# Phase-one scaffold, NOT deployed. Independent of occ-app/occ-chat/occ-tube.
# See README.md: admission checks are mandatory before accepting user uploads.
name: occ-files

x-runtime: &runtime
  restart: unless-stopped
  logging:
    driver: local
    options: { max-size: "10m", max-file: "3" }
  networks: [files]

services:
  ocis:
    <<: *runtime
    image: ${OCIS_IMAGE:?set an approved oCIS image digest}
    # Initialize privately once with `run --rm ocis init`; fail on absent config.
    command: [server]
    user: "1000"
    environment:
      HOME: /var/lib/ocis
      OCIS_CONFIG_DIR: /etc/ocis
      OCIS_URL: ${FILES_PUBLIC_URL:?}
      # The gateway advertises OCIS_URL/data as the upload endpoint to ocdav;
      # keep that hop on-loopback so writes survive public-edge outages.
      GATEWAY_FRONTEND_PUBLIC_URL: http://localhost:9200
      OCIS_INSECURE: "false"
      OCIS_JWT_SECRET: ${OCIS_JWT_SECRET:?}
      IDM_ADMIN_PASSWORD: ${OCIS_ADMIN_PASSWORD:?}
      IDM_CREATE_DEMO_USERS: "false"
      PROXY_TLS: "false" # host-side Tunnel terminates public TLS
      PROXY_HTTP_ADDR: 0.0.0.0:9200
      PROXY_ENABLE_BASIC_AUTH: "true"
      PROXY_CSP_CONFIG_FILE_LOCATION: /etc/ocis/csp.yaml
      OFFICE_HOST: ${OFFICE_HOST:?}
      STORAGE_USERS_DRIVER: s3ng
      STORAGE_USERS_S3NG_ROOT: /var/lib/ocis/storage/users
      STORAGE_USERS_S3NG_ENDPOINT: ${FILES_R2_ENDPOINT:?set the HTTPS account R2 endpoint}
      STORAGE_USERS_S3NG_REGION: auto
      STORAGE_USERS_S3NG_BUCKET: ${FILES_R2_BUCKET:?dedicated files bucket only}
      STORAGE_USERS_S3NG_ACCESS_KEY: ${FILES_R2_ACCESS_KEY:?bucket-scoped files key}
      STORAGE_USERS_S3NG_SECRET_KEY: ${FILES_R2_SECRET_KEY:?}
      OCIS_MAX_CONCURRENCY: "1"
      OCIS_ASYNC_UPLOADS: "false"
      # No previews/content extraction in phase one: they are payload derivatives.
      OCIS_EXCLUDE_RUN_SERVICES: thumbnails
      THUMBNAILS_FILESYSTEMSTORAGE_ROOT: /tmp/thumbnails
      GATEWAY_GRPC_ADDR: 0.0.0.0:9142
      MICRO_REGISTRY_ADDRESS: 127.0.0.1:9233
      NATS_NATS_HOST: 0.0.0.0
      NATS_NATS_PORT: "9233"
    ports: ["9200:9200"]
    volumes:
      - ocis-config:/etc/ocis
      - ocis-metadata:/var/lib/ocis
      - ./csp.yaml:/etc/ocis/csp.yaml:ro
    # Defense against upload staging spilling into the metadata volume.
    # Verify actual paths for the chosen release, including partial TUS uploads.
    tmpfs:
      - /tmp:size=268435456,mode=1777
      - /var/lib/ocis/storage/users/uploads:size=268435456,uid=1000,gid=1000,mode=0700
    mem_limit: 1536m
    cpus: 1.0

  collaboration:
    <<: *runtime
    profiles: [docs]
    image: ${OCIS_IMAGE:?}
    command: [collaboration, server]
    depends_on:
      - ocis
      - collabora
    environment:
      OCIS_URL: ${FILES_PUBLIC_URL:?}
      OCIS_JWT_SECRET: ${OCIS_JWT_SECRET:?}
      # Must be the registry service name (looked up via MICRO_REGISTRY), NOT host:port.
      # Reva pool.GetService() -> 'com.owncloud.api.gateway'; host:port values are only
      # honored with an explicit dns:/unix:/kubernetes: URI scheme prefix.
      OCIS_REVA_GATEWAY: com.owncloud.api.gateway
      MICRO_REGISTRY: nats-js-kv
      MICRO_REGISTRY_ADDRESS: ocis:9233
      COLLABORATION_STORE_NODES: ocis:9233
      COLLABORATION_GRPC_ADDR: 0.0.0.0:9301
      COLLABORATION_HTTP_ADDR: 0.0.0.0:9300
      COLLABORATION_WOPI_SRC: http://collaboration:9300
      COLLABORATION_WOPI_SECRET: ${COLLABORATION_WOPI_SECRET:?}
      COLLABORATION_APP_NAME: CollaboraOnline
      COLLABORATION_APP_PRODUCT: Collabora
      COLLABORATION_APP_ADDR: ${OFFICE_PUBLIC_URL:?}
      COLLABORATION_APP_INSECURE: "false"
      COLLABORATION_APP_PROOF_DISABLE: "false"
      COLLABORATION_CS3API_DATAGATEWAY_INSECURE: "false"
    volumes: [ocis-config:/etc/ocis:ro]
    tmpfs: ["/tmp:size=67108864,mode=1777"]
    mem_limit: 256m
    cpus: 0.25

  collabora:
    <<: *runtime
    profiles: [docs]
    image: ${COLLABORA_IMAGE:?set an approved Collabora image digest}
    environment:
      DONT_GEN_SSL_CERT: "YES"
      aliasgroup1: http://collaboration:9300
      username: ${COLLABORA_ADMIN_USER:?}
      password: ${COLLABORA_ADMIN_PASSWORD:?}
      extra_params: >-
        --o:ssl.enable=false
        --o:ssl.termination=true
        --o:net.frame_ancestors=${FILES_HOST:?}
        --o:welcome.enable=false
    cap_add: [MKNOD]
    ports: ["9980:9980"]
    volumes:
      - type: bind
        source: ${COLLABORA_PROOF_KEY_FILE:?private existing proof key file}
        target: /etc/coolwsd/proof_key
        read_only: true
        bind: { create_host_path: false }
    # No persistent document volume; jail/temp writes consume RAM, counted in limit.
    tmpfs:
      - /tmp:size=268435456,mode=1777
      - /opt/cool/child-roots:size=1073741824,mode=1777
    mem_limit: 2560m
    cpus: 1.5

# ONLY config + POSIX metadata/state. Audit their contents before opening uploads.
volumes:
  ocis-config:
  ocis-metadata:
networks:
  files: