LeoVasanko
3d8e20de8f
- docker-compose: attach the OnlyOffice container to the internal-only oonet network (fixed name matching mediapreview's OO_NETWORK, fixed container IP 172.30.0.2); no published ports, no outbound internet. - --oosetup prints ONLYOFFICE_JWT_SECRET=<key> at the end regardless of build outcome (the secret is deterministically derived from config).
47 lines
1.6 KiB
YAML
47 lines
1.6 KiB
YAML
services:
|
|
onlyoffice:
|
|
build:
|
|
context: ./mediapreview/mediapreview/docker
|
|
args:
|
|
ONLYOFFICE_VERSION: "9.3.1"
|
|
container_name: onlyoffice
|
|
# No published ports: Docker discards them on internal networks anyway.
|
|
# The host reaches the container at its fixed IP (172.30.0.2).
|
|
environment:
|
|
# Number of converter workers (default 8).
|
|
# Set to your CPU count or slightly below.
|
|
- WORKERS
|
|
# JWT secret shared with Cista.
|
|
# OnlyOffice reads it as JWT_SECRET; Cista reads it as ONLYOFFICE_JWT_SECRET.
|
|
# We use ONLYOFFICE_JWT_SECRET as the canonical name so you only set one variable.
|
|
- JWT_SECRET=${ONLYOFFICE_JWT_SECRET}
|
|
- JWT_ENABLED=true
|
|
- JWT_HEADER=Authorization
|
|
volumes:
|
|
# Persist fonts and generated caches across restarts
|
|
- onlyoffice-data:/var/www/onlyoffice/Data
|
|
- onlyoffice-lib:/var/lib/onlyoffice
|
|
networks:
|
|
# Fully isolated: no outbound internet, container can only reach the
|
|
# host on this bridge (needed for the preview file callback).
|
|
oonet:
|
|
# Fixed IP matching mediapreview's OO_CONTAINER_IP.
|
|
ipv4_address: 172.30.0.2
|
|
restart: unless-stopped
|
|
|
|
networks:
|
|
oonet:
|
|
# Fixed name (no compose project prefix) so it matches mediapreview's
|
|
# OO_NETWORK and the container setup done by `cista --oosetup`.
|
|
name: oonet
|
|
internal: true
|
|
# Pin the subnet so the gateway (and thus the auto-detected callback
|
|
# host) is stable: the host is always 172.30.0.1.
|
|
ipam:
|
|
config:
|
|
- subnet: 172.30.0.0/24
|
|
|
|
volumes:
|
|
onlyoffice-data:
|
|
onlyoffice-lib:
|