glass beadian
6cdffa60b2
infra/occupymedia/files/ was gitignored in phase one ('nothing deployed');
the oCIS deployment is now live, and the storage doc + DEPLOY.md link to its
runbook. Track the secret-free scaffold (compose.yml, csp.yaml, README,
tuwunel example, .env.example); keep only .env + secrets/ ignored.
compose.yml carries the deployment-proven fixes: ocis runs as user 1000 with
OCIS_CONFIG_DIR=/etc/ocis and HOME=/var/lib/ocis (source-built images do not
inherit the official image's conventions), and 9200/9980 publish on the LAN
for the CT150 tunnel connector.
37 lines
1.6 KiB
Text
37 lines
1.6 KiB
Text
# Standalone occ-files scaffold. Empty values are intentional deployment gates.
|
|
# Keep filled .env private (gitignored). Never copy app/Matrix R2 keys here.
|
|
# Pin approved release images by digest; research proposes oCIS 8.2.1.
|
|
OCIS_IMAGE=
|
|
COLLABORA_IMAGE=
|
|
FILES_PUBLIC_URL=https://files.occupymedia.cc
|
|
OFFICE_PUBLIC_URL=https://office.occupymedia.cc
|
|
FILES_HOST=files.occupymedia.cc
|
|
OFFICE_HOST=office.occupymedia.cc
|
|
FILES_R2_ENDPOINT=
|
|
FILES_R2_BUCKET=occupymedia-files-blobs
|
|
FILES_R2_ACCESS_KEY=
|
|
FILES_R2_SECRET_KEY=
|
|
# Dedicated existing buckets; contracts only, not consumed by this compose.
|
|
MATRIX_R2_BUCKET=occupymedia-matrix-media
|
|
S3_BUCKET=occupymedia-media-encrypted
|
|
PEERTUBE_VIDEO_BUCKET=occupymedia-peertube-videos
|
|
PEERTUBE_PLAYLIST_BUCKET=occupymedia-peertube-playlists
|
|
FILES_RESERVED_BUCKETS=occupymedia-peertube-videos,occupymedia-peertube-playlists
|
|
# Generate/store privately on the target. Same JWT in oCIS and collaboration.
|
|
OCIS_JWT_SECRET=
|
|
OCIS_ADMIN_PASSWORD=
|
|
COLLABORATION_WOPI_SECRET=
|
|
COLLABORA_ADMIN_USER=
|
|
COLLABORA_ADMIN_PASSWORD=
|
|
# Absolute existing regular file outside this repository; required for CODE 26+.
|
|
COLLABORA_PROOF_KEY_FILE=
|
|
# Reserved for a later implemented bot. Do not start a bot from this scaffold.
|
|
HUB_ARCHIVE_HOMESERVER_URL=https://chat.occupymedia.cc
|
|
HUB_ARCHIVE_ACCESS_TOKEN=
|
|
HUB_ARCHIVE_OCIS_SERVICE_TOKEN=
|
|
HUB_ARCHIVE_MAX_BYTES=20971520
|
|
HUB_ARCHIVE_CONCURRENCY=1
|
|
# Room -> workspace/group/Space/folder mapping comes from an ACL-controlled store.
|
|
# Pad uploads/text/revisions must have an R2 adapter before this boundary opens.
|
|
PADS_ENABLED=false
|
|
PADS_PUBLIC_URL=https://pads.occupymedia.cc
|