services:
  onlyoffice:
    build:
      context: ./mediapreview/mediapreview/docker
      args:
        ONLYOFFICE_VERSION: "9.3.1"
    container_name: onlyoffice
    # No published ports: Docker discards them on internal networks anyway.
    # The host reaches the container at its fixed IP (172.30.0.2).
    environment:
      # Number of converter workers (default 8).
      # Set to your CPU count or slightly below.
      - WORKERS
      # JWT secret shared with Cista.
      # OnlyOffice reads it as JWT_SECRET; Cista reads it as ONLYOFFICE_JWT_SECRET.
      # We use ONLYOFFICE_JWT_SECRET as the canonical name so you only set one variable.
      - JWT_SECRET=${ONLYOFFICE_JWT_SECRET}
      - JWT_ENABLED=true
      - JWT_HEADER=Authorization
    volumes:
      # Persist fonts and generated caches across restarts
      - onlyoffice-data:/var/www/onlyoffice/Data
      - onlyoffice-lib:/var/lib/onlyoffice
    networks:
      # Fully isolated: no outbound internet, container can only reach the
      # host on this bridge (needed for the preview file callback).
      oonet:
        # Fixed IP matching mediapreview's OO_CONTAINER_IP.
        ipv4_address: 172.30.0.2
    restart: unless-stopped

networks:
  oonet:
    # Fixed name (no compose project prefix) so it matches mediapreview's
    # OO_NETWORK and the container setup done by `cista --oosetup`.
    name: oonet
    internal: true
    # Pin the subnet so the gateway (and thus the auto-detected callback
    # host) is stable: the host is always 172.30.0.1.
    ipam:
      config:
        - subnet: 172.30.0.0/24

volumes:
  onlyoffice-data:
  onlyoffice-lib: