From c9567c34c0523d0c73e5f769aaac54eb70ce13b4 Mon Sep 17 00:00:00 2001
From: Alex Zaw <me@alexzaw.dev>
Date: Mon, 6 Apr 2026 18:04:05 +0000
Subject: [PATCH] Add main docker-compose configuration

---
 docker-compose.yml | 74 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 docker-compose.yml

diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..854c95c
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,74 @@
+version: "3.9"
+
+services:
+  onlyoffice-docs:
+    image: onlyoffice/documentserver:8.2
+    container_name: onlyoffice-docs
+    restart: unless-stopped
+    ports:
+      - "${APP_PORT}:80"
+    environment:
+      # JWT Configuration
+      - JWT_ENABLED=${ONLYOFFICE_JWT_ENABLED:-true}
+      - JWT_SECRET=${ONLYOFFICE_JWT_SECRET}
+      - JWT_HEADER=${ONLYOFFICE_JWT_HEADER:-Authorization}
+      - JWT_IN_BODY=${ONLYOFFICE_JWT_IN_BODY:-false}
+      # Storage Configuration
+      - USE_UNAUTHORIZED_STORAGE=${ONLYOFFICE_USE_UNAUTHORIZED_STORAGE:-false}
+      # WOPI Configuration
+      - WOPI_ENABLED=${ONLYOFFICE_WOPI_ENABLED:-false}
+      # Performance tuning
+      - NGINX_WORKER_PROCESSES=auto
+      - NGINX_WORKER_CONNECTIONS=4096
+      # Font generation
+      - GENERATE_FONTS=true
+    volumes:
+      # Logs
+      - ${APP_DATA_DIR}/data/logs:/var/log/onlyoffice
+      # Certificates and data
+      - ${APP_DATA_DIR}/data/data:/var/www/onlyoffice/Data
+      # File cache
+      - ${APP_DATA_DIR}/data/lib:/var/lib/onlyoffice
+      # Internal PostgreSQL database
+      - ${APP_DATA_DIR}/data/db:/var/lib/postgresql
+      # Font cache
+      - ${APP_DATA_DIR}/data/fonts:/usr/share/fonts/truetype/custom
+    networks:
+      - tipi_main_network
+    labels:
+      # Main
+      traefik.enable: true
+      traefik.http.middlewares.onlyoffice-docs-web-redirect.redirectscheme.scheme: https
+      traefik.http.services.onlyoffice-docs.loadbalancer.server.port: 80
+      # Web
+      traefik.http.routers.onlyoffice-docs-insecure.rule: Host(`${APP_DOMAIN}`)
+      traefik.http.routers.onlyoffice-docs-insecure.entrypoints: web
+      traefik.http.routers.onlyoffice-docs-insecure.service: onlyoffice-docs
+      traefik.http.routers.onlyoffice-docs-insecure.middlewares: onlyoffice-docs-web-redirect
+      # Websecure
+      traefik.http.routers.onlyoffice-docs.rule: Host(`${APP_DOMAIN}`)
+      traefik.http.routers.onlyoffice-docs.entrypoints: websecure
+      traefik.http.routers.onlyoffice-docs.service: onlyoffice-docs
+      traefik.http.routers.onlyoffice-docs.tls.certresolver: myresolver
+      # Local domain
+      traefik.http.routers.onlyoffice-docs-local-insecure.rule: Host(`onlyoffice-docs.${LOCAL_DOMAIN}`)
+      traefik.http.routers.onlyoffice-docs-local-insecure.entrypoints: web
+      traefik.http.routers.onlyoffice-docs-local-insecure.service: onlyoffice-docs
+      traefik.http.routers.onlyoffice-docs-local-insecure.middlewares: onlyoffice-docs-web-redirect
+      # Local domain secure
+      traefik.http.routers.onlyoffice-docs-local.rule: Host(`onlyoffice-docs.${LOCAL_DOMAIN}`)
+      traefik.http.routers.onlyoffice-docs-local.entrypoints: websecure
+      traefik.http.routers.onlyoffice-docs-local.service: onlyoffice-docs
+      traefik.http.routers.onlyoffice-docs-local.tls: true
+      # Runtipi managed
+      runtipi.managed: true
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost/healthcheck"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+
+networks:
+  tipi_main_network:
+    external: true