docker-compose.yml

services:
  ocis:
    image: ${OCIS_IMAGE:-owncloud/ocis:latest}
    container_name: web_ocis
    entrypoint: /bin/sh
    command: ['-c', 'ocis init || true && ocis server']
    environment:
      # OCIS
      OCIS_URL: ${OCIS_URL:-https://host.docker.internal:9200}
      OCIS_INSECURE: "${OCIS_INSECURE:-true}"
      OCIS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
      OCIS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-true}"
      OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-true}"

      # WEB
      WEB_UI_CONFIG_FILE: ${WEB_UI_CONFIG_FILE:-/web/config.json}
      WEB_ASSET_PATH: ${WEB_ASSET_PATH:-/web/dist}
      WEB_UI_THEME_PATH: ${WEB_UI_THEME_PATH:-/themes/owncloud/theme.json}

      #FRONTEND
      FRONTEND_SEARCH_MIN_LENGTH: "2"
      FRONTEND_OCS_ENABLE_DENIALS: "true"
      FRONTEND_FULL_TEXT_SEARCH_ENABLED: "true"
      FRONTEND_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: '/etc/ocis/password-policy-banned-passwords.txt'
      FRONTEND_AUTO_ACCEPT_SHARES: "true"

      # IDM
      IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-true}"
      IDM_ADMIN_PASSWORD: "${ADMIN_PASSWORD:-admin}" # override the random admin password from `ocis init`
      IDM_SVC_PASSWORD: "${IDM_SVC_PASSWORD:-some-ldap-idm-password}"
      IDM_REVASVC_PASSWORD: "${IDM_REVASVC_PASSWORD:-some-ldap-reva-password}"
      IDM_IDPSVC_PASSWORD: "${IDM_IDPSVC_PASSWORD:-some-ldap-idp-password}"

      # IDP
      IDP_LDAP_BIND_PASSWORD: "${IDP_LDAP_BIND_PASSWORD:-some-ldap-idp-password}"

      # STORAGE
      STORAGE_HOME_DRIVER: "${STORAGE_HOME_DRIVER:-ocis}"
      STORAGE_USERS_DRIVER: "${STORAGE_USERS_DRIVER:-ocis}"
      STORAGE_TRANSFER_SECRET: "${STORAGE_TRANSFER_SECRET:-some-ocis-transfer-secret}"

      # LDAP
      GROUPS_LDAP_BIND_PASSWORD: "${GROUPS_LDAP_BIND_PASSWORD:-some-ldap-reva-password}"
      USERS_LDAP_BIND_PASSWORD: "${USERS_LDAP_BIND_PASSWORD:-some-ldap-reva-password}"
      AUTH_BASIC_LDAP_BIND_PASSWORD: "${AUTH_BASIC_LDAP_BIND_PASSWORD:-some-ldap-reva-password}"
      GRAPH_APPLICATION_ID: "${GRAPH_APPLICATION_ID:-some-graph-app-id}"
      GRAPH_LDAP_BIND_PASSWORD: "${GRAPH_LDAP_BIND_PASSWORD:-some-ldap-idm-password}"
      LDAP_GROUP_SUBSTRING_FILTER_TYPE: "any"
      LDAP_USER_SUBSTRING_FILTER_TYPE: "any"

      # PROXY
      PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-true}"
      PROXY_TLS: "false"

      # CORS
      OCIS_CORS_ALLOW_ORIGINS: "https://host.docker.internal:9201"

      # TIKA
      SEARCH_EXTRACTOR_TYPE: "tika"
      SEARCH_EXTRACTOR_TIKA_TIKA_URL: "http://host.docker.internal:9998"
      SEARCH_EXTRACTOR_CS3SOURCE_INSECURE: "true"
      GATEWAY_GRPC_ADDR: 0.0.0.0:9142 # make the REVA gateway accessible to the app drivers
      # make the registry available to the app provider containers
      MICRO_REGISTRY: "mdns"
    volumes:
      - ./dev/docker/ocis/password-policy-banned-passwords.txt:/etc/ocis/password-policy-banned-passwords.txt
      - ./dev/docker/ocis.idp.config.yaml:/etc/ocis/idp.yaml
      - ./dev/docker/ocis-ca:/var/lib/ocis/proxy
      - ./dist:/web/dist
      - ${OCIS_WEB_CONFIG:-./dev/docker/ocis.web.config.json}:/web/config.json:ro
      - ./dev/docker/ocis/app-registry.yaml:/etc/ocis/app-registry.yaml
      - ocis-config:/etc/ocis
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    labels:
      traefik.enable: true
      traefik.http.routers.ocis.tls: true
      traefik.http.routers.ocis.rule: PathPrefix(`/`)
      traefik.http.routers.ocis.entrypoints: ocis
      traefik.http.services.ocis.loadbalancer.server.port: 9200
      # workaround: https://github.com/owncloud/ocis/issues/5108
      traefik.http.routers.ocis.middlewares: cors
    restart: unless-stopped
    depends_on:
      - traefik
      - tika-service

  selenium:
    build:
      dockerfile: selenium.Dockerfile
      context: ./dev/docker
      args:
        SELENIUM_IMAGE: ${SELENIUM_IMAGE:-selenium/standalone-chrome:104.0-20220812}
    container_name: web_selenium
    ports:
      - 4444:4444
      - 5900:5900
      - 7900:7900
      - 6080:7900
    volumes:
      - /dev/shm:/dev/shm
      - uploads:/uploads:ro
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    environment:
      VNC_NO_PASSWORD: "true"

  middleware-ocis:
    image: owncloud/owncloud-test-middleware:latest
    hostname: middleware
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    ports:
      - "3000:3000"
    volumes:
      - uploads:/uploads
    environment:
      MIDDLEWARE_PORT: 3000
      MIDDLEWARE_HOST: "0.0.0.0"
      RUN_ON_OCIS: 'true'
      NODE_TLS_REJECT_UNAUTHORIZED: '0'
      BACKEND_HOST: "https://host.docker.internal:9200"
      REMOTE_UPLOAD_DIR: "/uploads"
      TEST_WITH_GRAPH_API: "true"

  companion:
    image: owncloud/uppy-companion:3.12.13-owncloud
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    environment:
      NODE_TLS_REJECT_UNAUTHORIZED: 0
      COMPANION_ALLOW_LOCAL_URLS: "true"
      COMPANION_DATADIR: /tmp/companion/
      COMPANION_DOMAIN: host.docker.internal:9200
      COMPANION_PROTOCOL: https
      COMPANION_PATH: /companion
      COMPANION_ONEDRIVE_KEY: "${COMPANION_ONEDRIVE_KEY}"
      COMPANION_ONEDRIVE_SECRET: "${COMPANION_ONEDRIVE_SECRET}"
    volumes:
      - uppy_companion_datadir:/tmp/companion/
    labels:
      traefik.enable: true
      traefik.http.routers.companion.rule: PathPrefix(`/companion`)
      traefik.http.routers.companion.entrypoints: websecure
      traefik.http.services.companion.loadbalancer.server.port: 3020

  ocis-appprovider-collabora:
    image: ${OCIS_IMAGE:-owncloud/ocis:latest}
    command: app-provider server
    environment:
      APP_PROVIDER_LOG_LEVEL: error
      # use the internal service name of the gateway
      REVA_GATEWAY: ${REVA_GATEWAY:-com.owncloud.api.gateway}
      # STORAGE_GATEWAY_ENDPOINT: host.docker.internal:9142
      APP_PROVIDER_GRPC_ADDR: 0.0.0.0:9164
      # configure the service name to avoid collision with onlyoffice
      APP_PROVIDER_SERVICE_NAME: app-provider-collabora
      # use the internal service name
      APP_PROVIDER_EXTERNAL_ADDR: com.owncloud.api.app-provider-collabora
      APP_PROVIDER_DRIVER: wopi
      APP_PROVIDER_WOPI_APP_NAME: Collabora
      APP_PROVIDER_WOPI_APP_ICON_URI: https://${COLLABORA_DOMAIN:-host.docker.internal:9980}/favicon.ico
      APP_PROVIDER_WOPI_APP_URL: https://${COLLABORA_DOMAIN:-host.docker.internal:9980}
      APP_PROVIDER_WOPI_INSECURE: true
      APP_PROVIDER_WOPI_WOPI_SERVER_EXTERNAL_URL: https://${WOPISERVER_DOMAIN:-host.docker.internal:8880}
      APP_PROVIDER_WOPI_FOLDER_URL_BASE_URL: https://${OCIS_DOMAIN:-host.docker.internal:9200}
      # share the registry with the ocis container
      MICRO_REGISTRY: 'mdns'
    volumes:
      - ocis-config:/etc/ocis
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    restart: always

  ocis-appprovider-onlyoffice:
    image: ${OCIS_IMAGE:-owncloud/ocis:latest}
    user: '0' # needed for apk add in entrypoint script
    entrypoint:
      - /bin/sh
      - /entrypoint-override.sh
    environment:
      APP_PROVIDER_LOG_LEVEL: error
      # use the internal service name of the gateway
      REVA_GATEWAY: ${REVA_GATEWAY:-com.owncloud.api.gateway}
      APP_PROVIDER_GRPC_ADDR: 0.0.0.0:9164
      # configure the service name to avoid collision with collabora
      APP_PROVIDER_SERVICE_NAME: app-provider-onlyoffice
      # use the internal service name
      APP_PROVIDER_EXTERNAL_ADDR: com.owncloud.api.app-provider-onlyoffice
      APP_PROVIDER_DRIVER: wopi
      APP_PROVIDER_WOPI_APP_NAME: OnlyOffice
      APP_PROVIDER_WOPI_APP_ICON_URI: https://${ONLYOFFICE_DOMAIN:-host.docker.internal:9981}/web-apps/apps/documenteditor/main/resources/img/favicon.ico
      APP_PROVIDER_WOPI_APP_URL: https://${ONLYOFFICE_DOMAIN:-host.docker.internal:9981}
      APP_PROVIDER_WOPI_INSECURE: true
      APP_PROVIDER_WOPI_WOPI_SERVER_EXTERNAL_URL: https://${WOPISERVER_DOMAIN:-host.docker.internal:8880}
      APP_PROVIDER_WOPI_FOLDER_URL_BASE_URL: https://${OCIS_DOMAIN:-host.docker.internal:9200}
      # share the registry with the ocis container
      MICRO_REGISTRY: 'mdns'
    volumes:
      - ./dev/docker/ocis-appprovider-onlyoffice/entrypoint-override.sh:/entrypoint-override.sh
      - ocis-config:/etc/ocis
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    restart: always

  collabora:
    image: collabora/code:22.05.14.3.1
    environment:
      DONT_GEN_SSL_CERT: 'YES'
      extra_params: --o:ssl.enable=false --o:ssl.termination=true --o:welcome.enable=false --o:net.frame_ancestors=https://host.docker.internal:9200
    cap_add:
      - MKNOD
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    labels:
      traefik.enable: true
      traefik.http.routers.collabora.tls: true
      traefik.http.routers.collabora.rule: PathPrefix(`/`)
      traefik.http.routers.collabora.entrypoints: collabora
      traefik.http.services.collabora.loadbalancer.server.port: 9980
    restart: always
    depends_on:
      - traefik

  onlyoffice:
    image: onlyoffice/documentserver:7.3.3
    entrypoint:
      - /bin/sh
      - /entrypoint-override.sh
    environment:
      WOPI_ENABLED: true
      USE_UNAUTHORIZED_STORAGE: true # self signed certificates
    volumes:
      - ./dev/docker/onlyoffice/entrypoint-override.sh:/entrypoint-override.sh
      - ./dev/docker/onlyoffice/local.json:/etc/onlyoffice/documentserver/local.dist.json
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    labels:
      traefik.enable: true
      traefik.http.routers.onlyoffice.tls: true
      traefik.http.routers.onlyoffice.rule: PathPrefix(`/`)
      traefik.http.routers.onlyoffice.entrypoints: websecure
      # websockets can't be opened when this is ommitted
      traefik.http.middlewares.onlyoffice.headers.customrequestheaders.X-Forwarded-Proto: https
      traefik.http.routers.onlyoffice.middlewares: onlyoffice
    restart: always
    depends_on:
      - traefik

  wopiserver:
    image: cs3org/wopiserver:v9.4.0
    environment:
      WOPISERVER_INSECURE: true
      WOPISECRET: ${WOPI_JWT_SECRET:-LoremIpsum567}
      WOPISERVER_DOMAIN: ${WOPISERVER_DOMAIN:-host.docker.internal:8880}
    volumes:
      - ./dev/docker/wopiserver/entrypoint-override.sh:/entrypoint-override.sh
      - ./dev/docker/wopiserver/wopiserver.conf.dist:/etc/wopi/wopiserver.conf.dist
    entrypoint:
      - /bin/sh
      - /entrypoint-override.sh
    extra_hosts:
      - host.docker.internal:${DOCKER_HOST:-host-gateway}
    labels:
      traefik.enable: true
      traefik.http.routers.wopiserver.tls: true
      traefik.http.routers.wopiserver.rule: PathPrefix(`/`)
      traefik.http.routers.wopiserver.entrypoints: wopi
      traefik.http.services.wopiserver.loadbalancer.server.port: 8880
    depends_on:
      - traefik

  traefik:
    image: traefik:v2.10.1
    restart: unless-stopped
    entrypoint: ["/bin/sh", "-c", "[ -f /certificates/server.key ] && ./entrypoint.sh $$@ || (apk add openssl && openssl req -subj '/CN=ocis.test' -x509 -sha256 -nodes -days 3650 -newkey rsa:2048 -keyout /certificates/server.key -out /certificates/server.crt && chmod -R 777 /certificates && ./entrypoint.sh $$@)"]
    command:
      - "--pilot.dashboard=false"
      - "--log.level=DEBUG"
      - "--api.dashboard=true"
      - "--api.insecure=true"
      - "--providers.file.directory=/configs"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.ocis.address=:9200"
      - "--entrypoints.collabora.address=:9980"
      - "--entrypoints.wopi.address=:8880"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.websecure.http.middlewares=https_config@docker"
      - "--entrypoints.websecure.http.tls.options=default"
    labels:
      traefik.enable: true
      traefik.http.routers.http_catchall.rule: HostRegexp(`{any:.+}`)
      traefik.http.routers.http_catchall.entrypoints: web
      traefik.http.routers.http_catchall.middlewares: https_config
      traefik.http.middlewares.https_config.headers.sslRedirect: true
      traefik.http.middlewares.https_config.headers.stsSeconds: 63072000
      traefik.http.middlewares.https_config.headers.stsIncludeSubdomains: true
      traefik.http.middlewares.cors.headers.accesscontrolallowmethods: "*"
      traefik.http.middlewares.cors.headers.accesscontrolallowheaders: "*"
      traefik.http.middlewares.cors.headers.accesscontrolalloworiginlist: "*"
      traefik.http.middlewares.cors.headers.accesscontrolexposeheaders: "*"
      traefik.http.middlewares.cors.headers.accesscontrolmaxage: 100
      traefik.http.middlewares.cors.headers.addvaryheader: true
    ports:
      - "80:80"
      - "8090:8080"
      - "9200:9200"
      - "9980:9980"
      - "8880:8880"
      - "9981:443"
    volumes:
      - "./dev/docker/traefik/certificates:/certificates"
      - "./dev/docker/traefik/configs:/configs"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  tika-service:
    image: dadarek/wait-for-dependencies
    container_name: web_tika_service
    depends_on:
      - tika
    command: tika:9998

  tika:
    image: apache/tika:2.8.0.0
    container_name: web_tika
    ports:
      - 9998:9998
    restart: unless-stopped

volumes:
  uploads:
  uppy_companion_datadir:
  ocis-config: