glass beadian
688a2ce996
The group-files api and the archive bot authenticate to oCIS WebDAV with basic credentials (admin until a dedicated service user exists). The proxy is LAN-published only; no WAN forward exists.
128 lines
4.6 KiB
YAML
128 lines
4.6 KiB
YAML
# Phase-one scaffold, NOT deployed. Independent of occ-app/occ-chat/occ-tube.
|
|
# See README.md: admission checks are mandatory before accepting user uploads.
|
|
name: occ-files
|
|
|
|
x-runtime: &runtime
|
|
restart: unless-stopped
|
|
logging:
|
|
driver: local
|
|
options: { max-size: "10m", max-file: "3" }
|
|
networks: [files]
|
|
|
|
services:
|
|
ocis:
|
|
<<: *runtime
|
|
image: ${OCIS_IMAGE:?set an approved oCIS image digest}
|
|
# Initialize privately once with `run --rm ocis init`; fail on absent config.
|
|
command: [server]
|
|
user: "1000"
|
|
environment:
|
|
HOME: /var/lib/ocis
|
|
OCIS_CONFIG_DIR: /etc/ocis
|
|
OCIS_URL: ${FILES_PUBLIC_URL:?}
|
|
OCIS_INSECURE: "false"
|
|
OCIS_JWT_SECRET: ${OCIS_JWT_SECRET:?}
|
|
IDM_ADMIN_PASSWORD: ${OCIS_ADMIN_PASSWORD:?}
|
|
IDM_CREATE_DEMO_USERS: "false"
|
|
PROXY_TLS: "false" # host-side Tunnel terminates public TLS
|
|
PROXY_HTTP_ADDR: 0.0.0.0:9200
|
|
PROXY_ENABLE_BASIC_AUTH: "true"
|
|
PROXY_CSP_CONFIG_FILE_LOCATION: /etc/ocis/csp.yaml
|
|
OFFICE_HOST: ${OFFICE_HOST:?}
|
|
STORAGE_USERS_DRIVER: s3ng
|
|
STORAGE_USERS_S3NG_ROOT: /var/lib/ocis/storage/users
|
|
STORAGE_USERS_S3NG_ENDPOINT: ${FILES_R2_ENDPOINT:?set the HTTPS account R2 endpoint}
|
|
STORAGE_USERS_S3NG_REGION: auto
|
|
STORAGE_USERS_S3NG_BUCKET: ${FILES_R2_BUCKET:?dedicated files bucket only}
|
|
STORAGE_USERS_S3NG_ACCESS_KEY: ${FILES_R2_ACCESS_KEY:?bucket-scoped files key}
|
|
STORAGE_USERS_S3NG_SECRET_KEY: ${FILES_R2_SECRET_KEY:?}
|
|
OCIS_MAX_CONCURRENCY: "1"
|
|
OCIS_ASYNC_UPLOADS: "false"
|
|
# No previews/content extraction in phase one: they are payload derivatives.
|
|
OCIS_EXCLUDE_RUN_SERVICES: thumbnails
|
|
THUMBNAILS_FILESYSTEMSTORAGE_ROOT: /tmp/thumbnails
|
|
GATEWAY_GRPC_ADDR: 0.0.0.0:9142
|
|
MICRO_REGISTRY_ADDRESS: 127.0.0.1:9233
|
|
NATS_NATS_HOST: 0.0.0.0
|
|
NATS_NATS_PORT: "9233"
|
|
ports: ["9200:9200"]
|
|
volumes:
|
|
- ocis-config:/etc/ocis
|
|
- ocis-metadata:/var/lib/ocis
|
|
- ./csp.yaml:/etc/ocis/csp.yaml:ro
|
|
# Defense against upload staging spilling into the metadata volume.
|
|
# Verify actual paths for the chosen release, including partial TUS uploads.
|
|
tmpfs:
|
|
- /tmp:size=268435456,mode=1777
|
|
- /var/lib/ocis/storage/users/uploads:size=268435456,uid=1000,gid=1000,mode=0700
|
|
mem_limit: 1536m
|
|
cpus: 1.0
|
|
|
|
collaboration:
|
|
<<: *runtime
|
|
profiles: [docs]
|
|
image: ${OCIS_IMAGE:?}
|
|
command: [collaboration, server]
|
|
depends_on:
|
|
- ocis
|
|
- collabora
|
|
environment:
|
|
OCIS_URL: ${FILES_PUBLIC_URL:?}
|
|
OCIS_JWT_SECRET: ${OCIS_JWT_SECRET:?}
|
|
# Must be the registry service name (looked up via MICRO_REGISTRY), NOT host:port.
|
|
# Reva pool.GetService() -> 'com.owncloud.api.gateway'; host:port values are only
|
|
# honored with an explicit dns:/unix:/kubernetes: URI scheme prefix.
|
|
OCIS_REVA_GATEWAY: com.owncloud.api.gateway
|
|
MICRO_REGISTRY: nats-js-kv
|
|
MICRO_REGISTRY_ADDRESS: ocis:9233
|
|
COLLABORATION_STORE_NODES: ocis:9233
|
|
COLLABORATION_GRPC_ADDR: 0.0.0.0:9301
|
|
COLLABORATION_HTTP_ADDR: 0.0.0.0:9300
|
|
COLLABORATION_WOPI_SRC: http://collaboration:9300
|
|
COLLABORATION_WOPI_SECRET: ${COLLABORATION_WOPI_SECRET:?}
|
|
COLLABORATION_APP_NAME: CollaboraOnline
|
|
COLLABORATION_APP_PRODUCT: Collabora
|
|
COLLABORATION_APP_ADDR: ${OFFICE_PUBLIC_URL:?}
|
|
COLLABORATION_APP_INSECURE: "false"
|
|
COLLABORATION_APP_PROOF_DISABLE: "false"
|
|
COLLABORATION_CS3API_DATAGATEWAY_INSECURE: "false"
|
|
volumes: [ocis-config:/etc/ocis:ro]
|
|
tmpfs: ["/tmp:size=67108864,mode=1777"]
|
|
mem_limit: 256m
|
|
cpus: 0.25
|
|
|
|
collabora:
|
|
<<: *runtime
|
|
profiles: [docs]
|
|
image: ${COLLABORA_IMAGE:?set an approved Collabora image digest}
|
|
environment:
|
|
DONT_GEN_SSL_CERT: "YES"
|
|
aliasgroup1: http://collaboration:9300
|
|
username: ${COLLABORA_ADMIN_USER:?}
|
|
password: ${COLLABORA_ADMIN_PASSWORD:?}
|
|
extra_params: >-
|
|
--o:ssl.enable=false
|
|
--o:ssl.termination=true
|
|
--o:net.frame_ancestors=${FILES_HOST:?}
|
|
--o:welcome.enable=false
|
|
cap_add: [MKNOD]
|
|
ports: ["9980:9980"]
|
|
volumes:
|
|
- type: bind
|
|
source: ${COLLABORA_PROOF_KEY_FILE:?private existing proof key file}
|
|
target: /etc/coolwsd/proof_key
|
|
read_only: true
|
|
bind: { create_host_path: false }
|
|
# No persistent document volume; jail/temp writes consume RAM, counted in limit.
|
|
tmpfs:
|
|
- /tmp:size=268435456,mode=1777
|
|
- /opt/cool/child-roots:size=1073741824,mode=1777
|
|
mem_limit: 2560m
|
|
cpus: 1.5
|
|
|
|
# ONLY config + POSIX metadata/state. Audit their contents before opening uploads.
|
|
volumes:
|
|
ocis-config:
|
|
ocis-metadata:
|
|
networks:
|
|
files:
|