nixos/collabora-online: Can't add WOPI proof key pair

Nixpkgs version

• Unstable (25.11)

Describe the bug

There is no way to add WOPI proof key pair. When inspecting the logs, Collabora complains that the file /nix/store/<hash>-collabora-online-<version>/etc/coolwsd/proof_key doesn't exist.

Steps to reproduce

1. Enable Collabora: services.collabora-online = { enable = true; storage.wopi.host = "https://wopi.example.com"; };.
2. Rebuild your NixOS config.
3. Inspect the logs for coolwsd.service: journalctl -u coolwsd.service.
4. Observe the warning line saying that it couldn't find the proof key pair.

Expected behaviour

There should be an option for adding my own custom proof keys, like services.collabora-online.proofKey = "/path/to/proof_key".

Screenshots

No response

Relevant log output

Nov 07 23:29:58 collabora coolwsd[487]: wsd-00487-00487 2025-11-07 23:29:58.200392 +0100 [ coolwsd ] WRN  File not found: Private key file: /nix/store/as2zxcw52ah80zhdzphg0x19nidr91gp-collabora-online-24.04.13-2/etc/coolwsd/proof_key
Nov 07 23:29:58 collabora coolwsd[487]: No proof-key will be present in discovery.
Nov 07 23:29:58 collabora coolwsd[487]: If you need to use WOPI security, generate an RSA key using this command:
Nov 07 23:29:58 collabora coolwsd[487]:     sudo coolconfig generate-proof-key
Nov 07 23:29:58 collabora coolwsd[487]: or if your config dir is not /etc, you can run ssh-keygen manually:
Nov 07 23:29:58 collabora coolwsd[487]:     ssh-keygen -t rsa -N "" -m PEM -f "/nix/store/as2zxcw52ah80zhdzphg0x19nidr91gp-collabora-online-24.04.13-2/etc/coolwsd/proof_key"
Nov 07 23:29:58 collabora coolwsd[487]: Note: the proof_key file must be readable by the coolwsd process.| wsd/ProofKey.cpp:149

Additional context

This can be solved by overriding the collabora-online package in the package argument as follows:

services.collabora-online.package = pkgs.collabora-online.overrideAttrs (old: {
  postInstall = old.postInstall + ''
    ${lib.getExe' pkgs.openssh "ssh-keygen"} -t rsa -N "" -m PEM -f $out/etc/coolwsd/proof_key
  '';
});

However, this means that I have to build the entire package from source, which is undesirable for simply adding my own key pair.

System metadata

• system: "x86_64-linux"
• host os: Linux 6.17.2, NixOS, 25.11 (Xantusia), 25.11.20251031.2fb006b
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.31.2
• channels(root): "nixos"
• nixpkgs: /nix/store/xjjq52iwslhz6lbc621a31v0nfdhr5ks-source

Notify maintainers

@xzfc

---

Note for maintainers: Please tag this issue in your pull request description. (i.e. Resolves #ISSUE.)

I assert that this issue is relevant for Nixpkgs

• I assert that this is a bug and not a support request.
• I assert that this is not a duplicate of an existing issue.
• I assert that I have read the NixOS Code of Conduct and agree to abide by it.

Is this issue important to you?

Add a 👍 reaction to issues you find important.

Start at the NixOS services.collabora-online module and inspect how its package argument and existing options are translated into the coolwsd configuration. Review the reported proof_key path and the package override example, then verify that a configured key pair is available to coolwsd without rebuilding Collabora Online from source.