urko/selfhosted-owncloud
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat: use specific version and add anubis

Browse Source
This commit is contained in:
Urko
2026-09-02 14:42:33 -06:00
parent 2f02405ce7
commit 7d1d044cf4
2 changed files with 251 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-stack.yml
+227 -67
View File
@@ -1,8 +1,45 @@
version: "3.7"
services:
anubis:
image: ghcr.io/techarohq/anubis:v1.24.0
networks:
- ocis-net
environment:
- BIND=:8080
- 'TARGET= ' # IMPORTANTE: un espacio tras el '='
- PUBLIC_URL=https://${ANUBIS_DOMAIN}
- COOKIE_DOMAIN=${ANUBIS_COOKIE_DOMAIN}
- REDIRECT_DOMAINS=${ANUBIS_REDIRECT_DOMAINS}
deploy:
labels:
- "traefik.enable=true"
- "traefik.docker.network=ocis-net"
# Router para acceder a Anubis
- "traefik.http.routers.anubis.entrypoints=https"
- "traefik.http.routers.anubis.rule=Host(`${ANUBIS_DOMAIN}`)"
- "traefik.http.routers.anubis.tls.certresolver=http"
- "traefik.http.services.anubis.loadbalancer.server.port=8080"
# Middleware ForwardAuth
- "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check"
- "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true"
restart_policy:
condition: on-failure
delay: 5s
max_attempts: 3
update_config:
parallelism: 1
delay: 10s
order: start-first
failure_action: rollback
monitor: 30s
rollback_config:
parallelism: 1
order: stop-first
traefik:
image: traefik:v2.9.1
image: traefik:v3.6.7
networks:
ocis-net:
aliases:
@@ -11,6 +48,9 @@ services:
- ${COLLABORA_DOMAIN}
- ${ONLYOFFICE_DOMAIN}
command:
# allow big uploads with slow clients
- "--entrypoints.http.transport.respondingtimeouts.readtimeout=0"
- "--entrypoints.https.transport.respondingtimeouts.readtimeout=0"
- "--log.level=${TRAEFIK_LOG_LEVEL:-ERROR}"
# letsencrypt configuration
- "--certificatesResolvers.http.acme.email=${TRAEFIK_ACME_MAIL}"
@@ -23,16 +63,27 @@ services:
- "--entryPoints.http.http.redirections.entryPoint.to=https"
- "--entryPoints.http.http.redirections.entryPoint.scheme=https"
- "--entryPoints.https.address=:443"
- "--entryPoints.https.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
- "--entryPoints.http.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
# docker provider (get configuration from container labels)
- "--providers.docker.endpoint=unix:///var/run/docker.sock"
- "--providers.docker.exposedByDefault=false"
- "--providers.swarm.endpoint=unix:///var/run/docker.sock"
- "--providers.swarm.exposedByDefault=false"
- "--providers.swarm.network=ocis-net"
# TODO: will remove this after changing all the label syntax
- "--core.defaultRuleSyntax=v2"
# access log
- "--accessLog=true"
- "--accessLog.format=json"
- "--accessLog.fields.headers.names.X-Request-Id=keep"
ports:
- "80:80"
- "443:443"
- target: 80
published: 80
protocol: tcp
mode: host
- target: 443
published: 443
protocol: tcp
mode: host
volumes:
- "/var/run/docker.sock:/var/run/docker.sock:ro"
- "certs:/certs"
@@ -40,23 +91,37 @@ services:
driver: "local"
deploy:
labels:
- "traefik.enable=${TRAEFIK_DASHBOARD}"
- "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_BASIC_AUTH_USERS}" # defaults to admin:admin
- "traefik.http.routers.traefik.entrypoints=https"
- "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN}`)"
- "traefik.http.routers.traefik.middlewares=traefik-auth"
- "traefik.http.routers.traefik.tls.certresolver=http"
- "traefik.http.routers.traefik.service=api@internal"
- "traefik.enable=${TRAEFIK_DASHBOARD}"
- "traefik.http.services.dummyService.loadbalancer.server.port=1337"
- "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_BASIC_AUTH_USERS}" # defaults to admin:admin
- "traefik.http.routers.traefik.entrypoints=https"
- "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN}`)"
- "traefik.http.routers.traefik.middlewares=traefik-auth"
- "traefik.http.routers.traefik.tls.certresolver=http"
- "traefik.http.routers.traefik.service=api@internal"
update_config:
order: stop-first
parallelism: 1
delay: 10s
failure_action: rollback
monitor: 30s
rollback_config:
parallelism: 1
order: stop-first
placement:
constraints:
- node.role==manager
restart_policy:
condition: on-failure
delay: 5s
max_attempts: 3
ocis:
image: owncloud/ocis:latest
image: owncloud/ocis:${OCIS_DOCKER_TAG}
networks:
- ocis-net
ocis-net:
aliases:
- ocis
entrypoint:
- /bin/sh
command: ["-c", "ocis init || true; ocis server"]
@@ -65,9 +130,13 @@ services:
OCIS_LOG_LEVEL: ${OCIS_LOG_LEVEL}
OCIS_LOG_COLOR: ${OCIS_LOG_COLOR}
PROXY_TLS: "false"
OCIS_SERVICE_ACCOUNT_SECRET: ${OCIS_SERVICE_ACCOUNT_SECRET}
OCIS_SERVICE_ACCOUNT_ID: ${OCIS_SERVICE_ACCOUNT_ID}
SETTINGS_GRPC_ADDR: 0.0.0.0:9191
OCIS_INSECURE: ${OCIS_INSECURE}
PROXY_ENABLE_BASIC_AUTH: ${PROXY_ENABLE_BASIC_AUTH}
PROXY_ENABLE_APP_AUTH: "true"
OCIS_ADD_RUN_SERVICES: "auth-app"
IDM_ADMIN_PASSWORD: ${ADMIN_PASSWORD}
IDM_CREATE_DEMO_USERS: ${DEMO_USERS}
# fulltext search
@@ -75,35 +144,60 @@ services:
SEARCH_EXTRACTOR_TIKA_TIKA_URL: http://tika:9998
FRONTEND_FULL_TEXT_SEARCH_ENABLED: "true"
# make the registry available to the app provider containers
MICRO_REGISTRY: "mdns"
MICRO_REGISTRY: "nats-js-kv"
NATS_NATS_HOST: "0.0.0.0"
FRONTEND_ARCHIVER_MAX_SIZE: "53687091200" # 50 GiB
FRONTEND_ARCHIVER_MAX_NUM_FILES: "100000" # opcional
volumes:
- ./config/ocis/app-registry.yaml:/etc/ocis/app-registry.yaml
- ocis-config:/etc/ocis
- ocis-data:/var/lib/ocis
labels:
- "traefik.enable=true"
- "traefik.http.routers.ocis.entrypoints=https"
- "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN}`)"
- "traefik.http.routers.ocis.tls.certresolver=http"
- "traefik.http.routers.ocis.service=ocis"
- "traefik.http.services.ocis.loadbalancer.server.port=9200"
logging:
driver: "local"
deploy:
labels:
- "traefik.enable=true"
- "traefik.http.routers.ocis.entrypoints=https"
- "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN}`)"
- "traefik.http.routers.ocis.tls.certresolver=http"
- "traefik.http.routers.ocis.service=ocis"
- "traefik.docker.network=ocis-net"
- "traefik.http.services.ocis.loadbalancer.server.port=9200"
# 1) DAV/OCS/etc SIN anubis (prioridad alta)
- "traefik.http.routers.ocis-api.entrypoints=https"
- "traefik.http.routers.ocis-api.rule=Host(`${OCIS_DOMAIN}`) && (PathPrefix(`/remote.php/dav`) || PathPrefix(`/remote.php/webdav`) || PathPrefix(`/ocs`) || PathPrefix(`/.well-known`) || PathPrefix(`/status.php`))"
- "traefik.http.routers.ocis-api.tls.certresolver=http"
- "traefik.http.routers.ocis-api.service=ocis"
- "traefik.http.routers.ocis-api.priority=100"
# 2) WebUI CON anubis (prioridad baja)
- "traefik.http.routers.ocis-web.entrypoints=https"
- "traefik.http.routers.ocis-web.rule=Host(`${OCIS_DOMAIN}`)"
- "traefik.http.routers.ocis-web.tls.certresolver=http"
- "traefik.http.routers.ocis-web.service=ocis"
- "traefik.http.routers.ocis-web.middlewares=anubis@swarm"
- "traefik.http.routers.ocis-web.priority=1"
# - "traefik.enable=true"
# - "traefik.http.routers.ocis.entrypoints=https"
# - "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN}`)"
# - "traefik.http.routers.ocis.tls.certresolver=http"
# - "traefik.http.routers.ocis.service=ocis"
# - "traefik.http.services.ocis.loadbalancer.server.port=9200"
# - "traefik.http.routers.ocis.middlewares=anubis@swarm"
restart_policy:
condition: on-failure
delay: 5s
max_attempts: 3
update_config:
parallelism: 1
delay: 10s
order: start-first
failure_action: rollback
monitor: 30s
rollback_config:
parallelism: 1
order: stop-first
ocis-appprovider-collabora:
image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
image: owncloud/ocis:${OCIS_DOCKER_TAG}
networks:
- ocis-net
command: app-provider server
@@ -124,19 +218,30 @@ services:
APP_PROVIDER_WOPI_FOLDER_URL_BASE_URL: https://${OCIS_DOMAIN}
JWT_SECRET: ${WOPI_JWT_SECRET}
# share the registry with the ocis container
MICRO_REGISTRY: "mdns"
MICRO_REGISTRY: "nats-js-kv"
OCIS_EVENTS_ENDPOINT: "ocis:9233"
MICRO_REGISTRY_ADDRESS: "ocis:9233"
volumes:
- ocis-config:/etc/ocis
logging:
driver: "local"
deploy:
deploy:
update_config:
parallelism: 1
delay: 10s
order: start-first
failure_action: rollback
monitor: 30s
rollback_config:
parallelism: 1
order: stop-first
restart_policy:
condition: on-failure
delay: 5s
max_attempts: 3
ocis-appprovider-onlyoffice:
image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
image: owncloud/ocis:${OCIS_DOCKER_TAG}
networks:
- ocis-net
user: "0" # needed for apk add in entrypoint script
@@ -163,13 +268,24 @@ services:
APP_PROVIDER_WOPI_WOPI_SERVER_EXTERNAL_URL: https://${WOPISERVER_DOMAIN}
APP_PROVIDER_WOPI_FOLDER_URL_BASE_URL: https://${OCIS_DOMAIN}
# share the registry with the ocis container
MICRO_REGISTRY: "mdns"
MICRO_REGISTRY: "nats-js-kv"
OCIS_EVENTS_ENDPOINT: "ocis:9233"
MICRO_REGISTRY_ADDRESS: "ocis:9233"
volumes:
- ./config/ocis-appprovider-onlyoffice/entrypoint-override.sh:/entrypoint-override.sh
- ocis-config:/etc/ocis
logging:
driver: "local"
deploy:
deploy:
update_config:
parallelism: 1
delay: 10s
order: start-first
failure_action: rollback
monitor: 30s
rollback_config:
parallelism: 1
order: stop-first
restart_policy:
condition: on-failure
delay: 5s
@@ -190,16 +306,25 @@ services:
- ./config/wopiserver/entrypoint-override.sh:/entrypoint-override.sh
- ./config/wopiserver/wopiserver.conf.dist:/etc/wopi/wopiserver.conf.dist
- wopi-recovery:/var/spool/wopirecovery
labels:
- "traefik.enable=true"
- "traefik.http.routers.wopiserver.entrypoints=https"
- "traefik.http.routers.wopiserver.rule=Host(`${WOPISERVER_DOMAIN}`)"
- "traefik.http.routers.wopiserver.tls.certresolver=http"
- "traefik.http.routers.wopiserver.service=wopiserver"
- "traefik.http.services.wopiserver.loadbalancer.server.port=8880"
logging:
driver: "local"
deploy:
deploy:
labels:
- "traefik.enable=true"
- "traefik.http.routers.wopiserver.entrypoints=https"
- "traefik.http.routers.wopiserver.rule=Host(`${WOPISERVER_DOMAIN}`)"
- "traefik.http.routers.wopiserver.tls.certresolver=http"
- "traefik.http.routers.wopiserver.service=wopiserver"
- "traefik.http.services.wopiserver.loadbalancer.server.port=8880"
update_config:
parallelism: 1
delay: 10s
order: start-first
failure_action: rollback
monitor: 30s
rollback_config:
parallelism: 1
order: stop-first
restart_policy:
condition: on-failure
delay: 5s
@@ -217,16 +342,25 @@ services:
password: ${COLLABORA_ADMIN_PASSWORD}
cap_add:
- MKNOD
labels:
- "traefik.enable=true"
- "traefik.http.routers.collabora.entrypoints=https"
- "traefik.http.routers.collabora.rule=Host(`${COLLABORA_DOMAIN}`)"
- "traefik.http.routers.collabora.tls.certresolver=http"
- "traefik.http.routers.collabora.service=collabora"
- "traefik.http.services.collabora.loadbalancer.server.port=9980"
logging:
driver: "local"
deploy:
deploy:
labels:
- "traefik.enable=true"
- "traefik.http.routers.collabora.entrypoints=https"
- "traefik.http.routers.collabora.rule=Host(`${COLLABORA_DOMAIN}`)"
- "traefik.http.routers.collabora.tls.certresolver=http"
- "traefik.http.routers.collabora.service=collabora"
- "traefik.http.services.collabora.loadbalancer.server.port=9980"
update_config:
parallelism: 1
delay: 10s
order: start-first
failure_action: rollback
monitor: 30s
rollback_config:
parallelism: 1
order: stop-first
restart_policy:
condition: on-failure
delay: 5s
@@ -245,19 +379,28 @@ services:
volumes:
- ./config/onlyoffice/entrypoint-override.sh:/entrypoint-override.sh
- ./config/onlyoffice/local.json:/etc/onlyoffice/documentserver/local.dist.json
labels:
- "traefik.enable=true"
- "traefik.http.routers.onlyoffice.entrypoints=https"
- "traefik.http.routers.onlyoffice.rule=Host(`${ONLYOFFICE_DOMAIN}`)"
- "traefik.http.routers.onlyoffice.tls.certresolver=http"
- "traefik.http.routers.onlyoffice.service=onlyoffice"
- "traefik.http.services.onlyoffice.loadbalancer.server.port=80"
# websockets can't be opened when this is ommitted
- "traefik.http.middlewares.onlyoffice.headers.customrequestheaders.X-Forwarded-Proto=https"
- "traefik.http.routers.onlyoffice.middlewares=onlyoffice"
logging:
driver: "local"
deploy:
deploy:
labels:
- "traefik.enable=true"
- "traefik.http.routers.onlyoffice.entrypoints=https"
- "traefik.http.routers.onlyoffice.rule=Host(`${ONLYOFFICE_DOMAIN}`)"
- "traefik.http.routers.onlyoffice.tls.certresolver=http"
- "traefik.http.routers.onlyoffice.service=onlyoffice"
- "traefik.http.services.onlyoffice.loadbalancer.server.port=80"
# websockets can't be opened when this is ommitted
- "traefik.http.middlewares.onlyoffice.headers.customrequestheaders.X-Forwarded-Proto=https"
- "traefik.http.routers.onlyoffice.middlewares=onlyoffice"
update_config:
parallelism: 1
delay: 10s
order: start-first
failure_action: rollback
monitor: 30s
rollback_config:
parallelism: 1
order: stop-first
restart_policy:
condition: on-failure
delay: 5s
@@ -280,16 +423,25 @@ services:
INBUCKET_SMTP_TLSPRIVKEY: /tmp/server.key
INBUCKET_SMTP_TLSCERT: /tmp/server.crt
INBUCKET_STORAGE_MAILBOXMSGCAP: 1000
labels:
- "traefik.enable=true"
- "traefik.http.routers.inbucket.entrypoints=https"
- "traefik.http.routers.inbucket.rule=Host(`${INBUCKET_DOMAIN}`)"
- "traefik.http.routers.inbucket.tls.certresolver=http"
- "traefik.http.routers.inbucket.service=inbucket"
- "traefik.http.services.inbucket.loadbalancer.server.port=9000"
logging:
driver: "local"
deploy:
deploy:
labels:
- "traefik.enable=true"
- "traefik.http.routers.inbucket.entrypoints=https"
- "traefik.http.routers.inbucket.rule=Host(`${INBUCKET_DOMAIN}`)"
- "traefik.http.routers.inbucket.tls.certresolver=http"
- "traefik.http.routers.inbucket.service=inbucket"
- "traefik.http.services.inbucket.loadbalancer.server.port=9000"
update_config:
parallelism: 1
delay: 10s
order: start-first
failure_action: rollback
monitor: 30s
rollback_config:
parallelism: 1
order: stop-first
restart_policy:
condition: on-failure
delay: 5s
@@ -301,6 +453,14 @@ networks:
external: true
volumes:
certs:
external: true
name: selfhosted-owncloud_certs
ocis-data:
external: true
name: selfhosted-owncloud_ocis-data
ocis-config:
external: true
name: selfhosted-owncloud_ocis-config
wopi-recovery:
external: true
name: selfhosted-owncloud_wopi-recovery