Claude
bec9228c55
Confirmed live: install_frigate()'s fresh-install path overwrote a working, hand-crafted docker-compose.yml (Frigate + mosquitto + frigate-notify) with zero backup, because that file's shape didn't match what frigate.sh's own "existing install" detection knew how to recognize. Every service's own detection is a judgment call about what counts as "already installed" and can miss a real setup built outside this repo's conventions. lib/common.sh gains backup_if_exists(FILE) — copies FILE to FILE.bak.<timestamp> if it exists, no-ops otherwise (including DRY_RUN). Applied before every service's own `cat > docker-compose.yml`/`cat > .env` write across all 60 services that do one (115 call sites), plus a matching standalone-mode stub added to every service's own bootstrap block, same convention already used for port_in_use/find_free_port. This doesn't replace a service's own update/fresh-reinstall detection — it's the safety net underneath it, so a wrong detection costs a .bak file to restore from instead of the original silently disappearing. Also fixes the actual gap that surfaced this: services/frigate.sh's Authelia offer only checked for Authelia installed locally on Frigate's own box, which is never true for a dedicated NVR box with no local Caddy either (the common shape — Caddy lives elsewhere, snippet-generation mode already handles that). Now offers Authelia protection unconditionally and, when Authelia isn't local, asks whether it lives on the same machine as Caddy (still "import authelia", since that's local to wherever Caddy ends up) or on a genuinely separate third machine (the explicit header-pinned forward_auth form, per CLAUDE.md's "forward_auth to a remote Authelia" note, needed because a bare authelia:9091 shortcut only works one hop).
420 lines
17 KiB
Bash
420 lines
17 KiB
Bash
#!/bin/bash
|
|
# services/onlyoffice.sh — Self-hosted OnlyOffice Document Server (Nextcloud/FileBrowser).
|
|
# Part of the modular post-install system (sourced by setup.sh).
|
|
#
|
|
# Can also be run standalone on any machine:
|
|
# sudo bash onlyoffice.sh
|
|
# (Docker must already be installed when run standalone)
|
|
|
|
# ── Standalone bootstrap ──────────────────────────────────────────────────────
|
|
# Detected when the script is executed directly rather than sourced by setup.sh.
|
|
# Sets up helpers and globals, then defers execution until after the function
|
|
# definition at the bottom of this file.
|
|
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
|
|
[[ "$(id -u)" == "0" ]] || { echo "Run with sudo: sudo bash $0"; exit 1; }
|
|
|
|
_SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
_COMMON="$_SELF_DIR/../lib/common.sh"
|
|
|
|
if [[ -f "$_COMMON" ]]; then
|
|
# Full repo present — use the real helpers (picks up ~/docker/.config too)
|
|
# shellcheck source=../lib/common.sh
|
|
source "$_COMMON"
|
|
else
|
|
# One-off copy — inline minimal stubs so the script works without the repo
|
|
log_info() { echo -e "\033[0;34m[INFO]\033[0m $*"; }
|
|
log_success() { echo -e "\033[0;32m[OK]\033[0m $*"; }
|
|
log_warning() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
|
|
log_error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
|
|
|
|
require_docker() {
|
|
command -v docker &>/dev/null || {
|
|
log_error "Docker not found. Install it first:"
|
|
log_error " curl -fsSL https://get.docker.com | sudo sh"
|
|
return 1
|
|
}
|
|
docker compose version &>/dev/null || {
|
|
log_error "Docker Compose plugin missing:"
|
|
log_error " sudo apt-get install -y docker-compose-plugin"
|
|
return 1
|
|
}
|
|
}
|
|
|
|
ensure_docker_dir_ownership() {
|
|
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$@" 2>/dev/null || true
|
|
}
|
|
|
|
port_in_use() {
|
|
local _port="$1" _proto="${2:-tcp}"
|
|
local _flag="-tlnH"
|
|
[ "$_proto" = "udp" ] && _flag="-ulnH"
|
|
ss "$_flag" "sport = :${_port}" 2>/dev/null | grep -q .
|
|
}
|
|
|
|
find_free_port() {
|
|
local _varname="$1" _port="$2" _proto="${3:-tcp}"
|
|
while port_in_use "$_port" "$_proto"; do
|
|
_port=$((_port + 1))
|
|
done
|
|
eval "$_varname='$_port'"
|
|
}
|
|
|
|
generate_password() {
|
|
local _len="${1:-32}"
|
|
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$_len"
|
|
}
|
|
|
|
write_readme() {
|
|
local _dir="$1"; shift
|
|
[[ "${DRY_RUN:-false}" == "true" ]] && return 0
|
|
mkdir -p "$_dir"
|
|
cat > "$_dir/README.md"
|
|
}
|
|
backup_if_exists() {
|
|
local _file="$1"
|
|
[ -f "$_file" ] || return 0
|
|
cp -p "$_file" "${_file}.bak.$(date +%Y%m%d-%H%M%S)" 2>/dev/null
|
|
}
|
|
|
|
# Match common.sh's eval-based pattern so local vars in install_* are set correctly
|
|
prompt_text() {
|
|
local _q="$1" _def="$2" _var="$3" _r
|
|
[[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
|
|
read -r -p " $_q " _r
|
|
eval "$_var='${_r:-$_def}'"
|
|
}
|
|
|
|
prompt_yn() {
|
|
local _q="$1" _def="$2" _var="$3" _r
|
|
[[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
|
|
read -r -p " $_q " _r
|
|
eval "$_var='${_r:-$_def}'"
|
|
}
|
|
|
|
configure_caddy_for_service() {
|
|
local _name="$1" _upstream="$2" _subdomain="$3" _extra="${4:-}"
|
|
local _caddy_dir="$DOCKER_DIR/caddy"
|
|
local _caddyfile="$_caddy_dir/Caddyfile"
|
|
|
|
# Support remote Caddy host via CADDY_REMOTE_HOST
|
|
if [[ -n "${CADDY_REMOTE_HOST:-}" ]]; then
|
|
log_info "Remote Caddy detected at $CADDY_REMOTE_HOST — printing block to add manually."
|
|
echo ""
|
|
echo " Add the following to your Caddyfile on $CADDY_REMOTE_HOST:"
|
|
echo " ──────────────────────────────────────────────────────────"
|
|
echo " # $_name"
|
|
echo " ${_subdomain}.${SITE_DOMAIN:-example.com} {"
|
|
echo " reverse_proxy $_upstream"
|
|
[[ -n "$_extra" ]] && echo "$_extra"
|
|
echo " }"
|
|
echo " ──────────────────────────────────────────────────────────"
|
|
return 0
|
|
fi
|
|
|
|
if [[ ! -d "$_caddy_dir" ]]; then
|
|
log_info "Access $_name directly on port ${_upstream##*:}."
|
|
return 0
|
|
fi
|
|
|
|
echo ""
|
|
local _do_caddy=""
|
|
read -r -p " Configure Caddy reverse proxy for $_name? [y/N]: " _do_caddy
|
|
[[ "${_do_caddy,,}" == "y" ]] || {
|
|
log_info "Skipping — access at: http://localhost:${_upstream##*:}"
|
|
return 0
|
|
}
|
|
|
|
local _domain=""
|
|
read -r -p " Domain (e.g. ${_subdomain}.${SITE_DOMAIN:-example.com}): " _domain
|
|
[[ -n "$_domain" ]] || { log_warning "No domain entered — skipping Caddy."; return 0; }
|
|
|
|
# Back up before touching
|
|
if [[ -f "$_caddyfile" ]]; then
|
|
local _bk="$_caddy_dir/Caddyfile.backup.$(date +%Y%m%d-%H%M%S)"
|
|
cp "$_caddyfile" "$_bk"
|
|
log_info "Backed up Caddyfile to $(basename "$_bk")"
|
|
else
|
|
touch "$_caddyfile"
|
|
fi
|
|
|
|
# Remove existing block for this domain if present
|
|
if grep -q "^${_domain}" "$_caddyfile" 2>/dev/null; then
|
|
log_warning "$_domain already in Caddyfile"
|
|
local _ow=""
|
|
read -r -p " Overwrite? [y/N]: " _ow
|
|
[[ "${_ow,,}" == "y" ]] || { log_info "Keeping existing entry."; return 0; }
|
|
sed -i "/^${_domain}/,/^}/d" "$_caddyfile"
|
|
fi
|
|
|
|
cat >> "$_caddyfile" << CBLOCK
|
|
|
|
# $_name
|
|
$_domain {
|
|
reverse_proxy $_upstream
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "SAMEORIGIN"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
}
|
|
|
|
log {
|
|
output file /var/log/caddy/${_domain}.log
|
|
format json
|
|
}
|
|
${_extra}
|
|
}
|
|
CBLOCK
|
|
|
|
log_success "Added $_domain to Caddyfile"
|
|
docker exec caddy caddy fmt --overwrite /etc/caddy/Caddyfile 2>/dev/null || true
|
|
if docker exec caddy caddy reload --config /etc/caddy/Caddyfile 2>/dev/null; then
|
|
log_success "$_name accessible at: https://$_domain"
|
|
else
|
|
log_warning "Reload failed — check: docker logs caddy"
|
|
log_info "Manual reload: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
|
|
fi
|
|
}
|
|
fi
|
|
|
|
# Globals — ACTUAL_USER/ACTUAL_HOME must come before DOCKER_DIR
|
|
# ($HOME under sudo is /root, not the real user's home)
|
|
ACTUAL_USER="${ACTUAL_USER:-${SUDO_USER:-$USER}}"
|
|
ACTUAL_HOME="$(getent passwd "$ACTUAL_USER" 2>/dev/null | cut -d: -f6 || echo "${HOME:-/root}")"
|
|
DOCKER_DIR="${DOCKER_DIR:-$ACTUAL_HOME/docker}"
|
|
DRY_RUN="${DRY_RUN:-false}"
|
|
UNATTENDED="${UNATTENDED:-false}"
|
|
SITE_TZ="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
|
|
SITE_DOMAIN="${SITE_DOMAIN:-example.com}"
|
|
SITE_CADDY_NET="${SITE_CADDY_NET:-caddy_net}"
|
|
|
|
register_service() { :; } # no-op — no wizard to register into
|
|
_RUN_STANDALONE=1
|
|
fi
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
register_service onlyoffice utilities "Self-hosted OnlyOffice Document Server (Nextcloud/FileBrowser)" 8082
|
|
|
|
# yq install helper moved to lib/common.sh (ensure_yq) — shared with
|
|
# services/gatus.sh now that it needs the same thing.
|
|
|
|
# ── Helper: wire OnlyOffice into Nextcloud (idempotent) ───────────────────────
|
|
_wire_nextcloud() {
|
|
local _jwt="$1"
|
|
local _nc_container="nextcloud"
|
|
docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${_nc_container}$" || {
|
|
log_info "Nextcloud container not running — skipping Nextcloud wiring"
|
|
return 0
|
|
}
|
|
log_info "Wiring OnlyOffice into Nextcloud..."
|
|
docker exec "$_nc_container" php occ app:enable onlyoffice 2>/dev/null || true
|
|
docker exec "$_nc_container" php occ config:system:set onlyoffice DocumentServerUrl \
|
|
--value="https://office.${SITE_DOMAIN:-example.com}/" 2>/dev/null \
|
|
&& log_success "DocumentServerUrl set" || log_warning "Could not set DocumentServerUrl"
|
|
docker exec "$_nc_container" php occ config:system:set onlyoffice jwt_secret \
|
|
--value="$_jwt" 2>/dev/null \
|
|
&& log_success "jwt_secret set" || log_warning "Could not set jwt_secret"
|
|
docker exec "$_nc_container" php occ config:system:set onlyoffice jwt_header \
|
|
--value="AuthorizationJwt" 2>/dev/null \
|
|
&& log_success "jwt_header set" || log_warning "Could not set jwt_header"
|
|
}
|
|
|
|
# ── Helper: patch FileBrowser Quantum config.yaml with OnlyOffice endpoint ───
|
|
_wire_filebrowser() {
|
|
local _fbq_config="$DOCKER_DIR/filebrowser/config.yaml"
|
|
[[ -f "$_fbq_config" ]] || { log_info "FileBrowser config not found — skipping"; return 0; }
|
|
yq --version 2>/dev/null | grep -q mikefarah || { log_info "yq unavailable or incompatible — skipping FileBrowser wiring"; return 0; }
|
|
log_info "Wiring OnlyOffice into FileBrowser Quantum..."
|
|
yq e '.officeServer = "http://onlyoffice:80/"' -i "$_fbq_config" \
|
|
&& log_success "FileBrowser officeServer set" || log_warning "Could not patch FileBrowser config"
|
|
docker restart filebrowser 2>/dev/null && log_success "FileBrowser restarted" || true
|
|
}
|
|
|
|
install_onlyoffice() {
|
|
require_docker || return 1
|
|
declare -F ensure_yq >/dev/null 2>&1 && ensure_yq
|
|
|
|
log_info "Installing OnlyOffice Document Server..."
|
|
local DIR="$DOCKER_DIR/onlyoffice"
|
|
local WEB_PORT="8082"
|
|
|
|
if [ "$DRY_RUN" = true ]; then
|
|
echo "[DRY-RUN] Would create $DIR with docker-compose.yml, .env"
|
|
echo "[DRY-RUN] Would auto-scan for a free host port (8082 default)"
|
|
return 0
|
|
fi
|
|
|
|
# Scan for a free host port — a plain install shouldn't silently claim a
|
|
# port another already-running service holds. See CLAUDE.md's "Port
|
|
# collision avoidance" section.
|
|
find_free_port WEB_PORT "$WEB_PORT"
|
|
|
|
mkdir -p "$DIR"
|
|
ensure_docker_dir_ownership "$DIR"
|
|
cd "$DIR" || return 1
|
|
|
|
# ── Preserve JWT secret across re-runs ──────────────────────────────────
|
|
local JWT_SECRET=""
|
|
if [[ -f "$DIR/.env" ]]; then
|
|
JWT_SECRET=$(grep "^JWT_SECRET=" "$DIR/.env" 2>/dev/null | cut -d= -f2-)
|
|
fi
|
|
[[ -z "$JWT_SECRET" ]] && JWT_SECRET="$(generate_password 32)"
|
|
|
|
# Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
|
|
# explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
|
|
# then the legacy CADDY_REMOTE_HOST var. Only "local" joins caddy_net — a
|
|
# remote Caddy box can't resolve container names on this host's bridge
|
|
# network anyway; it reaches this service via the host's published port.
|
|
local _CADDY_MODE="${CADDY_MODE:-none}"
|
|
[ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
|
|
[ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
|
|
|
|
local _CADDY_NET_BLOCK=""
|
|
local _CADDY_NET_SECTION=""
|
|
if [ "$_CADDY_MODE" = "local" ]; then
|
|
_CADDY_NET_BLOCK=" networks:
|
|
- caddy_net
|
|
"
|
|
_CADDY_NET_SECTION="
|
|
networks:
|
|
caddy_net:
|
|
external: true
|
|
name: ${SITE_CADDY_NET:-caddy_net}
|
|
"
|
|
fi
|
|
|
|
# ── docker-compose.yml ──────────────────────────────────────────────────
|
|
backup_if_exists docker-compose.yml
|
|
cat > docker-compose.yml << OOCOMPOSE
|
|
name: onlyoffice
|
|
services:
|
|
onlyoffice:
|
|
image: onlyoffice/documentserver:latest
|
|
container_name: onlyoffice
|
|
hostname: onlyoffice
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
volumes:
|
|
- ./logs:/var/log/onlyoffice
|
|
- ./data:/var/www/onlyoffice/Data
|
|
- ./fonts:/usr/share/fonts/truetype/custom
|
|
ports:
|
|
- "${WEB_PORT}:80"
|
|
${_CADDY_NET_BLOCK}${_CADDY_NET_SECTION}
|
|
OOCOMPOSE
|
|
|
|
# ── .env ────────────────────────────────────────────────────────────────
|
|
backup_if_exists .env
|
|
cat > .env << OOENV
|
|
CADDY_NET=$SITE_CADDY_NET
|
|
# JWT authentication — keep JWT_SECRET private
|
|
JWT_ENABLED=true
|
|
JWT_SECRET=$JWT_SECRET
|
|
JWT_HEADER=AuthorizationJwt
|
|
OOENV
|
|
chmod 600 .env
|
|
|
|
# ── Subdirectories ──────────────────────────────────────────────────────
|
|
mkdir -p logs data fonts
|
|
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$DIR"
|
|
|
|
echo ""
|
|
log_success "OnlyOffice configured at $DIR"
|
|
|
|
# OnlyOffice must be embeddable as an iframe (Nextcloud / FileBrowser open
|
|
# documents in a frame). Override the default X-Frame-Options header that
|
|
# Caddy would otherwise set to SAMEORIGIN.
|
|
local OO_EXTRA_BLOCK=' header {
|
|
-X-Frame-Options
|
|
Content-Security-Policy "frame-ancestors '\''self'\'' *"
|
|
}'
|
|
configure_caddy_for_service "OnlyOffice" "onlyoffice:80" "office" "$OO_EXTRA_BLOCK"
|
|
|
|
# ── Prompt to start ─────────────────────────────────────────────────────
|
|
local START_OO=""
|
|
prompt_yn "Start OnlyOffice now? (y/n):" "y" START_OO
|
|
if [ "$START_OO" = "y" ] || [ "$START_OO" = "Y" ]; then
|
|
docker compose up -d \
|
|
&& log_success "OnlyOffice started" \
|
|
|| log_warning "Start failed — check: docker compose logs"
|
|
fi
|
|
|
|
# ── Wire integrations (runs every install/re-install) ───────────────────
|
|
echo ""
|
|
_wire_nextcloud "$JWT_SECRET"
|
|
_wire_filebrowser
|
|
|
|
# ── README ───────────────────────────────────────────────────────────────
|
|
write_readme "$DIR" << OOREAD
|
|
# OnlyOffice Document Server
|
|
|
|
Self-hosted document editing server, integrated with Nextcloud and FileBrowser Quantum.
|
|
|
|
## Access
|
|
|
|
- URL: https://office.${SITE_DOMAIN:-example.com} (or http://localhost:${WEB_PORT})
|
|
- The document server itself has no user-facing login page — it is accessed
|
|
through Nextcloud or FileBrowser Quantum.
|
|
|
|
## Manage
|
|
|
|
\`\`\`bash
|
|
docker compose up -d # start
|
|
docker compose down # stop
|
|
docker compose logs -f # follow logs
|
|
docker compose pull && docker compose up -d # update
|
|
\`\`\`
|
|
|
|
## JWT secret rotation
|
|
|
|
1. Generate a new secret:
|
|
\`\`\`bash
|
|
openssl rand -hex 24
|
|
\`\`\`
|
|
2. Update \`JWT_SECRET\` in \`$DIR/.env\`
|
|
3. Restart OnlyOffice:
|
|
\`\`\`bash
|
|
docker compose restart
|
|
\`\`\`
|
|
4. Update Nextcloud's stored secret:
|
|
\`\`\`bash
|
|
docker exec nextcloud php occ config:system:set onlyoffice jwt_secret --value="<new-secret>"
|
|
\`\`\`
|
|
|
|
## Verify Nextcloud integration
|
|
|
|
\`\`\`bash
|
|
docker exec nextcloud php occ config:system:get onlyoffice
|
|
\`\`\`
|
|
|
|
## Verify FileBrowser integration
|
|
|
|
\`\`\`bash
|
|
grep officeServer $DOCKER_DIR/filebrowser/config.yaml
|
|
\`\`\`
|
|
|
|
## Add custom fonts
|
|
|
|
Copy \`.ttf\` / \`.otf\` font files into \`$DIR/fonts/\`, then restart the container.
|
|
OOREAD
|
|
|
|
echo ""
|
|
echo " OnlyOffice Document Server"
|
|
echo " Access URL: http://localhost:${WEB_PORT}"
|
|
echo " JWT secret: $JWT_SECRET"
|
|
echo " Config dir: $DIR"
|
|
echo ""
|
|
echo " Integration status:"
|
|
docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^nextcloud$" \
|
|
&& echo " Nextcloud: wired (onlyoffice app + JWT configured)" \
|
|
|| echo " Nextcloud: not running — wire manually after starting Nextcloud"
|
|
[[ -f "$DOCKER_DIR/filebrowser/config.yaml" ]] \
|
|
&& echo " FileBrowser: config.yaml patched" \
|
|
|| echo " FileBrowser: config not found — will wire on next onlyoffice install"
|
|
echo ""
|
|
}
|
|
|
|
# Run immediately when executed directly (deferred until after function definition)
|
|
[[ "${_RUN_STANDALONE:-0}" == 1 ]] && install_onlyoffice
|