Installing Cryptpad on Debian 12

# Docker falls back on the running instance if a restart fails, so you won't
# see any errors, so make sure to shutdown completely first.
sudo docker compose down -v
sudo docker compose up -d
# Show logs.
sudo docker-compose logs cryptpad

# NOTE: Not part of Cryptpad's example config, but without it, HTTP requests
# get forwarded to HTTPS of other configured websites that configured a
# forward from HTTP.
server {
    listen       80;
    listen       [::]:80;
    server_name office.foo.com sandbox.office.foo.com;

    location / {
        access_log off;
        return 301 https://$server_name$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    # Let's Encrypt webroot
    # CHRIS: Deactivated
    # include letsencrypt-webroot;

    # Include mime.types to be able to support .mjs files (see "types" below)
    include mime.types;

    # CryptPad serves static assets over these two domains.
    # `your-main-domain` is what users will enter in their address bar.
    # Privileged computation such as key management is handled in this scope
    # UI content is loaded via the `your-sandbox-domain`.
    # "Content Security Policy" headers prevent content loaded via the sandbox
    # from accessing privileged information.
    # This setup allows to take advantage of CryptPad's sandboxing techniques.
    # In the event of an XSS vulnerability in CryptPad's front-end code
    # this will limit the amount of information accessible to attackers.
    server_name office.foo.com sandbox.office.foo.com;

    # You'll need to Set the path to your certificates and keys here
    # IMPORTANT: this config is intended to serve assets for at least two domains
    # (your main domain and your sandbox domain). As such, you'll need to generate a single SSL certificate
    # that includes both domains in order for things to work as expected.
    ssl_certificate         /etc/letsencrypt/live/office.foo.com/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/office.foo.com/privkey.pem;

    # diffie-hellman parameters are used to negotiate keys for your session
    # generate strong parameters using the following command
    # openssl dhparam -out /etc/nginx/dhparam.pem 4096
    ssl_dhparam /etc/nginx/dhparam.pem;

    # Speeds things up a little bit when resuming a session
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    # verify chain of trust of OCSP response using Root CA and Intermediate certs
    ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;

    # replace with the IP address of your resolver
    resolver 8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 9.9.9.9 149.112.112.112 208.67.222.222 208.67.220.220;

    location / {
        proxy_pass            http://localhost:3000;
        proxy_set_header      X-Real-IP $remote_addr;
        proxy_set_header      Host $host;
        proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
        client_max_body_size  150m;

        proxy_http_version    1.1;
        proxy_set_header      Upgrade $http_upgrade;
        proxy_set_header      Connection upgrade;
    }
}

OLD_CRYPTPAD_VERSION_NUMBER=<OLD_CRYPTPAD_VERSION_NUMBER>
NEW_CRYPTPAD_VERSION_NUMBER=<NEW_CRYPTPAD_VERSION_NUMBER>
CRYPTPAD_USAGE_ROLE=<EG_WORK_OR_PERSONAL>
NEW_CRYPTPAD_DIR=/opt/cryptpad-$NEW_CRYPTPAD_VERSION_NUMBER-$CRYPTPAD_USAGE_ROLE
OLD_CRYPTPAD_DIR=/opt/cryptpad-$OLD_CRYPTPAD_VERSION_NUMBER-$CRYPTPAD_USAGE_ROLE

cd $OLD_CRYPTPAD_DIR
sudo docker compose down -v
cd $NEW_CRYPTPAD_DIR
sudo mv data data_ORIGINAL
sudo mv customize customize_ORIGINAL
sudo mv config config_ORIGINAL
sudo cp -r $OLD_CRYPTPAD_DIR/data/ .
sudo cp -r $OLD_CRYPTPAD_DIR/customize/ .
sudo cp -r $OLD_CRYPTPAD_DIR/config/ .
sudo chown -R 4001:4001 data customize
sudo chown -R 1000:1000 config
sudo chown -R 4001:4001 config/config.js
sudo docker compose up -d

services:
    cryptpad:
        # ...
        - ./config/config.js:/cryptpad/config/config.js
        - ./customize.dist/application_config.js:/cryptpad/customize.dist/application_config.js

sudo docker restart

sudo rm -r data_ORIGINAL
sudo rm -r customize customize_ORIGINAL
sudo rm -r config config_ORIGINAL

sudo cp customize.dist/src/less2/include/colortheme.less customize/src/less2/include/
sudo cp customize.dist/src/less2/include/colortheme-dark.less customize/src/less2/include/
sudo chown -R 4001:4001 customize/src/

sudo docker compose restart

# Container
sudo sed -i 's^foo.com^bar.com^g' config/config.js
sudo sed -i 's^foo.com^bar.com^g' docker-compose.yml
sudo docker compose restart

# Webserver
sudo cp /etc/nginx/sites-available/office.foo.com.conf /etc/nginx/sites-available/office.bar.com.conf
sudo sed -i 's^foo.com^bar.com^g' /etc/nginx/sites-available/office.bar.com.conf
sudo ln -s /etc/nginx/sites-available/office.bar.com.conf /etc/nginx/sites-enabled/
sudo service nginx stop
sudo certbot certonly --standalone -d office.bar.com -d sandbox.office.bar.com
sudo nginx -t
sudo service nginx start