onlyoffice: isolated oonet network in compose; print JWT secret from --oosetup

- docker-compose: attach the OnlyOffice container to the internal-only
  oonet network (fixed name matching mediapreview's OO_NETWORK, fixed
  container IP 172.30.0.2); no published ports, no outbound internet.
- --oosetup prints ONLYOFFICE_JWT_SECRET=<key> at the end regardless of
  build outcome (the secret is deterministically derived from config).

cista/onlyoffice.py

@@ -6,6 +6,7 @@ only bridges cista's config-derived JWT secret into it and wires the
 """
 
 import os
+import sys
 from pathlib import Path
 
 import mediapreview.office
@@ -36,4 +37,11 @@ def setup_docker(confdir: Path | None = None) -> str:
             }
         )
     configure()
-    return mediapreview.office.setup_docker()
+    try:
+        return mediapreview.office.setup_docker()
+    finally:
+        # Print regardless of build outcome: the secret is deterministic
+        # (derived from the config).
+        sys.stdout.write(
+            f"ONLYOFFICE_JWT_SECRET={os.environ['ONLYOFFICE_JWT_SECRET']}\n"
+        )

docker-compose.yml

@@ -5,8 +5,8 @@ services:
       args:
         ONLYOFFICE_VERSION: "9.3.1"
     container_name: onlyoffice
-    ports:
-      - "8080:80"
+    # No published ports: Docker discards them on internal networks anyway.
+    # The host reaches the container at its fixed IP (172.30.0.2).
     environment:
       # Number of converter workers (default 8).
       # Set to your CPU count or slightly below.
@@ -21,8 +21,26 @@ services:
       # Persist fonts and generated caches across restarts
       - onlyoffice-data:/var/www/onlyoffice/Data
       - onlyoffice-lib:/var/lib/onlyoffice
+    networks:
+      # Fully isolated: no outbound internet, container can only reach the
+      # host on this bridge (needed for the preview file callback).
+      oonet:
+        # Fixed IP matching mediapreview's OO_CONTAINER_IP.
+        ipv4_address: 172.30.0.2
     restart: unless-stopped
 
+networks:
+  oonet:
+    # Fixed name (no compose project prefix) so it matches mediapreview's
+    # OO_NETWORK and the container setup done by `cista --oosetup`.
+    name: oonet
+    internal: true
+    # Pin the subnet so the gateway (and thus the auto-detected callback
+    # host) is stable: the host is always 172.30.0.1.
+    ipam:
+      config:
+        - subnet: 172.30.0.0/24
+
 volumes:
   onlyoffice-data:
   onlyoffice-lib: