467 lines
16 KiB
YAML
467 lines
16 KiB
YAML
version: "3.7"
|
|
|
|
services:
|
|
anubis:
|
|
image: ghcr.io/techarohq/anubis:v1.24.0
|
|
networks:
|
|
- ocis-net
|
|
environment:
|
|
- BIND=:8080
|
|
- 'TARGET= ' # IMPORTANTE: un espacio tras el '='
|
|
- PUBLIC_URL=https://${ANUBIS_DOMAIN}
|
|
- COOKIE_DOMAIN=${ANUBIS_COOKIE_DOMAIN}
|
|
- REDIRECT_DOMAINS=${ANUBIS_REDIRECT_DOMAINS}
|
|
deploy:
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=ocis-net"
|
|
|
|
# Router para acceder a Anubis
|
|
- "traefik.http.routers.anubis.entrypoints=https"
|
|
- "traefik.http.routers.anubis.rule=Host(`${ANUBIS_DOMAIN}`)"
|
|
- "traefik.http.routers.anubis.tls.certresolver=http"
|
|
- "traefik.http.services.anubis.loadbalancer.server.port=8080"
|
|
# Middleware ForwardAuth
|
|
- "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/cmd/anubis/api/check"
|
|
- "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true"
|
|
restart_policy:
|
|
condition: on-failure
|
|
delay: 5s
|
|
max_attempts: 3
|
|
update_config:
|
|
parallelism: 1
|
|
delay: 10s
|
|
order: start-first
|
|
failure_action: rollback
|
|
monitor: 30s
|
|
rollback_config:
|
|
parallelism: 1
|
|
order: stop-first
|
|
|
|
traefik:
|
|
image: traefik:v3.6.7
|
|
networks:
|
|
ocis-net:
|
|
aliases:
|
|
- ${OCIS_DOMAIN}
|
|
- ${WOPISERVER_DOMAIN}
|
|
- ${COLLABORA_DOMAIN}
|
|
- ${ONLYOFFICE_DOMAIN}
|
|
command:
|
|
# allow big uploads with slow clients
|
|
- "--entrypoints.http.transport.respondingtimeouts.readtimeout=0"
|
|
- "--entrypoints.https.transport.respondingtimeouts.readtimeout=0"
|
|
- "--log.level=${TRAEFIK_LOG_LEVEL:-ERROR}"
|
|
# letsencrypt configuration
|
|
- "--certificatesResolvers.http.acme.email=${TRAEFIK_ACME_MAIL}"
|
|
- "--certificatesResolvers.http.acme.storage=/certs/acme.json"
|
|
- "--certificatesResolvers.http.acme.httpChallenge.entryPoint=http"
|
|
# enable dashboard
|
|
- "--api.dashboard=true"
|
|
# define entrypoints
|
|
- "--entryPoints.http.address=:80"
|
|
- "--entryPoints.http.http.redirections.entryPoint.to=https"
|
|
- "--entryPoints.http.http.redirections.entryPoint.scheme=https"
|
|
- "--entryPoints.https.address=:443"
|
|
- "--entryPoints.https.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
|
|
- "--entryPoints.http.forwardedHeaders.trustedIPs=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
|
|
# docker provider (get configuration from container labels)
|
|
- "--providers.swarm.endpoint=unix:///var/run/docker.sock"
|
|
- "--providers.swarm.exposedByDefault=false"
|
|
- "--providers.swarm.network=ocis-net"
|
|
# TODO: will remove this after changing all the label syntax
|
|
- "--core.defaultRuleSyntax=v2"
|
|
# access log
|
|
- "--accessLog=true"
|
|
- "--accessLog.format=json"
|
|
- "--accessLog.fields.headers.names.X-Request-Id=keep"
|
|
ports:
|
|
- target: 80
|
|
published: 80
|
|
protocol: tcp
|
|
mode: host
|
|
- target: 443
|
|
published: 443
|
|
protocol: tcp
|
|
mode: host
|
|
volumes:
|
|
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
|
- "certs:/certs"
|
|
logging:
|
|
driver: "local"
|
|
deploy:
|
|
labels:
|
|
- "traefik.enable=${TRAEFIK_DASHBOARD}"
|
|
- "traefik.http.services.dummyService.loadbalancer.server.port=1337"
|
|
- "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_BASIC_AUTH_USERS}" # defaults to admin:admin
|
|
- "traefik.http.routers.traefik.entrypoints=https"
|
|
- "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN}`)"
|
|
- "traefik.http.routers.traefik.middlewares=traefik-auth"
|
|
- "traefik.http.routers.traefik.tls.certresolver=http"
|
|
- "traefik.http.routers.traefik.service=api@internal"
|
|
update_config:
|
|
order: stop-first
|
|
parallelism: 1
|
|
delay: 10s
|
|
failure_action: rollback
|
|
monitor: 30s
|
|
rollback_config:
|
|
parallelism: 1
|
|
order: stop-first
|
|
placement:
|
|
constraints:
|
|
- node.role==manager
|
|
restart_policy:
|
|
condition: on-failure
|
|
delay: 5s
|
|
max_attempts: 3
|
|
|
|
ocis:
|
|
image: owncloud/ocis:${OCIS_DOCKER_TAG}
|
|
networks:
|
|
ocis-net:
|
|
aliases:
|
|
- ocis
|
|
entrypoint:
|
|
- /bin/sh
|
|
command: ["-c", "ocis init || true; ocis server"]
|
|
environment:
|
|
OCIS_URL: https://${OCIS_DOMAIN}
|
|
OCIS_LOG_LEVEL: ${OCIS_LOG_LEVEL}
|
|
OCIS_LOG_COLOR: ${OCIS_LOG_COLOR}
|
|
PROXY_TLS: "false"
|
|
OCIS_SERVICE_ACCOUNT_SECRET: ${OCIS_SERVICE_ACCOUNT_SECRET}
|
|
OCIS_SERVICE_ACCOUNT_ID: ${OCIS_SERVICE_ACCOUNT_ID}
|
|
SETTINGS_GRPC_ADDR: 0.0.0.0:9191
|
|
OCIS_INSECURE: ${OCIS_INSECURE}
|
|
PROXY_ENABLE_BASIC_AUTH: ${PROXY_ENABLE_BASIC_AUTH}
|
|
PROXY_ENABLE_APP_AUTH: "true"
|
|
OCIS_ADD_RUN_SERVICES: "auth-app"
|
|
IDM_ADMIN_PASSWORD: ${ADMIN_PASSWORD}
|
|
IDM_CREATE_DEMO_USERS: ${DEMO_USERS}
|
|
# fulltext search
|
|
SEARCH_EXTRACTOR_TYPE: tika
|
|
SEARCH_EXTRACTOR_TIKA_TIKA_URL: http://tika:9998
|
|
FRONTEND_FULL_TEXT_SEARCH_ENABLED: "true"
|
|
# make the registry available to the app provider containers
|
|
MICRO_REGISTRY: "nats-js-kv"
|
|
NATS_NATS_HOST: "0.0.0.0"
|
|
FRONTEND_ARCHIVER_MAX_SIZE: "53687091200" # 50 GiB
|
|
FRONTEND_ARCHIVER_MAX_NUM_FILES: "100000" # opcional
|
|
volumes:
|
|
- ./config/ocis/app-registry.yaml:/etc/ocis/app-registry.yaml
|
|
- ocis-config:/etc/ocis
|
|
- ocis-data:/var/lib/ocis
|
|
logging:
|
|
driver: "local"
|
|
deploy:
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.docker.network=ocis-net"
|
|
- "traefik.http.services.ocis.loadbalancer.server.port=9200"
|
|
|
|
# 1) DAV/OCS/etc SIN anubis (prioridad alta)
|
|
- "traefik.http.routers.ocis-api.entrypoints=https"
|
|
- "traefik.http.routers.ocis-api.rule=Host(`${OCIS_DOMAIN}`) && (PathPrefix(`/remote.php/dav`) || PathPrefix(`/remote.php/webdav`) || PathPrefix(`/ocs`) || PathPrefix(`/.well-known`) || PathPrefix(`/status.php`))"
|
|
- "traefik.http.routers.ocis-api.tls.certresolver=http"
|
|
- "traefik.http.routers.ocis-api.service=ocis"
|
|
- "traefik.http.routers.ocis-api.priority=100"
|
|
|
|
# 2) WebUI CON anubis (prioridad baja)
|
|
- "traefik.http.routers.ocis-web.entrypoints=https"
|
|
- "traefik.http.routers.ocis-web.rule=Host(`${OCIS_DOMAIN}`)"
|
|
- "traefik.http.routers.ocis-web.tls.certresolver=http"
|
|
- "traefik.http.routers.ocis-web.service=ocis"
|
|
- "traefik.http.routers.ocis-web.middlewares=anubis@swarm"
|
|
- "traefik.http.routers.ocis-web.priority=1"
|
|
# - "traefik.enable=true"
|
|
# - "traefik.http.routers.ocis.entrypoints=https"
|
|
# - "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN}`)"
|
|
# - "traefik.http.routers.ocis.tls.certresolver=http"
|
|
# - "traefik.http.routers.ocis.service=ocis"
|
|
# - "traefik.http.services.ocis.loadbalancer.server.port=9200"
|
|
# - "traefik.http.routers.ocis.middlewares=anubis@swarm"
|
|
restart_policy:
|
|
condition: on-failure
|
|
delay: 5s
|
|
max_attempts: 3
|
|
update_config:
|
|
parallelism: 1
|
|
delay: 10s
|
|
order: start-first
|
|
failure_action: rollback
|
|
monitor: 30s
|
|
rollback_config:
|
|
parallelism: 1
|
|
order: stop-first
|
|
|
|
|
|
ocis-appprovider-collabora:
|
|
image: owncloud/ocis:${OCIS_DOCKER_TAG}
|
|
networks:
|
|
- ocis-net
|
|
command: app-provider server
|
|
environment:
|
|
# use the internal service name of the gateway
|
|
REVA_GATEWAY: ${REVA_GATEWAY}
|
|
APP_PROVIDER_GRPC_ADDR: 0.0.0.0:9164
|
|
# configure the service name to avoid collision with onlyoffice
|
|
APP_PROVIDER_SERVICE_NAME: app-provider-collabora
|
|
# use the internal service name
|
|
APP_PROVIDER_EXTERNAL_ADDR: com.owncloud.api.app-provider-collabora
|
|
APP_PROVIDER_DRIVER: wopi
|
|
APP_PROVIDER_WOPI_APP_NAME: Collabora
|
|
APP_PROVIDER_WOPI_APP_ICON_URI: https://${COLLABORA_DOMAIN}/favicon.ico
|
|
APP_PROVIDER_WOPI_APP_URL: https://${COLLABORA_DOMAIN}
|
|
APP_PROVIDER_WOPI_INSECURE: "${INSECURE}"
|
|
APP_PROVIDER_WOPI_WOPI_SERVER_EXTERNAL_URL: https://${WOPISERVER_DOMAIN}
|
|
APP_PROVIDER_WOPI_FOLDER_URL_BASE_URL: https://${OCIS_DOMAIN}
|
|
JWT_SECRET: ${WOPI_JWT_SECRET}
|
|
# share the registry with the ocis container
|
|
MICRO_REGISTRY: "nats-js-kv"
|
|
OCIS_EVENTS_ENDPOINT: "ocis:9233"
|
|
MICRO_REGISTRY_ADDRESS: "ocis:9233"
|
|
volumes:
|
|
- ocis-config:/etc/ocis
|
|
logging:
|
|
driver: "local"
|
|
deploy:
|
|
update_config:
|
|
parallelism: 1
|
|
delay: 10s
|
|
order: start-first
|
|
failure_action: rollback
|
|
monitor: 30s
|
|
rollback_config:
|
|
parallelism: 1
|
|
order: stop-first
|
|
restart_policy:
|
|
condition: on-failure
|
|
delay: 5s
|
|
max_attempts: 3
|
|
|
|
ocis-appprovider-onlyoffice:
|
|
image: owncloud/ocis:${OCIS_DOCKER_TAG}
|
|
networks:
|
|
- ocis-net
|
|
user: "0" # needed for apk add in entrypoint script
|
|
entrypoint:
|
|
- /bin/sh
|
|
- /entrypoint-override.sh
|
|
environment:
|
|
OCIS_URL: https://${OCIS_DOMAIN}
|
|
OCIS_LOG_LEVEL: ${OCIS_LOG_LEVEL:-info}
|
|
OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
|
|
PROXY_TLS: "false" # do not use SSL between Traefik and oCIS
|
|
# use the internal service name of the gateway
|
|
REVA_GATEWAY: ${REVA_GATEWAY}
|
|
APP_PROVIDER_GRPC_ADDR: 0.0.0.0:9164
|
|
# configure the service name to avoid collision with collabora
|
|
APP_PROVIDER_SERVICE_NAME: app-provider-onlyoffice
|
|
# use the internal service name
|
|
APP_PROVIDER_EXTERNAL_ADDR: com.owncloud.api.app-provider-onlyoffice
|
|
APP_PROVIDER_DRIVER: wopi
|
|
APP_PROVIDER_WOPI_APP_NAME: OnlyOffice
|
|
APP_PROVIDER_WOPI_APP_ICON_URI: https://${ONLYOFFICE_DOMAIN}/web-apps/apps/documenteditor/main/resources/img/favicon.ico
|
|
APP_PROVIDER_WOPI_APP_URL: https://${ONLYOFFICE_DOMAIN}
|
|
APP_PROVIDER_WOPI_INSECURE: "${INSECURE:-false}"
|
|
APP_PROVIDER_WOPI_WOPI_SERVER_EXTERNAL_URL: https://${WOPISERVER_DOMAIN}
|
|
APP_PROVIDER_WOPI_FOLDER_URL_BASE_URL: https://${OCIS_DOMAIN}
|
|
# share the registry with the ocis container
|
|
MICRO_REGISTRY: "nats-js-kv"
|
|
OCIS_EVENTS_ENDPOINT: "ocis:9233"
|
|
MICRO_REGISTRY_ADDRESS: "ocis:9233"
|
|
volumes:
|
|
- ./config/ocis-appprovider-onlyoffice/entrypoint-override.sh:/entrypoint-override.sh
|
|
- ocis-config:/etc/ocis
|
|
logging:
|
|
driver: "local"
|
|
deploy:
|
|
update_config:
|
|
parallelism: 1
|
|
delay: 10s
|
|
order: start-first
|
|
failure_action: rollback
|
|
monitor: 30s
|
|
rollback_config:
|
|
parallelism: 1
|
|
order: stop-first
|
|
restart_policy:
|
|
condition: on-failure
|
|
delay: 5s
|
|
max_attempts: 3
|
|
|
|
wopiserver:
|
|
image: cs3org/wopiserver:${WOPISERVER_DOCKER_TAG:-v10.2.2}
|
|
networks:
|
|
- ocis-net
|
|
entrypoint:
|
|
- /bin/sh
|
|
- /entrypoint-override.sh
|
|
environment:
|
|
WOPISERVER_INSECURE: "${INSECURE}"
|
|
WOPISECRET: ${WOPI_JWT_SECRET}
|
|
WOPISERVER_DOMAIN: ${WOPISERVER_DOMAIN}
|
|
volumes:
|
|
- ./config/wopiserver/entrypoint-override.sh:/entrypoint-override.sh
|
|
- ./config/wopiserver/wopiserver.conf.dist:/etc/wopi/wopiserver.conf.dist
|
|
- wopi-recovery:/var/spool/wopirecovery
|
|
logging:
|
|
driver: "local"
|
|
deploy:
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.wopiserver.entrypoints=https"
|
|
- "traefik.http.routers.wopiserver.rule=Host(`${WOPISERVER_DOMAIN}`)"
|
|
- "traefik.http.routers.wopiserver.tls.certresolver=http"
|
|
- "traefik.http.routers.wopiserver.service=wopiserver"
|
|
- "traefik.http.services.wopiserver.loadbalancer.server.port=8880"
|
|
update_config:
|
|
parallelism: 1
|
|
delay: 10s
|
|
order: start-first
|
|
failure_action: rollback
|
|
monitor: 30s
|
|
rollback_config:
|
|
parallelism: 1
|
|
order: stop-first
|
|
restart_policy:
|
|
condition: on-failure
|
|
delay: 5s
|
|
max_attempts: 3
|
|
|
|
collabora:
|
|
image: collabora/code:23.05.5.2.1
|
|
networks:
|
|
- ocis-net
|
|
environment:
|
|
aliasgroup1: https://${WOPISERVER_DOMAIN}:443
|
|
DONT_GEN_SSL_CERT: "YES"
|
|
extra_params: --o:ssl.enable=false --o:ssl.termination=true --o:welcome.enable=false --o:net.frame_ancestors=${OCIS_DOMAIN}
|
|
username: ${COLLABORA_ADMIN_USER}
|
|
password: ${COLLABORA_ADMIN_PASSWORD}
|
|
cap_add:
|
|
- MKNOD
|
|
logging:
|
|
driver: "local"
|
|
deploy:
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.collabora.entrypoints=https"
|
|
- "traefik.http.routers.collabora.rule=Host(`${COLLABORA_DOMAIN}`)"
|
|
- "traefik.http.routers.collabora.tls.certresolver=http"
|
|
- "traefik.http.routers.collabora.service=collabora"
|
|
- "traefik.http.services.collabora.loadbalancer.server.port=9980"
|
|
update_config:
|
|
parallelism: 1
|
|
delay: 10s
|
|
order: start-first
|
|
failure_action: rollback
|
|
monitor: 30s
|
|
rollback_config:
|
|
parallelism: 1
|
|
order: stop-first
|
|
restart_policy:
|
|
condition: on-failure
|
|
delay: 5s
|
|
max_attempts: 3
|
|
|
|
onlyoffice:
|
|
image: onlyoffice/documentserver:7.5.0
|
|
networks:
|
|
- ocis-net
|
|
entrypoint:
|
|
- /bin/sh
|
|
- /entrypoint-override.sh
|
|
environment:
|
|
WOPI_ENABLED: "true"
|
|
USE_UNAUTHORIZED_STORAGE: "${INSECURE}" # self signed certificates
|
|
volumes:
|
|
- ./config/onlyoffice/entrypoint-override.sh:/entrypoint-override.sh
|
|
- ./config/onlyoffice/local.json:/etc/onlyoffice/documentserver/local.dist.json
|
|
logging:
|
|
driver: "local"
|
|
deploy:
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.onlyoffice.entrypoints=https"
|
|
- "traefik.http.routers.onlyoffice.rule=Host(`${ONLYOFFICE_DOMAIN}`)"
|
|
- "traefik.http.routers.onlyoffice.tls.certresolver=http"
|
|
- "traefik.http.routers.onlyoffice.service=onlyoffice"
|
|
- "traefik.http.services.onlyoffice.loadbalancer.server.port=80"
|
|
# websockets can't be opened when this is ommitted
|
|
- "traefik.http.middlewares.onlyoffice.headers.customrequestheaders.X-Forwarded-Proto=https"
|
|
- "traefik.http.routers.onlyoffice.middlewares=onlyoffice"
|
|
update_config:
|
|
parallelism: 1
|
|
delay: 10s
|
|
order: start-first
|
|
failure_action: rollback
|
|
monitor: 30s
|
|
rollback_config:
|
|
parallelism: 1
|
|
order: stop-first
|
|
restart_policy:
|
|
condition: on-failure
|
|
delay: 5s
|
|
max_attempts: 3
|
|
|
|
tika:
|
|
image: ${TIKA_IMAGE:-apache/tika:latest-full}
|
|
networks:
|
|
- ocis-net
|
|
|
|
inbucket:
|
|
image: inbucket/inbucket
|
|
networks:
|
|
- ocis-net
|
|
entrypoint:
|
|
- /bin/sh
|
|
command: [ "-c", "apk add openssl; openssl req -subj '/CN=inbucket.test' -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout /tmp/server.key -out /tmp/server.crt; /start-inbucket.sh" ]
|
|
environment:
|
|
INBUCKET_SMTP_TLSENABLED: "true"
|
|
INBUCKET_SMTP_TLSPRIVKEY: /tmp/server.key
|
|
INBUCKET_SMTP_TLSCERT: /tmp/server.crt
|
|
INBUCKET_STORAGE_MAILBOXMSGCAP: 1000
|
|
logging:
|
|
driver: "local"
|
|
deploy:
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.inbucket.entrypoints=https"
|
|
- "traefik.http.routers.inbucket.rule=Host(`${INBUCKET_DOMAIN}`)"
|
|
- "traefik.http.routers.inbucket.tls.certresolver=http"
|
|
- "traefik.http.routers.inbucket.service=inbucket"
|
|
- "traefik.http.services.inbucket.loadbalancer.server.port=9000"
|
|
update_config:
|
|
parallelism: 1
|
|
delay: 10s
|
|
order: start-first
|
|
failure_action: rollback
|
|
monitor: 30s
|
|
rollback_config:
|
|
parallelism: 1
|
|
order: stop-first
|
|
restart_policy:
|
|
condition: on-failure
|
|
delay: 5s
|
|
max_attempts: 3
|
|
|
|
|
|
networks:
|
|
ocis-net:
|
|
external: true
|
|
volumes:
|
|
certs:
|
|
external: true
|
|
name: selfhosted-owncloud_certs
|
|
ocis-data:
|
|
external: true
|
|
name: selfhosted-owncloud_ocis-data
|
|
ocis-config:
|
|
external: true
|
|
name: selfhosted-owncloud_ocis-config
|
|
wopi-recovery:
|
|
external: true
|
|
name: selfhosted-owncloud_wopi-recovery
|