security an collabora code /hosting/discovery etc....

[chrismaster]

I tried Collabora CODE with podman and it works, looks great. Thx!
Are there some docs about security.
https://mydomain:9980 is open to the world. Behind a proxy, but everyone can access mydomain:9980/hosting/discovery
Acces sites like https://mydomain:9980/cool/getMetrics and https://mydomain:9980/browser/dist/admin/admin.html are secured by basic auth. Without user/password, there is no access. (I think :-) )
With aliasgroup i set the wopiserver and net.frame_ancestors who is allowed to embed in frame.
Is this the way it works, or do I have to secure it some more, that no unwanted service is using my collabora service in their environment or does some harmful stuff.
Thx
Chris

[vmiklos]

Just pointing out that the main forum for COOL is https://forum.collaboraonline.com/, you might want to ask there if you get no reply here.