Collabora

Timoni Module
Collaboration Tools
26.04.4.1.1

#Collabora
#Google Docs
#Microsoft 365

Collabora is a powerful collaborative office suite that supports all major document, spreadsheet and presentation file formats, which you can integrate into your own infrastructure.

Deploys

Ingress
Autoscaling
Disruption budget
Network policy
Metrics
Persistent storage

GitHub Upstream

(CODE - Collabora Online Development Edition) is a powerful, open-source, web-based office suite that provides real-time collaborative document editing directly in your web browser. Built on the upstream Collabora Online architecture, this Timoni module delivers a cloud-native, production-ready Collabora deployment with Kubernetes Secret credentials management, in-memory RAM disk sandboxing, secure non-root operation, and Kubernetes Gateway API integration.

Version: 26.04.4.1.1
Upstream Project:
Container Base: (docker.io/collabora/code:26.04.4.1.1@sha256:1efda3043e8b9cb437d1b6c6efe20cc3753760e634de012b8dac391da488bf97)
Deployment Type: Timoni Module / Kubernetes Cloud-Native Workload

Collabora Online Core (collabora): The web-based document editing and rendering engine container running docker.io/collabora/code:26.04.4.1.1 on container port 9980. Operates as dedicated unprivileged system user (), dropping all kernel capabilities (), with , , and to achieve full non-root isolation and a 11/11 Kubesec score without requiring node-level DaemonSets.

Key	Type	Default	Description
`image.repository`	string	`docker.io/collabora/code`	Container image repository
`image.tag`	string	`26.04.4.1.1`	Pinned container image tag
`image.digest`	string	`sha256:1efda3043e8b9cb437d1b6c6efe20cc3753760e634de012b8dac391da488bf97`	Pinned container image digest
`image.pullPolicy`	string	`IfNotPresent`	Kubernetes image pull policy
`collabora.username`	string	`admin`	Collabora administrator username (stored in Secret)
`collabora.password`	string	`changeme`	Collabora administrator password (stored in Secret)
`collabora.server_name`	string	`example.com`	Public hostname or domain of the Collabora service
`collabora.aliasgroup1`	string	`https://cloud.example.com`	Primary WOPI host URL (TrueCharts addition)
`collabora.dictionaries`	list	`["de_DE", ...]`	Multilingual spellchecking dictionaries (TrueCharts addition)
`collabora.interface`	string	`default`	UI mode (`default`, `compact`, `tabbed`)
`collabora.extra_params`	string	`--o:ssl.enable=false ... --o:mount_jail_tree=false ...`	Tuned coolwsd daemon flags
`securityContext.privileged`	bool	`false`	Unprivileged container mode
`securityContext.runAsNonRoot`	bool	`true`	Enforces running as a non-root user
`securityContext.runAsUser`	int	`1001`	Runs as dedicated `cool` system user
`securityContext.readOnlyRootFilesystem`	bool	`false`	Document runtime conversion filesystem access
`securityContext.allowPrivilegeEscalation`	bool	`false`	Disables privilege escalation (achieves Kubesec score 11/11)
`securityContext.seccompProfile.type`	string	`RuntimeDefault`	Standard container runtime seccomp profile
`securityContext.capabilities.drop`	list	`["ALL"]`	Drops all Linux capabilities
`podSecurityContext.fsGroup`	int	`1001`	Filesystem group matching `cool` user
`podSecurityContext.fsGroupChangePolicy`	string	`OnRootMismatch`	Optimizes volume permission checks on pod start
`podSecurityContext.seccompProfile.type`	string	`RuntimeDefault`	Pod-level runtime default seccomp profile
`installCOOLSeccompProfile`	bool	`false`	Host seccomp DaemonSet (not required with mount_jail_tree=false)
`service.port`	int	`9980`	Service port exposed within the cluster
`service.type`	string	`ClusterIP`	Kubernetes service type
`resources.requests.cpu`	string	`75m`	Container requested CPU capacity
`resources.requests.memory`	string	`200Mi`	Container requested memory capacity
`resources.limits.cpu`	string	`1500m`	Container maximum CPU limit
`resources.limits.memory`	string	`2400Mi`	Container maximum memory limit
`route.enabled`	bool	`true`	Create a Gateway API HTTPRoute resource
`route.parentRefs`	list	`[{name: "shared-gtw", namespace: "kube-system"}]`	Gateway reference(s) to attach the route to
`route.hostnames`	list	`[]`	Optional domain hostnames matching inbound requests
`route.path`	string	`/`	Inbound URL path match value
`route.pathType`	string	`PathPrefix`	URL path match type (`PathPrefix` or `Exact`)
`route.annotations`	map	`{}`	Annotations applied to the HTTPRoute resource
`ingress.enabled`	bool	`false`	Create a standard Kubernetes Ingress resource
`ingress.className`	string	`""`	Ingress class name (e.g. `nginx`, `traefik`)
`ingress.hosts`	list	`[]`	Ingress host match rules
`autoscaling.enabled`	bool	`true`	Create a HorizontalPodAutoscaler (HPA) resource
`autoscaling.minReplicas`	int	`2`	Minimum replica count for autoscaling
`autoscaling.maxReplicas`	int	`3`	Maximum replica count for autoscaling
`podDisruptionBudget.enabled`	bool	`true`	Create a PodDisruptionBudget (PDB) resource
`networkPolicy.enabled`	bool	`false`	Enforce Kubernetes NetworkPolicy ingress/egress isolation
`serviceAccount.create`	bool	`true`	Create a dedicated ServiceAccount for Collabora
`prometheus.servicemonitor.enabled`	bool	`false`	Create a Prometheus Operator ServiceMonitor for `/cool/getMetrics`
`deployment.customFonts.enabled`	bool	`false`	Mount PVC for custom typography & fonts
`nginxDeny.enabled`	bool	`false`	Deploy secondary Nginx pod blocking sensitive endpoints
`reverseProxy.enabled`	bool	`false`	Deploy WOPISrc hash sticky reverse proxy for multi-replica

Key

Type

Default

Description

image.repository

string

docker.io/collabora/code

Container image repository

image.tag

string

26.04.4.1.1

Pinned container image tag

image.digest

string

sha256:1efda3043e8b9cb437d1b6c6efe20cc3753760e634de012b8dac391da488bf97

Pinned container image digest

image.pullPolicy

string

IfNotPresent

Kubernetes image pull policy

collabora.username

string

admin

Collabora administrator username (stored in Secret)

collabora.password

string

changeme

Collabora administrator password (stored in Secret)

collabora.server_name

string

example.com

Public hostname or domain of the Collabora service

collabora.aliasgroup1

string

https://cloud.example.com

Primary WOPI host URL (TrueCharts addition)

collabora.dictionaries

list

["de_DE", ...]

Multilingual spellchecking dictionaries (TrueCharts addition)

collabora.interface

string

default

UI mode (default, compact, tabbed)

collabora.extra_params

string

--o:ssl.enable=false ... --o:mount_jail_tree=false ...

Tuned coolwsd daemon flags

securityContext.privileged

bool

false

Unprivileged container mode

securityContext.runAsNonRoot

bool

true

Enforces running as a non-root user

securityContext.runAsUser

int

1001

Runs as dedicated cool system user

securityContext.readOnlyRootFilesystem

bool

false

Document runtime conversion filesystem access

securityContext.allowPrivilegeEscalation

bool

false

Disables privilege escalation (achieves Kubesec score 11/11)

securityContext.seccompProfile.type

string

RuntimeDefault

Standard container runtime seccomp profile

securityContext.capabilities.drop

list

["ALL"]

Drops all Linux capabilities

podSecurityContext.fsGroup

int

1001

Filesystem group matching cool user

podSecurityContext.fsGroupChangePolicy

string

OnRootMismatch

Optimizes volume permission checks on pod start

podSecurityContext.seccompProfile.type

string

RuntimeDefault

Pod-level runtime default seccomp profile

installCOOLSeccompProfile

bool

false

Host seccomp DaemonSet (not required with mount_jail_tree=false)

service.port

int

9980

Service port exposed within the cluster

service.type

string

ClusterIP

Kubernetes service type

resources.requests.cpu

string

75m

Container requested CPU capacity

resources.requests.memory

string

200Mi

Container requested memory capacity

resources.limits.cpu

string

1500m

Container maximum CPU limit

resources.limits.memory

string

2400Mi

Container maximum memory limit

route.enabled

bool

true

Create a Gateway API HTTPRoute resource

route.parentRefs

list

[{name: "shared-gtw", namespace: "kube-system"}]

Gateway reference(s) to attach the route to

route.hostnames

list

[]

Optional domain hostnames matching inbound requests

route.path

string

/

Inbound URL path match value

route.pathType

string

PathPrefix

URL path match type (PathPrefix or Exact)

route.annotations

map

{}

Annotations applied to the HTTPRoute resource

ingress.enabled

bool

false

Create a standard Kubernetes Ingress resource

ingress.className

string

""

Ingress class name (e.g. nginx, traefik)

ingress.hosts

list

[]

Ingress host match rules

autoscaling.enabled

bool

true

Create a HorizontalPodAutoscaler (HPA) resource

autoscaling.minReplicas

int

2

Minimum replica count for autoscaling

autoscaling.maxReplicas

int

3

Maximum replica count for autoscaling

podDisruptionBudget.enabled

bool

true

Create a PodDisruptionBudget (PDB) resource

networkPolicy.enabled

bool

false

Enforce Kubernetes NetworkPolicy ingress/egress isolation

serviceAccount.create

bool

true

Create a dedicated ServiceAccount for Collabora

prometheus.servicemonitor.enabled

bool

false

Create a Prometheus Operator ServiceMonitor for /cool/getMetrics

deployment.customFonts.enabled

bool

false

Mount PVC for custom typography & fonts

nginxDeny.enabled

bool

false

Deploy secondary Nginx pod blocking sensitive endpoints

reverseProxy.enabled

bool

false

Deploy WOPISrc hash sticky reverse proxy for multi-replica

Collabora

Deploys

Modernize your IT Infrastructure with EvoCloud

General values