LibreOffice WASM and https on Docker

[he-pennypacker]

Hi there. While trying to figure out why my Word to PDF conversion was failing, I stumbled across this in the docs:

The page must also be served from a secure context. http://localhost works for local testing, but http://192.168.x.x or other LAN IPs usually do not qualify, so Office conversion over plain HTTP will fail even if the headers are present.

I am assuming this is the reason why the Word to PDF conversion fails with:

An error occurred during conversion. Error: WASM initialization timeout

Two questions:

1. Is the Word to PDF conversion failing because my page is only served over HTTP?
2. Is it left up to the reader to work out how to serve BentoPDF over HTTPS? I am using plain Docker on a ubuntu host which I access over the LAN with no reverse proxy etc.

[alam00000]

1. Yes, that's exactly the cause. Word to PDF uses LibreOffice compiled to WebAssembly, which depends on SharedArrayBuffer for its worker threads. Without SharedArrayBuffer, the LibreOffice worker never finishes initialising and you get the "WASM initialization timeout" you're seeing. Other tools (PDF merge, split, compress, OCR) don't depend on SharedArrayBuffer, which is why they keep working over plain LAN HTTP.

2. Also Yes for now, the Docker image only ships plain HTTP nginx, so HTTPS termination is on the operator. The fastest path on Ubuntu is to put Caddy in front:

sudo apt install caddy

Caddyfile :


bentopdf.local {
    tls internal
    reverse_proxy localhost:8080
}

Add bentopdf.local to /etc/hosts on each device that needs access (pointing at your Ubuntu host's IP), visit https://bentopdf.local, accept the local-cert warning once, and Word to PDF will start working. If you want a real public-CA cert without opening any firewall ports, Tailscale Funnel or a Cloudflare Tunnel also works and takes about 5 minutes. The COOP/COEP headers Word→PDF needs (Cross-Origin-Opener-Policy: same-origin, Cross-Origin-Embedder-Policy: credentialless) are already set by the BentoPDF nginx by default, so you don't need to configure those.

Now having said that, This has been a recurring point of friction for self hosters, so over the coming week I'll be making the self hosting story significantly easier with better docs, an HTTPS-ready Docker variant, and clearer troubleshooting for the secure context / reverse-proxy issues people keep running into. Thanks for the patience while I improve it.

[he-pennypacker]

Nice one. Thanks for the comprehensive reply 🙂

Looking forward to the updated docker image when it's ready.