File sync - opencloud

Opencloud is a service to store, access, and share your files.

1. Create .env

   OC_URL=https://files.${DOMAIN}
   OC_INSECURE=true
   PROXY_TLS=false
   OC_LOG_LEVEL=ERROR
   PROXY_CSP_CONFIG_FILE_LOCATION=/etc/opencloud/csp.yaml
   
   STORAGE_USERS_DRIVER=posix
   STORAGE_USERS_ID_CACHE_STORE=nats-js-kv
   STORAGE_USERS_POSIX_ROOT=/home/userdata
   STORAGE_USERS_POSIX_WATCH_FS=true
   
   OC_EXCLUDE_RUN_SERVICES=idp
   OC_ADD_RUN_SERVICES=collaboration
   OC_OIDC_ISSUER=https://auth.${DOMAIN}
   WEB_OIDC_CLIENT_ID=opencloud-web
   WEB_OIDC_SCOPE=openid profile email groups
   PROXY_OIDC_REWRITE_WELLKNOWN=true
   PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none
   PROXY_AUTOPROVISION_ACCOUNTS=true
   PROXY_USER_OIDC_CLAIM=preferred_username
   PROXY_USER_CS3_CLAIM=username
   GRAPH_ASSIGN_DEFAULT_USER_ROLE=false
   GRAPH_USERNAME_MATCH=none
   
   EURO_OFFICE_DOMAIN=office.${DOMAIN}
   COLLABORATION_WOPI_SRC=https://files.${DOMAIN}
   COLLABORATION_APP_NAME="Euro-Office"
   COLLABORATION_APP_PRODUCT="OnlyOffice"
   COLLABORATION_APP_ADDR=https://office.${DOMAIN}
   COLLABORATION_APP_ICON=https://office.${DOMAIN}/web-apps/apps/documenteditor/main/resources/img/favicon.ico
   COLLABORATION_APP_INSECURE="false"
   COLLABORATION_CS3API_DATAGATEWAY_INSECURE="false"
   COLLABORATION_APP_PROOF_DISABLE="true"
   

2. Create .env_euro-office

   WOPI_ENABLED=true
   USE_UNAUTHORIZED_STORAGE=false
   JWT_ENABLED=true
   JWT_SECRET=<REDACTED>
   

3. Create config/csp.yaml

   directives:
       child-src:
           - '''self'''
       connect-src:
           - '''self'''
           - 'blob:'
           - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
           - '${OC_OIDC_ISSUER}'
           - 'https://update.opencloud.eu/'
       default-src:
           - '''none'''
       font-src:
           - '''self'''
       frame-ancestors:
           - '''self'''
       frame-src:
           - '''self'''
           - 'blob:'
           - 'https://embed.diagrams.net/'
           # This is needed for the external-sites web extension when embedding sites
           - 'https://docs.opencloud.eu'
           - '${COLLABORA_DOMAIN}'
           - '${EURO_OFFICE_DOMAIN}'
       img-src:
           - '''self'''
           - 'data:'
           - 'blob:'
           - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
           - 'https://tile.openstreetmap.org/'
       manifest-src:
           - '''self'''
       media-src:
           - '''self'''
       object-src:
           - '''self'''
           - 'blob:'
       script-src:
           - '''self'''
           - '''unsafe-inline'''
           - '''unsafe-eval'''
           - '${OC_OIDC_ISSUER}'
       style-src:
           - '''self'''
           - '''unsafe-inline'''
   

4. Create config/proxy.yaml

   role_assignment:
       driver: oidc
       oidc_role_mapper:
           role_claim: profile #hack until https://github.com/opencloud-eu/desktop/issues/217 is resolved
           role_mapping:
           - role_name: admin
               claim_value: https://opencloud-admin
           - role_name: user
               claim_value: https://opencloud-user
   
   role_quotas:
       'd7beeea8-8ff4-406b-8fb6-ab2dd81e6b11': 134200000 #limit role user to 1gb
   

5. Copy euro-office app-registry.yaml to confg dir

   wget https://raw.githubusercontent.com/opencloud-eu/opencloud-compose/refs/heads/main/config/euro-office/app-registry.yaml -O config/euro-office/app-registry.yaml
   

6. Create docker-compose.yml

   services:
       opencloud:
           image: opencloudeu/opencloud-rolling:7.2.0
           networks: ["server"]
           entrypoint:
               - /bin/sh
           command: ["-c", "opencloud init || true; opencloud server"]
           env_file:
               - .env
           ports:
               - '9200:9200'
           volumes:
               - ${PWD}/config/euro-office/app-registry.yaml:/etc/opencloud/app-registry.yaml
               - ${PWD}/config:/etc/opencloud
               - ${PWD}/data:/var/lib/opencloud
               - /overlay/eigene_dateien/files:/home/userdata
               - ${PWD}/apps:/var/lib/opencloud/web/assets/apps
           restart: 'unless-stopped'
           labels:
               - "traefik.enable=true"
               - "traefik.http.routers.opencloud.rule=Host(`files.${DOMAIN}`)"
   
       euro-office:
           image: ghcr.io/euro-office/documentserver:v9.3.2
           networks: ["server"]
           ports:
               - "8081:80"
           env_file:
               - .env_euro-office
           volumes:
               - /usr/share/fonts/truetype:/usr/share/fonts/truetype/more:ro
           logging:
               driver: local
           restart: 'unless-stopped'
           healthcheck:
               test:
                   [
                       "CMD",
                       "bash",
                       "-c",
                       "exec 3<>/dev/tcp/127.0.0.1/80 && printf 'GET /hosting/discovery HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 && cat <&3 | head -1 | grep -q '200 OK'"
                   ]
               interval: 30s
               timeout: 10s
               retries: 5
               start_period: 120s
           labels:
               - "traefik.enable=true"
               - "traefik.http.routers.euro-office.rule=Host(`office.${DOMAIN}`)"
   
   networks:
       server:
           external: true