docker-compose.yml

x-ocis-server: &ocis-service
  image: ${OCIS_IMAGE:-owncloud/ocis:latest}
  entrypoint: /bin/sh
  command: ['-c', 'ocis init || true && ocis server']
  environment: &ocis-environment
    OCIS_INSECURE: '${OCIS_INSECURE:-true}'
    OCIS_LOG_LEVEL: '${OCIS_LOG_LEVEL:-error}'
    OCIS_LOG_PRETTY: '${OCIS_LOG_PRETTY:-true}'
    OCIS_LOG_COLOR: '${OCIS_LOG_COLOR:-true}'
    OCIS_PASSWORD_POLICY_MIN_CHARACTERS: '3'
    OCIS_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS: '0'
    OCIS_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS: '0'
    OCIS_PASSWORD_POLICY_MIN_DIGITS: '0'
    OCIS_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS: '0'
    OCIS_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: '/etc/ocis/password-policy-banned-passwords.txt'

    # WEB
    WEB_ASSET_CORE_PATH: ${WEB_ASSET_CORE_PATH:-/web/dist}
    WEB_UI_THEME_PATH: ${WEB_UI_THEME_PATH:-/themes/owncloud/theme.json}
    WEB_UI_CONFIG_FILE: ${WEB_UI_CONFIG_FILE:-/web/config.json}

    #FRONTEND
    FRONTEND_SEARCH_MIN_LENGTH: '2'
    FRONTEND_OCS_ENABLE_DENIALS: 'true'
    FRONTEND_FULL_TEXT_SEARCH_ENABLED: 'true'
    FRONTEND_OCS_INCLUDE_OCM_SHAREES: 'true'

    # IDM
    IDM_CREATE_DEMO_USERS: '${DEMO_USERS:-true}'
    IDM_ADMIN_PASSWORD: '${ADMIN_PASSWORD:-admin}' # override the random admin password from `ocis init`
    IDM_SVC_PASSWORD: '${IDM_SVC_PASSWORD:-some-ldap-idm-password}'
    IDM_REVASVC_PASSWORD: '${IDM_REVASVC_PASSWORD:-some-ldap-reva-password}'
    IDM_IDPSVC_PASSWORD: '${IDM_IDPSVC_PASSWORD:-some-ldap-idp-password}'

    # IDP
    IDP_LDAP_BIND_PASSWORD: '${IDP_LDAP_BIND_PASSWORD:-some-ldap-idp-password}'

    # STORAGE
    STORAGE_HOME_DRIVER: '${STORAGE_HOME_DRIVER:-ocis}'
    STORAGE_USERS_DRIVER: '${STORAGE_USERS_DRIVER:-ocis}'
    STORAGE_TRANSFER_SECRET: '${STORAGE_TRANSFER_SECRET:-some-ocis-transfer-secret}'

    # LDAP
    GROUPS_LDAP_BIND_PASSWORD: '${GROUPS_LDAP_BIND_PASSWORD:-some-ldap-reva-password}'
    USERS_LDAP_BIND_PASSWORD: '${USERS_LDAP_BIND_PASSWORD:-some-ldap-reva-password}'
    AUTH_BASIC_LDAP_BIND_PASSWORD: '${AUTH_BASIC_LDAP_BIND_PASSWORD:-some-ldap-reva-password}'
    GRAPH_APPLICATION_ID: '${GRAPH_APPLICATION_ID:-some-graph-app-id}'
    GRAPH_LDAP_BIND_PASSWORD: '${GRAPH_LDAP_BIND_PASSWORD:-some-ldap-idm-password}'
    LDAP_GROUP_SUBSTRING_FILTER_TYPE: 'any'
    LDAP_USER_SUBSTRING_FILTER_TYPE: 'any'

    # PROXY
    PROXY_ENABLE_BASIC_AUTH: '${PROXY_ENABLE_BASIC_AUTH:-true}'
    PROXY_TLS: 'false'

    # TIKA
    SEARCH_EXTRACTOR_TYPE: 'tika'
    SEARCH_EXTRACTOR_TIKA_TIKA_URL: 'http://host.docker.internal:9998'
    SEARCH_EXTRACTOR_CS3SOURCE_INSECURE: 'true'

    # App Provider
    GATEWAY_GRPC_ADDR: 0.0.0.0:9142 # make the REVA gateway accessible to the app drivers
    NATS_NATS_HOST: 0.0.0.0
    NATS_NATS_PORT: 9233

    # OCM
    OCM_OCM_PROVIDER_AUTHORIZER_PROVIDERS_FILE: '/etc/ocis/ocmproviders.json'
    OCM_OCM_INVITE_MANAGER_INSECURE: 'true'
    OCM_OCM_SHARE_PROVIDER_INSECURE: 'true'
    OCM_OCM_STORAGE_PROVIDER_INSECURE: 'true'
    OCM_DEBUG_ADDR: '127.0.0.1:10281'
    OCM_HTTP_ADDR: '127.0.0.1:10280'
    OCM_GRPC_ADDR: '127.0.0.1:10282'

  extra_hosts:
    - host.docker.internal:${DOCKER_HOST:-host-gateway}
    - ocis.owncloud.test:${DOCKER_HOST:-host-gateway}
  restart: unless-stopped
  depends_on:
    - traefik
    - tika-service

services:
  ocis:
    <<: *ocis-service
    container_name: web_ocis
    environment:
      <<: *ocis-environment
      OCIS_URL: ${OCIS_URL:-https://host.docker.internal:9200}
      OCIS_CORS_ALLOW_ORIGINS: https://host.docker.internal:9200,https://host.docker.internal:9201
      OCM_WEBAPP_TEMPLATE: https://host.docker.internal:9201/o/{{.Token}}/{relative-path-to-shared-resource}
      # make the registry available to the app provider containers
      MICRO_REGISTRY: 'nats-js-kv'
      MICRO_REGISTRY_ADDRESS: 0.0.0.0:9233
      PROXY_CSP_CONFIG_FILE_LOCATION: /etc/ocis/csp.yaml
      ONLYOFFICE_DOMAIN: host.docker.internal:9981
      COLLABORA_DOMAIN: host.docker.internal:9980
    labels:
      traefik.enable: true
      traefik.http.routers.ocis.tls: true
      traefik.http.routers.ocis.rule: Host(`host.docker.internal`) && PathPrefix(`/`)
      traefik.http.routers.ocis.entrypoints: ocis
      traefik.http.services.ocis.loadbalancer.server.port: 9200
      # workaround: https://github.com/owncloud/ocis/issues/5108
      traefik.http.routers.ocis.middlewares: cors
    volumes:
      - ./dev/docker/ocis/csp.yaml:/etc/ocis/csp.yaml
      - ./dev/docker/ocis/password-policy-banned-passwords.txt:/etc/ocis/password-policy-banned-passwords.txt
      - ./dev/docker/ocis.idp.config.yaml:/etc/ocis/idp.yaml
      - ./dev/docker/ocis-ca:/var/lib/ocis/proxy
      - ./dev/docker/ocis.storage.ocmproviders.json:/etc/ocis/ocmproviders.json
      - ./dist:/web/dist
      - ./dev/docker/ocis/app-registry.yaml:/etc/ocis/app-registry.yaml
      - ocis-config:/etc/ocis
      - ${OCIS_WEB_CONFIG:-./dev/docker/ocis.web.config.json}:/web/config.json:ro

  ocis-federated:
    <<: *ocis-service
    container_name: web_ocis_federated
    environment:
      <<: *ocis-environment
      OCIS_URL: https://ocis.owncloud.test:10200
      OCIS_CORS_ALLOW_ORIGINS: https://ocis.owncloud.test:10201
      OCM_WEBAPP_TEMPLATE: https://ocis.owncloud.test:10201/o/{{.Token}}/{relative-path-to-shared-resource}
    labels:
      traefik.enable: true
      traefik.http.routers.ocis-federated.tls: true
      traefik.http.routers.ocis-federated.rule: Host(`ocis.owncloud.test`) && PathPrefix(`/`)
      traefik.http.routers.ocis-federated.entrypoints: ocis-federated
      traefik.http.services.ocis-federated.loadbalancer.server.port: 9200
      # workaround: https://github.com/owncloud/ocis/issues/5108
      traefik.http.routers.ocis-federated.middlewares: cors
    volumes:
      - ./dev/docker/ocis/password-policy-banned-passwords.txt:/etc/ocis/password-policy-banned-passwords.txt
      - ./dev/docker/ocis.idp.config.yaml:/etc/ocis/idp.yaml
      - ./dev/docker/ocis-ca:/var/lib/ocis/proxy
      - ./dev/docker/ocis.storage.ocmproviders.json:/etc/ocis/ocmproviders.json
      - ./dist:/web/dist
      - ./dev/docker/ocis/app-registry.yaml:/etc/ocis/app-registry.yaml
      - ocis-federated-config:/etc/ocis
      - ${OCIS_WEB_CONFIG:-./dev/docker/ocis.web-federated.config.json}:/web/config.json:ro

  companion:
    image: owncloud/uppy-companion:3.12.13-owncloud
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    environment:
      NODE_TLS_REJECT_UNAUTHORIZED: 0
      COMPANION_ALLOW_LOCAL_URLS: 'true'
      COMPANION_DATADIR: /tmp/companion/
      COMPANION_DOMAIN: host.docker.internal:9200
      COMPANION_PROTOCOL: https
      COMPANION_PATH: /companion
      COMPANION_ONEDRIVE_KEY: '${COMPANION_ONEDRIVE_KEY}'
      COMPANION_ONEDRIVE_SECRET: '${COMPANION_ONEDRIVE_SECRET}'
    volumes:
      - uppy_companion_datadir:/tmp/companion/
    labels:
      traefik.enable: true
      traefik.http.routers.companion.rule: PathPrefix(`/companion`)
      traefik.http.routers.companion.entrypoints: websecure
      traefik.http.services.companion.loadbalancer.server.port: 3020

  ocis-appprovider-collabora:
    image: ${OCIS_IMAGE:-owncloud/ocis:latest}
    command: app-provider server
    environment:
      APP_PROVIDER_LOG_LEVEL: error
      # use the internal service name of the gateway
      REVA_GATEWAY: ${REVA_GATEWAY:-com.owncloud.api.gateway}
      # STORAGE_GATEWAY_ENDPOINT: host.docker.internal:9142
      APP_PROVIDER_GRPC_ADDR: 0.0.0.0:9164
      # configure the service name to avoid collision with onlyoffice
      APP_PROVIDER_SERVICE_NAME: app-provider-collabora
      # use the internal service name
      APP_PROVIDER_EXTERNAL_ADDR: com.owncloud.api.app-provider-collabora
      APP_PROVIDER_DRIVER: wopi
      APP_PROVIDER_WOPI_APP_NAME: Collabora
      APP_PROVIDER_WOPI_APP_ICON_URI: https://${COLLABORA_DOMAIN:-host.docker.internal:9980}/favicon.ico
      APP_PROVIDER_WOPI_APP_URL: https://${COLLABORA_DOMAIN:-host.docker.internal:9980}
      APP_PROVIDER_WOPI_INSECURE: true
      APP_PROVIDER_WOPI_WOPI_SERVER_EXTERNAL_URL: https://${WOPISERVER_DOMAIN:-host.docker.internal:8880}
      APP_PROVIDER_WOPI_FOLDER_URL_BASE_URL: https://${OCIS_DOMAIN:-host.docker.internal:9200}
      # share the registry with the ocis container
      MICRO_REGISTRY: 'nats-js-kv'
      MICRO_REGISTRY_ADDRESS: http://ocis:9233
    volumes:
      - ocis-config:/etc/ocis
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    restart: always

  ocis-appprovider-onlyoffice:
    image: ${OCIS_IMAGE:-owncloud/ocis:latest}
    user: '0' # needed for apk add in entrypoint script
    entrypoint:
      - /bin/sh
      - /entrypoint-override.sh
    environment:
      APP_PROVIDER_LOG_LEVEL: error
      # use the internal service name of the gateway
      REVA_GATEWAY: ${REVA_GATEWAY:-com.owncloud.api.gateway}
      APP_PROVIDER_GRPC_ADDR: 0.0.0.0:9164
      # configure the service name to avoid collision with collabora
      APP_PROVIDER_SERVICE_NAME: app-provider-onlyoffice
      # use the internal service name
      APP_PROVIDER_EXTERNAL_ADDR: com.owncloud.api.app-provider-onlyoffice
      APP_PROVIDER_DRIVER: wopi
      APP_PROVIDER_WOPI_APP_NAME: OnlyOffice
      APP_PROVIDER_WOPI_APP_ICON_URI: https://${ONLYOFFICE_DOMAIN:-host.docker.internal:9981}/web-apps/apps/documenteditor/main/resources/img/favicon.ico
      APP_PROVIDER_WOPI_APP_URL: https://${ONLYOFFICE_DOMAIN:-host.docker.internal:9981}
      APP_PROVIDER_WOPI_INSECURE: true
      APP_PROVIDER_WOPI_WOPI_SERVER_EXTERNAL_URL: https://${WOPISERVER_DOMAIN:-host.docker.internal:8880}
      APP_PROVIDER_WOPI_FOLDER_URL_BASE_URL: https://${OCIS_DOMAIN:-host.docker.internal:9200}
      # share the registry with the ocis container
      MICRO_REGISTRY: 'nats-js-kv'
      MICRO_REGISTRY_ADDRESS: http://ocis:9233
    volumes:
      - ./dev/docker/ocis-appprovider-onlyoffice/entrypoint-override.sh:/entrypoint-override.sh
      - ocis-config:/etc/ocis
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    restart: always

  collabora:
    image: collabora/code:23.05.9.4.1
    environment:
      DONT_GEN_SSL_CERT: 'YES'
      extra_params: --o:ssl.enable=false --o:ssl.termination=true --o:welcome.enable=false --o:net.frame_ancestors=https://host.docker.internal:9200
    cap_add:
      - MKNOD
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    labels:
      traefik.enable: true
      traefik.http.routers.collabora.tls: true
      traefik.http.routers.collabora.rule: PathPrefix(`/`)
      traefik.http.routers.collabora.entrypoints: collabora
      traefik.http.services.collabora.loadbalancer.server.port: 9980
    restart: always
    depends_on:
      - traefik

  onlyoffice:
    image: onlyoffice/documentserver:7.5.1
    entrypoint:
      - /bin/sh
      - /entrypoint-override.sh
    environment:
      WOPI_ENABLED: true
      USE_UNAUTHORIZED_STORAGE: true # self signed certificates
    volumes:
      - ./dev/docker/onlyoffice/entrypoint-override.sh:/entrypoint-override.sh
      - ./dev/docker/onlyoffice/local.json:/etc/onlyoffice/documentserver/local.dist.json
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    labels:
      traefik.enable: true
      traefik.http.routers.onlyoffice.tls: true
      traefik.http.routers.onlyoffice.rule: PathPrefix(`/`)
      traefik.http.routers.onlyoffice.entrypoints: websecure
      # websockets can't be opened when this is ommitted
      traefik.http.middlewares.onlyoffice.headers.customrequestheaders.X-Forwarded-Proto: https
      traefik.http.routers.onlyoffice.middlewares: onlyoffice
    restart: always
    depends_on:
      - traefik

  wopiserver:
    image: cs3org/wopiserver:v10.3.0
    environment:
      WOPISERVER_INSECURE: true
      WOPISECRET: ${WOPI_JWT_SECRET:-LoremIpsum567}
      WOPISERVER_DOMAIN: ${WOPISERVER_DOMAIN:-host.docker.internal:8880}
    volumes:
      - ./dev/docker/wopiserver/entrypoint-override.sh:/entrypoint-override.sh
      - ./dev/docker/wopiserver/wopiserver.conf.dist:/etc/wopi/wopiserver.conf.dist
    entrypoint:
      - /bin/sh
      - /entrypoint-override.sh
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    labels:
      traefik.enable: true
      traefik.http.routers.wopiserver.tls: true
      traefik.http.routers.wopiserver.rule: PathPrefix(`/`)
      traefik.http.routers.wopiserver.entrypoints: wopi
      traefik.http.services.wopiserver.loadbalancer.server.port: 8880
    depends_on:
      - traefik

  traefik:
    image: traefik:2.10.7
    restart: unless-stopped
    entrypoint:
      [
        '/bin/sh',
        '-c',
        "[ -f /certificates/server.key ] && ./entrypoint.sh $$@ || (apk add openssl && openssl req -subj '/CN=ocis.test' -x509 -sha256 -nodes -days 3650 -newkey rsa:2048 -keyout /certificates/server.key -out /certificates/server.crt && chmod -R 777 /certificates && ./entrypoint.sh $$@)"
      ]
    command:
      - '--pilot.dashboard=false'
      - '--log.level=DEBUG'
      - '--api.dashboard=true'
      - '--api.insecure=true'
      - '--providers.file.directory=/configs'
      - '--providers.docker=true'
      - '--providers.docker.exposedbydefault=false'
      - '--entrypoints.web.address=:80'
      - '--entrypoints.ocis.address=:9200'
      - '--entrypoints.ocis-federated.address=:10200'
      - '--entrypoints.collabora.address=:9980'
      - '--entrypoints.wopi.address=:8880'
      - '--entrypoints.websecure.address=:443'
      - '--entrypoints.websecure.http.middlewares=https_config@docker'
      - '--entrypoints.websecure.http.tls.options=default'
    labels:
      traefik.enable: true
      traefik.http.routers.http_catchall.rule: HostRegexp(`{any:.+}`)
      traefik.http.routers.http_catchall.entrypoints: web
      traefik.http.routers.http_catchall.middlewares: https_config
      traefik.http.middlewares.https_config.headers.sslRedirect: true
      traefik.http.middlewares.https_config.headers.stsSeconds: 63072000
      traefik.http.middlewares.https_config.headers.stsIncludeSubdomains: true
      traefik.http.middlewares.cors.headers.accesscontrolallowmethods: '*'
      traefik.http.middlewares.cors.headers.accesscontrolallowheaders: '*'
      traefik.http.middlewares.cors.headers.accesscontrolalloworiginlist: '*'
      traefik.http.middlewares.cors.headers.accesscontrolexposeheaders: '*'
      traefik.http.middlewares.cors.headers.accesscontrolmaxage: 100
      traefik.http.middlewares.cors.headers.addvaryheader: true
    ports:
      - '80:80'
      - '8090:8080'
      - '9200:9200'
      - '10200:10200'
      - '9980:9980'
      - '8880:8880'
      - '9981:443'
    volumes:
      - './dev/docker/traefik/certificates:/certificates'
      - './dev/docker/traefik/configs:/configs'
      - '/var/run/docker.sock:/var/run/docker.sock:ro'

  tika-service:
    image: owncloudci/wait-for:latest
    container_name: web_tika_service
    depends_on:
      - tika
    command:
      - 'wait-for -it tika:9998 -t 300'

  tika:
    image: apache/tika:2.9.1.0
    container_name: web_tika
    ports:
      - 9998:9998
    restart: unless-stopped

volumes:
  uploads:
  uppy_companion_datadir:
  ocis-config:
  ocis-federated-config:

networks:
  traefik: