Add asterisk, nextcloud, onlyoffice, mattermost services + vendor/easy-asterisk

asterisk.sh (homelab):
- Easy Asterisk PBX with self-hosted coturn TURN server
- Vendored from outis1one/easy-asterisk v0.10.0 for offline install
- LAN-only or FQDN mode (TLS + TURN relay for remote access)
- Auto-answer SIP headers for intercom use case
- Authelia SSO for web admin; WEB_ADMIN_AUTH_DISABLED=true when chosen
- UFW rules: 5060-5061, 8080, 8088-8089, 3478, 10000-20000/udp, 49152-49252/udp
- Builds custom Docker image from vendor/easy-asterisk/

nextcloud.sh (utilities):
- Custom Dockerfile: nextcloud:apache + smbclient (SMB external storage)
- MariaDB 10.11 sidecar with matching env vars
- OVERWRITEPROTOCOL/OVERWRITECLIURL/TRUSTED_PROXIES set for Caddy
- Enables files_external app after first-run init (waits up to 90s)

onlyoffice.sh (utilities):
- JWT generated once, preserved across re-runs
- _ensure_yq: auto-installs yq v4 for FileBrowser config patching
- _wire_nextcloud: idempotent occ wiring (DocumentServerUrl, jwt_secret)
- _wire_filebrowser: patches config.yaml + restarts container
- Caddy block overrides X-Frame-Options to allow iframe embedding

mattermost.sh (utilities):
- PostgreSQL 15-alpine + Mattermost Team Edition + coturn (port 3479)
- 8443/udp for Calls plugin RTC server
- coturn uses --use-auth-secret HMAC mode (required by Calls plugin)
- SITE_URL computed from SITE_DOMAIN, promptable
- UFW: 8443/udp, 3479, 49153-49352/udp

vendor/easy-asterisk/:
- All upstream source files vendored for offline/self-contained installs
- Dockerfile, docker/entrypoint.sh, docker/coturn-entrypoint.sh
- easy-asterisk-v0.10.0.sh (6929-line management script)
- scripts/vpn-diagnostics.sh, scripts/dns-whitelist.sh
- .env.example

https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt
This commit is contained in:
Claude
2026-06-09 00:28:38 +00:00
parent ec3f9bfd3f
commit 7c3f101fe0
11 changed files with 772 additions and 1488 deletions
+157 -139
View File
@@ -1,5 +1,5 @@
#!/bin/bash
# services/onlyoffice.sh — Self-hosted OnlyOffice Document Server.
# services/onlyoffice.sh — Self-hosted OnlyOffice Document Server (Nextcloud/FileBrowser).
# Part of the modular post-install system (sourced by setup.sh).
#
# Can also be run standalone on any machine:
@@ -7,6 +7,9 @@
# (Docker must already be installed when run standalone)
# ── Standalone bootstrap ──────────────────────────────────────────────────────
# Detected when the script is executed directly rather than sourced by setup.sh.
# Sets up helpers and globals, then defers execution until after the function
# definition at the bottom of this file.
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
[[ "$(id -u)" == "0" ]] || { echo "Run with sudo: sudo bash $0"; exit 1; }
@@ -14,9 +17,11 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
_COMMON="$_SELF_DIR/../lib/common.sh"
if [[ -f "$_COMMON" ]]; then
# Full repo present — use the real helpers (picks up ~/docker/.config too)
# shellcheck source=../lib/common.sh
source "$_COMMON"
else
# One-off copy — inline minimal stubs so the script works without the repo
log_info() { echo -e "\033[0;34m[INFO]\033[0m $*"; }
log_success() { echo -e "\033[0;32m[OK]\033[0m $*"; }
log_warning() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
@@ -39,6 +44,19 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$@" 2>/dev/null || true
}
generate_password() {
local _len="${1:-32}"
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$_len"
}
write_readme() {
local _dir="$1"; shift
[[ "${DRY_RUN:-false}" == "true" ]] && return 0
mkdir -p "$_dir"
cat > "$_dir/README.md"
}
# Match common.sh's eval-based pattern so local vars in install_* are set correctly
prompt_text() {
local _q="$1" _def="$2" _var="$3" _r
[[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
@@ -58,6 +76,21 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
local _caddy_dir="$DOCKER_DIR/caddy"
local _caddyfile="$_caddy_dir/Caddyfile"
# Support remote Caddy host via CADDY_REMOTE_HOST
if [[ -n "${CADDY_REMOTE_HOST:-}" ]]; then
log_info "Remote Caddy detected at $CADDY_REMOTE_HOST — printing block to add manually."
echo ""
echo " Add the following to your Caddyfile on $CADDY_REMOTE_HOST:"
echo " ──────────────────────────────────────────────────────────"
echo " # $_name"
echo " ${_subdomain}.${SITE_DOMAIN:-example.com} {"
echo " reverse_proxy $_upstream"
[[ -n "$_extra" ]] && echo "$_extra"
echo " }"
echo " ──────────────────────────────────────────────────────────"
return 0
fi
if [[ ! -d "$_caddy_dir" ]]; then
log_info "Access $_name directly on port ${_upstream##*:}."
return 0
@@ -75,6 +108,7 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
read -r -p " Domain (e.g. ${_subdomain}.${SITE_DOMAIN:-example.com}): " _domain
[[ -n "$_domain" ]] || { log_warning "No domain entered — skipping Caddy."; return 0; }
# Back up before touching
if [[ -f "$_caddyfile" ]]; then
local _bk="$_caddy_dir/Caddyfile.backup.$(date +%Y%m%d-%H%M%S)"
cp "$_caddyfile" "$_bk"
@@ -83,6 +117,7 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
touch "$_caddyfile"
fi
# Remove existing block for this domain if present
if grep -q "^${_domain}" "$_caddyfile" 2>/dev/null; then
log_warning "$_domain already in Caddyfile"
local _ow=""
@@ -121,19 +156,10 @@ CBLOCK
log_info "Manual reload: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
fi
}
write_readme() {
local _dir="$1"; shift
mkdir -p "$_dir"
cat > "$_dir/README.md"
}
generate_password() {
local len="${1:-32}"
tr -dc 'A-Za-z0-9' </dev/urandom | head -c "$len"
}
fi
# Globals — ACTUAL_USER/ACTUAL_HOME must come before DOCKER_DIR
# ($HOME under sudo is /root, not the real user's home)
ACTUAL_USER="${ACTUAL_USER:-${SUDO_USER:-$USER}}"
ACTUAL_HOME="$(getent passwd "$ACTUAL_USER" 2>/dev/null | cut -d: -f6 || echo "${HOME:-/root}")"
DOCKER_DIR="${DOCKER_DIR:-$ACTUAL_HOME/docker}"
@@ -143,129 +169,83 @@ CBLOCK
SITE_DOMAIN="${SITE_DOMAIN:-example.com}"
SITE_CADDY_NET="${SITE_CADDY_NET:-caddy_net}"
register_service() { :; }
register_service() { :; } # no-op — no wizard to register into
_RUN_STANDALONE=1
fi
# ─────────────────────────────────────────────────────────────────────────────
register_service onlyoffice utilities "Self-hosted OnlyOffice Document Server (Nextcloud/FileBrowser)" 8082
# ── Ensure yq v4 is installed ─────────────────────────────────────────────────
# ── Helper: install yq v4 if absent ──────────────────────────────────────────
_ensure_yq() {
if command -v yq &>/dev/null; then
local major
major=$(yq --version 2>&1 | grep -oP '(?<=v)\d+' | head -1 || echo 0)
[[ "$major" -ge 4 ]] && return 0
log_info "yq found but version < 4 — reinstalling..."
else
log_info "yq not found — installing..."
fi
local arch
arch=$(uname -m)
local yq_bin="yq_linux_amd64"
[[ "$arch" == "aarch64" || "$arch" == "arm64" ]] && yq_bin="yq_linux_arm64"
if wget -qO /usr/local/bin/yq \
"https://github.com/mikefarah/yq/releases/latest/download/${yq_bin}" \
&& chmod +x /usr/local/bin/yq; then
log_success "yq installed ($(yq --version 2>&1 | head -1))"
else
log_warning "Could not install yq — FileBrowser config.yaml will need manual update"
return 1
fi
command -v yq &>/dev/null && return 0
log_info "Installing yq (required for FileBrowser config patching)..."
local _arch; _arch=$(uname -m)
local _binary="yq_linux_amd64"
[[ "$_arch" == "aarch64" || "$_arch" == "arm64" ]] && _binary="yq_linux_arm64"
curl -fsSL "https://github.com/mikefarah/yq/releases/latest/download/${_binary}" \
-o /usr/local/bin/yq && chmod +x /usr/local/bin/yq \
&& log_success "yq installed" || log_warning "yq install failed — FileBrowser wiring skipped"
}
# ── Wire OnlyOffice into Nextcloud ────────────────────────────────────────────
# ── Helper: wire OnlyOffice into Nextcloud (idempotent) ───────────────────────
_wire_nextcloud() {
local jwt_secret="$1"
local nc_dir="$DOCKER_DIR/nextcloud"
[[ -d "$nc_dir" ]] || return 0
log_info "Nextcloud detected — wiring OnlyOffice integration..."
if ! docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^nextcloud$"; then
log_warning "Nextcloud container not running — skipping occ wiring."
log_info " Start Nextcloud and re-run: sudo bash $0"
local _jwt="$1"
local _nc_container="nextcloud"
docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${_nc_container}$" || {
log_info "Nextcloud container not running — skipping Nextcloud wiring"
return 0
fi
docker exec --user www-data nextcloud php occ app:enable onlyoffice \
&& log_success "OnlyOffice app enabled in Nextcloud" \
|| log_warning "app:enable failed — may already be enabled"
docker exec --user www-data nextcloud php occ \
config:app:set onlyoffice DocumentServerUrl \
--value "http://onlyoffice:80/" \
&& log_success "DocumentServerUrl → http://onlyoffice:80/" \
|| log_warning "Could not set DocumentServerUrl"
docker exec --user www-data nextcloud php occ \
config:app:set onlyoffice jwt_secret \
--value "$jwt_secret" \
&& log_success "jwt_secret set" \
|| log_warning "Could not set jwt_secret"
docker exec --user www-data nextcloud php occ \
config:app:set onlyoffice jwt_header \
--value "AuthorizationJwt" \
&& log_success "jwt_header set" \
|| log_warning "Could not set jwt_header"
}
log_info "Wiring OnlyOffice into Nextcloud..."
docker exec "$_nc_container" php occ app:enable onlyoffice 2>/dev/null || true
docker exec "$_nc_container" php occ config:system:set onlyoffice DocumentServerUrl \
--value="https://office.${SITE_DOMAIN:-example.com}/" 2>/dev/null \
&& log_success "DocumentServerUrl set" || log_warning "Could not set DocumentServerUrl"
docker exec "$_nc_container" php occ config:system:set onlyoffice jwt_secret \
--value="$_jwt" 2>/dev/null \
&& log_success "jwt_secret set" || log_warning "Could not set jwt_secret"
docker exec "$_nc_container" php occ config:system:set onlyoffice jwt_header \
--value="AuthorizationJwt" 2>/dev/null \
&& log_success "jwt_header set" || log_warning "Could not set jwt_header"
}
# ── Wire OnlyOffice into FileBrowser Quantum ──────────────────────────────────
# ── Helper: patch FileBrowser Quantum config.yaml with OnlyOffice endpoint ───
_wire_filebrowser() {
local fb_config="$DOCKER_DIR/filebrowser/data/config.yaml"
[[ -f "$fb_config" ]] || return 0
log_info "FileBrowser Quantum detected — updating config.yaml..."
if ! _ensure_yq; then
log_info "Set officeServer manually in $fb_config:"
log_info " officeServer: \"http://onlyoffice:80/\""
return 0
fi
yq e -i '.officeServer = "http://onlyoffice:80/"' "$fb_config" \
&& log_success "FileBrowser config.yaml: officeServer → http://onlyoffice:80/" \
|| log_warning "yq failed — set officeServer manually in $fb_config"
if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^filebrowser$"; then
docker restart filebrowser >/dev/null 2>&1 \
&& log_info "FileBrowser restarted to pick up config change" \
|| log_warning "Could not restart FileBrowser container"
fi
local _fbq_config="$DOCKER_DIR/filebrowser/config.yaml"
[[ -f "$_fbq_config" ]] || { log_info "FileBrowser config not found — skipping"; return 0; }
command -v yq &>/dev/null || { log_info "yq not found — skipping FileBrowser wiring"; return 0; }
log_info "Wiring OnlyOffice into FileBrowser Quantum..."
yq e '.officeServer = "http://onlyoffice:80/"' -i "$_fbq_config" \
&& log_success "FileBrowser officeServer set" || log_warning "Could not patch FileBrowser config"
docker restart filebrowser 2>/dev/null && log_success "FileBrowser restarted" || true
}
install_onlyoffice() {
require_docker || return 1
log_info "Installing OnlyOffice Document Server..."
_ensure_yq
log_info "Installing OnlyOffice Document Server..."
local DIR="$DOCKER_DIR/onlyoffice"
if [ "$DRY_RUN" = true ]; then
echo "[DRY-RUN] Would create $DIR with docker-compose.yml and .env"
echo "[DRY-RUN] Would deploy onlyoffice/documentserver:latest on port 8082"
echo "[DRY-RUN] Would install yq if missing"
echo "[DRY-RUN] Would wire OnlyOffice into Nextcloud (if running)"
echo "[DRY-RUN] Would wire OnlyOffice into FileBrowser Quantum (if present)"
echo "[DRY-RUN] Would create $DIR with docker-compose.yml, .env"
return 0
fi
# Always install yq — needed for FBQ config patching
_ensure_yq || true
mkdir -p "$DIR"
ensure_docker_dir_ownership "$DIR"
cd "$DIR" || return 1
# Generate JWT secret (or read existing one so re-runs don't rotate it)
# ── Preserve JWT secret across re-runs ──────────────────────────────────
local JWT_SECRET=""
if [[ -f "$DIR/.env" ]]; then
JWT_SECRET=$(grep "^JWT_SECRET=" "$DIR/.env" 2>/dev/null | cut -d= -f2-)
fi
[[ -z "$JWT_SECRET" ]] && JWT_SECRET="$(generate_password 32)"
cat > docker-compose.yml << 'OO_COMPOSE'
# ── docker-compose.yml ──────────────────────────────────────────────────
cat > docker-compose.yml << 'OOCOMPOSE'
name: onlyoffice
services:
onlyoffice:
image: onlyoffice/documentserver:latest
@@ -273,6 +253,10 @@ services:
hostname: onlyoffice
restart: unless-stopped
env_file: .env
volumes:
- ./logs:/var/log/onlyoffice
- ./data:/var/www/onlyoffice/Data
- ./fonts:/usr/share/fonts/truetype/custom
ports:
- "8082:80"
networks:
@@ -282,81 +266,115 @@ networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
OO_COMPOSE
OOCOMPOSE
cat > .env << OO_ENV
# OnlyOffice Document Server — environment
# ── .env ────────────────────────────────────────────────────────────────
cat > .env << OOENV
CADDY_NET=$SITE_CADDY_NET
# JWT authentication — keep JWT_SECRET private
# If you rotate it, update Nextcloud (occ config:app:set onlyoffice jwt_secret)
# and any other integration that uses this server
JWT_ENABLED=true
JWT_SECRET=$JWT_SECRET
JWT_HEADER=AuthorizationJwt
OO_ENV
OOENV
chmod 600 .env
# ── Subdirectories ──────────────────────────────────────────────────────
mkdir -p logs data fonts
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$DIR"
# OnlyOffice must be embeddable as an iframe in Nextcloud/FileBrowser.
# Override X-Frame-Options to allow same-site embedding (remove SAMEORIGIN restriction).
echo ""
log_success "OnlyOffice configured at $DIR"
# OnlyOffice must be embeddable as an iframe (Nextcloud / FileBrowser open
# documents in a frame). Override the default X-Frame-Options header that
# Caddy would otherwise set to SAMEORIGIN.
local OO_EXTRA_BLOCK=' header {
-X-Frame-Options
Content-Security-Policy "frame-ancestors '\''self'\'' *"
}'
configure_caddy_for_service "OnlyOffice" "onlyoffice:80" "office" "$OO_EXTRA_BLOCK"
local START=""
prompt_yn "Start OnlyOffice now? (y/n):" "y" START
if [[ "$START" =~ ^[Yy]$ ]]; then
# ── Prompt to start ─────────────────────────────────────────────────────
local START_OO=""
prompt_yn "Start OnlyOffice now? (y/n):" "y" START_OO
if [ "$START_OO" = "y" ] || [ "$START_OO" = "Y" ]; then
docker compose up -d \
&& log_success "OnlyOffice started" \
|| log_warning "Start failed — check: docker compose logs"
fi
# Wire into integrations every run (idempotent)
# ── Wire integrations (runs every install/re-install) ───────────────────
echo ""
_wire_nextcloud "$JWT_SECRET"
_wire_filebrowser
write_readme "$DIR" << MD
# ── README ───────────────────────────────────────────────────────────────
write_readme "$DIR" << OOREAD
# OnlyOffice Document Server
Self-hosted collaborative editing for DOCX, XLSX, PPTX, and ODT files.
Integrates with Nextcloud and FileBrowser Quantum.
Port: 8082 (internal 80)
Self-hosted document editing server, integrated with Nextcloud and FileBrowser Quantum.
## JWT Secret
Stored in \`.env\` (chmod 600). If you rotate it:
1. Update \`JWT_SECRET\` in \`.env\`
2. Re-run the installer to re-wire all integrations: \`sudo bash services/onlyoffice.sh\`
## Access
## Verify integrations
\`\`\`bash
# Nextcloud
docker exec --user www-data nextcloud php occ config:app:get onlyoffice DocumentServerUrl
docker exec --user www-data nextcloud php occ config:app:get onlyoffice jwt_secret
# FileBrowser Quantum
grep officeServer ~/docker/filebrowser/data/config.yaml
\`\`\`
- URL: https://office.${SITE_DOMAIN:-example.com} (or http://localhost:8082)
- The document server itself has no user-facing login page — it is accessed
through Nextcloud or FileBrowser Quantum.
## Manage
\`\`\`bash
cd $DIR
docker compose up -d # start
docker compose down # stop
docker compose logs -f # logs
docker compose up -d # start
docker compose down # stop
docker compose logs -f # follow logs
docker compose pull && docker compose up -d # update
\`\`\`
MD
log_success "OnlyOffice installed at $DIR"
## JWT secret rotation
1. Generate a new secret:
\`\`\`bash
openssl rand -hex 24
\`\`\`
2. Update \`JWT_SECRET\` in \`$DIR/.env\`
3. Restart OnlyOffice:
\`\`\`bash
docker compose restart
\`\`\`
4. Update Nextcloud's stored secret:
\`\`\`bash
docker exec nextcloud php occ config:system:set onlyoffice jwt_secret --value="<new-secret>"
\`\`\`
## Verify Nextcloud integration
\`\`\`bash
docker exec nextcloud php occ config:system:get onlyoffice
\`\`\`
## Verify FileBrowser integration
\`\`\`bash
grep officeServer $DOCKER_DIR/filebrowser/config.yaml
\`\`\`
## Add custom fonts
Copy \`.ttf\` / \`.otf\` font files into \`$DIR/fonts/\`, then restart the container.
OOREAD
echo ""
echo " Port: http://localhost:8082"
echo " JWT Secret: $JWT_SECRET"
echo " (Secret also saved to $DIR/.env)"
echo " OnlyOffice Document Server"
echo " Access URL: http://localhost:8082"
echo " JWT secret: $JWT_SECRET"
echo " Config dir: $DIR"
echo ""
echo " Integration status:"
docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^nextcloud$" \
&& echo " Nextcloud: wired (onlyoffice app + JWT configured)" \
|| echo " Nextcloud: not running — wire manually after starting Nextcloud"
[[ -f "$DOCKER_DIR/filebrowser/config.yaml" ]] \
&& echo " FileBrowser: config.yaml patched" \
|| echo " FileBrowser: config not found — will wire on next onlyoffice install"
echo ""
}