To build WSD we first need to build the libreofficekit.
It is important to checkout the appropriate branches and tags in both repos that match.

Libreoffice: https://wiki.documentfoundation.org/Development/BuildingOnLinux
# install dependencies
cd projects
git clone https://gerrit.libreoffice.org/core libreoffice
cd libreoffice
git checkout cp-23.05.1-2
# keep in mind that a build without gui can't run "make check" as of yet, it does not select/run tests accordingly
./autogen.sh --disable-gui --without-doxygen
# arch: ./autogen.sh --disable-gui --without-doxygen --without-junit --without-system-libxml --without-system-gpgmepp --disable-postgresql-sdbc --disable-mariadb-sdbc
#./autogen.sh --without-doxygen
make -j 5
make check
sudo mkdir /opt/collab
sudo cp -r instdir /opt/collab/office
sudo cp -r include /opt/collab/office/include

CollaboraOnline https://collaboraonline.github.io/post/build-code/#build-code-n-lo
# install dependencies (poco)
cd projects
git clone https://github.com/CollaboraOnline/online.git collabora-online
cd collabora-online
git checkout cp-23.05.1-2
# Add CXXFLAGS="$CXXFLAGS -Wno-deprecated-declarations" to configure.ac if poco is too new (make will complain -Werror=deprecated-declarations)
./autogen.sh
# TESTS: To run tests remove the --disable-tests and add --enable-debug and run "make check" after make
./configure --prefix=/opt/collab/wsd \
            --with-poco-includes=/usr/local/include --with-poco-libs=/usr/local/lib \
            --with-app-name="Nano Editor" --with-vendor="Clarabot Zrt" --with-info-url="https://clarabot.com" \
            --with-lokit-path=/opt/collab/office/include --with-lo-path=/opt/collab/office \
            --with-max-connections=8 --with-max-documents=8 \
            --disable-bundle --disable-tests

# NOTE: make will ask sudo password during build for CAP_SYS_CHROOT
make -j6
sudo make install
sudo mkdir -p /opt/collab/jail/child-roots
sudo chown cool:cool /opt/collab/jail
sudo chown cool:cool /opt/collab/jail/child-roots
sudo /opt/collab/wsd/bin/coolwsd-systemplate-setup /opt/collab/jail/systemplate /opt/collab/office
sudo /opt/collab/wsd/bin/coolwsd-generate-proof-key /opt/collab/wsd/etc/coolwsd
sudo setcap cap_fowner,cap_chown,cap_mknod,cap_sys_chroot=ep /opt/collab/wsd/bin/coolforkit-caps
sudo setcap cap_sys_admin=ep /opt/collab/wsd/bin/coolmount

Run with for initial test:
sudo -u cool /opt/collab/wsd/bin/coolwsd --o:sys_template_path=/opt/collab/jail/systemplate --o:child_root_path=/opt/collab/jail/child-roots --o:file_server_root_path=/opt/collab/wsd/share/coolwsd

Adjust configs for browser freeze:
    sys_template_path -> /opt/collab/jail/systemplate
    child_root_path -> /opt/collab/jail/child-roots
    server_name -> doc.clarabot.com
    file_server_root_path -> /opt/collab/wsd/share/coolwsd
    hexify_embedded_urls -> true
    memproportion -> 50.0
    net/proto -> IPv4
    net/listen -> loopback
    net/content_security_policy -> TODO
    net/frame_ancestors -> https://nano.clarabot.com
    ssl/enable -> false
    ssl/termination -> true
    user_interface/mode -> TODO?
    user_interface/brandProductName -> Clarabot Nano Online Editor
    user_interface/brandProductURL -> https://www.clarabot.com
    zotero/enable -> false
    document_signing/enable -> false
For "native" test: http://127.0.0.1:9980/browser/<hash>/cool.html
    server_name -> 127.0.0.1:9980
    ssl/termination -> false
For "direct" test: http://127.0.0.1:9981/browser/<hash>/cool.html
    server_name -> 127.0.0.1:9980
    ssl/termination -> false
For "frame" test: http://127.0.0.1:9981/app.html frames http://127.0.0.1:9981/browser/<hash>/cool.html
    server_name -> doc.clarabot.com
    ssl/termination -> true
    net/frame_ancestors -> http://127.0.0.1:9981

Run with:
sudo -u cool /opt/collab/wsd/bin/coolwsd

SystemD service:
[Unit]
Description=Collabora Online WebSocket Daemon
After=network.target

[Service]
ExecStart=/opt/collab/wsd/bin/coolwsd --version
KillSignal=SIGINT
TimeoutStopSec=120
User=cool
KillMode=control-group
Restart=always
LimitNOFILE=infinity:infinity

ProtectSystem=strict
ReadWritePaths=/opt/collab/jail /var/log

ProtectHome=yes
PrivateTmp=yes
ProtectControlGroups=yes
CapabilityBoundingSet=CAP_FOWNER CAP_CHOWN CAP_MKNOD CAP_SYS_CHROOT CAP_SYS_ADMIN

[Install]
WantedBy=multi-user.target
