hacklab/T-HUB
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Track the files scaffold; sync deployed oCIS compose requirements

Browse source 
infra/occupymedia/files/ was gitignored in phase one ('nothing deployed');
the oCIS deployment is now live, and the storage doc + DEPLOY.md link to its
runbook. Track the secret-free scaffold (compose.yml, csp.yaml, README,
tuwunel example, .env.example); keep only .env + secrets/ ignored.

compose.yml carries the deployment-proven fixes: ocis runs as user 1000 with
OCIS_CONFIG_DIR=/etc/ocis and HOME=/var/lib/ocis (source-built images do not
inherit the official image's conventions), and 9200/9980 publish on the LAN
for the CT150 tunnel connector.
This commit is contained in:
glass beadian 2026-10-11 07:51:59 +00:00
parent fc5f94400f
commit 6cdffa60b2
6 changed files with 382 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

37
infra/occupymedia/files/.env.example Normal file
View file

@ -0,0 +1,37 @@
# Standalone occ-files scaffold. Empty values are intentional deployment gates.
# Keep filled .env private (gitignored). Never copy app/Matrix R2 keys here.
# Pin approved release images by digest; research proposes oCIS 8.2.1.
OCIS_IMAGE=
COLLABORA_IMAGE=
FILES_PUBLIC_URL=https://files.occupymedia.cc
OFFICE_PUBLIC_URL=https://office.occupymedia.cc
FILES_HOST=files.occupymedia.cc
OFFICE_HOST=office.occupymedia.cc
FILES_R2_ENDPOINT=
FILES_R2_BUCKET=occupymedia-files-blobs
FILES_R2_ACCESS_KEY=
FILES_R2_SECRET_KEY=
# Dedicated existing buckets; contracts only, not consumed by this compose.
MATRIX_R2_BUCKET=occupymedia-matrix-media
S3_BUCKET=occupymedia-media-encrypted
PEERTUBE_VIDEO_BUCKET=occupymedia-peertube-videos
PEERTUBE_PLAYLIST_BUCKET=occupymedia-peertube-playlists
FILES_RESERVED_BUCKETS=occupymedia-peertube-videos,occupymedia-peertube-playlists
# Generate/store privately on the target. Same JWT in oCIS and collaboration.
OCIS_JWT_SECRET=
OCIS_ADMIN_PASSWORD=
COLLABORATION_WOPI_SECRET=
COLLABORA_ADMIN_USER=
COLLABORA_ADMIN_PASSWORD=
# Absolute existing regular file outside this repository; required for CODE 26+.
COLLABORA_PROOF_KEY_FILE=
# Reserved for a later implemented bot. Do not start a bot from this scaffold.
HUB_ARCHIVE_HOMESERVER_URL=https://chat.occupymedia.cc
HUB_ARCHIVE_ACCESS_TOKEN=
HUB_ARCHIVE_OCIS_SERVICE_TOKEN=
HUB_ARCHIVE_MAX_BYTES=20971520
HUB_ARCHIVE_CONCURRENCY=1
# Room -> workspace/group/Space/folder mapping comes from an ACL-controlled store.
# Pad uploads/text/revisions must have an R2 adapter before this boundary opens.
PADS_ENABLED=false
PADS_PUBLIC_URL=https://pads.occupymedia.cc