: "storage": { "fs": { "secretString": "ORhSgP8mzBplNqVt9Aad" } } Actual runtime behavior ======================= Without manually adding storage.fs.secretString to local.json, ONLYOFFICE starts and the editor UI loads, but document opening fails. nginx returns 403 for cached editor files: GET /cache/files/data/.../Editor.bin?... HTTP/1.1" 403 Other parts work: GET /web-apps/apps/api/documents/api.js HTTP/1.1" 200 GET /doc/.../transport=websocket HTTP/1.1" 101 After adding storage.fs.secretString to local.json with the same value as $secure_link_secret from ds.conf, documents open correctly. Additional jail-specific nginx issue ==================================== The default ds.conf also contains: listen [::]:80 default_server; In an IPv4-only jail this causes: socket() [::]:80 failed (43: Protocol not supported) This can be worked around manually by commenting the IPv6 listen line. This may be expected depending on jail IPv6 configuration, but it is worth noting. Workaround ========== 1. Fix missing commas after _comment entries in local.json. 2. Run documentserver-update-securelink.sh. 3. Copy the generated $secure_link_secret from nginx/ds.conf. 4. Add the following top-level override to local.json: "storage": { "fs": { "secretString": "<same value as $secure_link_secret>" } } 5. Restart services: service supervisord restart service nginx restart After this, /healthcheck returns true and documents open correctly.
Good evening- Thanks for reporting this. I have a patch for this based on your feedback, but need to build and test it first.
Created attachment 272803 [details] Proposed patch While investigating PR 296567, several related issues affecting the FreeBSD port were identified and addressed together. The primary issue was that the installed local.json was not valid JSON due to missing commas after _comment fields. This prevented the file from being parsed by standard JSON tools and required manual correction before any local configuration overrides could be added. In addition, the packaged local.json.sample no longer reflected the upstream 9.4.0 Community Edition configuration. The Community Edition no longer supports PostgreSQL, MySQL or RabbitMQ, so the obsolete configuration blocks have been removed. At the same time, the missing storage.fs.secretString override has been added to the sample configuration. This allows documentserver-update-securelink.sh to correctly override the default secret in default.json, eliminating the secure link mismatch that resulted in HTTP 403 responses when opening cached editor files. The FreeBSD documentserver-update-securelink.sh patch has also been enhanced to update both ds.conf and ds-ssl.conf. This keeps the generated secure_link_secret synchronized regardless of whether an administrator chooses the HTTP or HTTPS nginx configuration supplied with the port, simplifying future migration between the two configurations. The post-install pkg-message has been updated to document the available nginx configuration files, recommend reviewing the supplied listen directives for the local deployment, and clarify that the secure link update script modifies only the packaged configuration files in their default locations. While touching the build infrastructure, the npm cache was regenerated using a newer @yao-pkg/pkg release, allowing the embedded Node runtime to be updated from 24.15.0 to 24.18.0. This incorporates upstream Node security fixes addressing: CVE-2026-48615, CVE-2026-48617, CVE-2026-48618, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48931, CVE-2026-48933, CVE-2026-48934, CVE-2026-48935 CVE-2026-48937 Finally, several upstream Python helper scripts were patched to replace deprecated invalid escape sequences with raw string literals. These are behavior-preserving changes that eliminate the new SyntaxWarning messages emitted by Python 3.12 and proactively prepare the port for future Python releases where these warnings are expected to become hard errors. Build log for amd64: https://pkg.compasses.xyz/data/143Ramd64-default-baseSSL/2026-07-12_21h42m10s/logs/onlyoffice-documentserver-9.4.0_1.log Build log for aarch64: https://pkg03.compasses.xyz/data/143Rarm64-default/2026-07-12_14h56m15s/logs/onlyoffice-documentserver-9.4.0_1.log Given the security issues resolved (2 High / 6 Med / 3 Low), request this patch also be pushed to the quarterly branch.
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=c534cc41965a350c3849cf78fe63c6a98aeb09c0 commit c534cc41965a350c3849cf78fe63c6a98aeb09c0 Author: Matt Kempe <fsbruva@yahoo.com> AuthorDate: 2026-07-11 19:33:08 +0000 Commit: Mikael Urankar <mikael@FreeBSD.org> CommitDate: 2026-07-14 09:21:14 +0000 www/onlyoffice-documentserver: Fix local.json, update securelink handling - Fix invalid JSON in local.json.sample - Add storage.fs.secretString override to local.json.sample - Update documentserver-update-securelink.sh to synchronize both ds.conf and ds-ssl.conf - Update packaged Node runtime to 24.18.0 PR: 296567 www/onlyoffice-documentserver/Makefile | 5 +-- www/onlyoffice-documentserver/distinfo | 10 +++--- .../files/local.json.sample | 19 ++++------- .../files/patch-build__tools_scripts_base.py | 35 +++++++++++++++++--- ...uild__tools_scripts_develop_dependence.py (new) | 25 ++++++++++++++ ...8__89_v8_tools_gen-postmortem-metadata.py (new) | 38 ++++++++++++++++++++++ ...rver_bin_documentserver-update-securelink.sh.m4 | 14 +++++--- www/onlyoffice-documentserver/files/pkg-message.in | 18 ++++++++-- 8 files changed, 133 insertions(+), 31 deletions(-)
A commit in branch 2026Q3 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=ece21dfa4242f8401d1343b12a3123aa83719be6 commit ece21dfa4242f8401d1343b12a3123aa83719be6 Author: Matt Kempe <fsbruva@yahoo.com> AuthorDate: 2026-07-11 19:33:08 +0000 Commit: Mikael Urankar <mikael@FreeBSD.org> CommitDate: 2026-07-14 09:28:23 +0000 www/onlyoffice-documentserver: Fix local.json, update securelink handling - Fix invalid JSON in local.json.sample - Add storage.fs.secretString override to local.json.sample - Update documentserver-update-securelink.sh to synchronize both ds.conf and ds-ssl.conf - Update packaged Node runtime to 24.18.0 PR: 296567 (cherry picked from commit c534cc41965a350c3849cf78fe63c6a98aeb09c0) www/onlyoffice-documentserver/Makefile | 5 +-- www/onlyoffice-documentserver/distinfo | 10 +++--- .../files/local.json.sample | 19 ++++------- .../files/patch-build__tools_scripts_base.py | 35 +++++++++++++++++--- ...uild__tools_scripts_develop_dependence.py (new) | 25 ++++++++++++++ ...8__89_v8_tools_gen-postmortem-metadata.py (new) | 38 ++++++++++++++++++++++ ...rver_bin_documentserver-update-securelink.sh.m4 | 14 +++++--- www/onlyoffice-documentserver/files/pkg-message.in | 18 ++++++++-- 8 files changed, 133 insertions(+), 31 deletions(-)
Thanks!