version: "3.9"

services:
  onlyoffice-docs:
    image: onlyoffice/documentserver:8.2
    container_name: onlyoffice-docs
    restart: unless-stopped
    ports:
      - "${APP_PORT}:80"
    environment:
      # JWT Configuration
      - JWT_ENABLED=${ONLYOFFICE_JWT_ENABLED:-true}
      - JWT_SECRET=${ONLYOFFICE_JWT_SECRET}
      - JWT_HEADER=${ONLYOFFICE_JWT_HEADER:-Authorization}
      - JWT_IN_BODY=${ONLYOFFICE_JWT_IN_BODY:-false}
      # Storage Configuration
      - USE_UNAUTHORIZED_STORAGE=${ONLYOFFICE_USE_UNAUTHORIZED_STORAGE:-false}
      # WOPI Configuration
      - WOPI_ENABLED=${ONLYOFFICE_WOPI_ENABLED:-false}
      # Performance tuning
      - NGINX_WORKER_PROCESSES=auto
      - NGINX_WORKER_CONNECTIONS=4096
      # Font generation
      - GENERATE_FONTS=true
    volumes:
      # Logs
      - ${APP_DATA_DIR}/data/logs:/var/log/onlyoffice
      # Certificates and data
      - ${APP_DATA_DIR}/data/data:/var/www/onlyoffice/Data
      # File cache
      - ${APP_DATA_DIR}/data/lib:/var/lib/onlyoffice
      # Internal PostgreSQL database
      - ${APP_DATA_DIR}/data/db:/var/lib/postgresql
      # Font cache
      - ${APP_DATA_DIR}/data/fonts:/usr/share/fonts/truetype/custom
    networks:
      - tipi_main_network
    labels:
      # Main
      traefik.enable: true
      traefik.http.middlewares.onlyoffice-docs-web-redirect.redirectscheme.scheme: https
      traefik.http.services.onlyoffice-docs.loadbalancer.server.port: 80
      # Web
      traefik.http.routers.onlyoffice-docs-insecure.rule: Host(`${APP_DOMAIN}`)
      traefik.http.routers.onlyoffice-docs-insecure.entrypoints: web
      traefik.http.routers.onlyoffice-docs-insecure.service: onlyoffice-docs
      traefik.http.routers.onlyoffice-docs-insecure.middlewares: onlyoffice-docs-web-redirect
      # Websecure
      traefik.http.routers.onlyoffice-docs.rule: Host(`${APP_DOMAIN}`)
      traefik.http.routers.onlyoffice-docs.entrypoints: websecure
      traefik.http.routers.onlyoffice-docs.service: onlyoffice-docs
      traefik.http.routers.onlyoffice-docs.tls.certresolver: myresolver
      # Local domain
      traefik.http.routers.onlyoffice-docs-local-insecure.rule: Host(`onlyoffice-docs.${LOCAL_DOMAIN}`)
      traefik.http.routers.onlyoffice-docs-local-insecure.entrypoints: web
      traefik.http.routers.onlyoffice-docs-local-insecure.service: onlyoffice-docs
      traefik.http.routers.onlyoffice-docs-local-insecure.middlewares: onlyoffice-docs-web-redirect
      # Local domain secure
      traefik.http.routers.onlyoffice-docs-local.rule: Host(`onlyoffice-docs.${LOCAL_DOMAIN}`)
      traefik.http.routers.onlyoffice-docs-local.entrypoints: websecure
      traefik.http.routers.onlyoffice-docs-local.service: onlyoffice-docs
      traefik.http.routers.onlyoffice-docs-local.tls: true
      # Runtipi managed
      runtipi.managed: true
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

networks:
  tipi_main_network:
    external: true