owncloud / owncloud/ocis

Misleading inline documentation: Commenting out "INSECURE=true" in .env leads to login fails

Open
#8,496 0 comments 0 reactions 0 assignees View on GitHub
Type:Bug
Dominant language
Go
Stars
2.1k
Forks
274
Avg merge
2d 1h
Merged PRs (30d)
103

Description

## Describe the bug
In the .env file, two lines of inline documentation are misleading and wrong in the context of a user that is just installing OCIS. With self-signed certificates as our default, we need to fix this and explain/warn about the consequences for all users. Let's encrypt should be the standard.

## Steps to reproduce
1. Get docker images from Github (git clone https://github.com/owncloud/ocis.git)
2. In ocis/deployments/examples/ocis_wopi/.env comment out "INSECURE=true" as described
3. "docker-compose up -d", then try to login -> fails

## Expected behavior
The description of "INSECURE=true" explains what happens during installation - especially in the default setup. The user understands both the danger and the how to of using self-signed certificates (which is the default here). He is not confused and knows what will happen.

## Actual behavior
If - as the comment in .env suggests - the user is commenting out ("#INSECURE=true"), he will break his setup and will not be able to login. Removing the "#" will help despite the advice in the lines above it.

## Setup
See above, standard docker installation as per developer dokumentation.

## Additional context
Self-Signed Certificates also require EVERY user of the server to also accept the certificates for all subdomaines involved (e.,g. collabora.ocis-tld and onlyoffice.ocis-tld. User expectation is different. Since this is the standard that we deliver, we have to a) fix behaviour and inline documentation, b) explicitely warn about risks and c) tell users about the behaviour they will see.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.