Misleading inline documentation: Commenting out "INSECURE=true" in .env leads to login fails
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 274
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 103
Description
## Describe the bug
In the .env file, two lines of inline documentation are misleading and wrong in the context of a user that is just installing OCIS. With self-signed certificates as our default, we need to fix this and explain/warn about the consequences for all users. Let's encrypt should be the standard.
## Steps to reproduce
1. Get docker images from Github (git clone https://github.com/owncloud/ocis.git)
2. In ocis/deployments/examples/ocis_wopi/.env comment out "INSECURE=true" as described
3. "docker-compose up -d", then try to login -> fails
## Expected behavior
The description of "INSECURE=true" explains what happens during installation - especially in the default setup. The user understands both the danger and the how to of using self-signed certificates (which is the default here). He is not confused and knows what will happen.
## Actual behavior
If - as the comment in .env suggests - the user is commenting out ("#INSECURE=true"), he will break his setup and will not be able to login. Removing the "#" will help despite the advice in the lines above it.
## Setup
See above, standard docker installation as per developer dokumentation.
## Additional context
Self-Signed Certificates also require EVERY user of the server to also accept the certificates for all subdomaines involved (e.,g. collabora.ocis-tld and onlyoffice.ocis-tld. User expectation is different. Since this is the standard that we deliver, we have to a) fix behaviour and inline documentation, b) explicitely warn about risks and c) tell users about the behaviour they will see.
Contributor guide
Assessment
This issue has not been assessed yet.