services:

  # ─────────────────────────────────────────────
  # ONLYOFFICE Docs — editor web standalone
  # Accessibile direttamente dal browser via tunnel
  # ─────────────────────────────────────────────
  onlyoffice:
    image: onlyoffice/documentserver:latest
    container_name: onlyoffice
    restart: unless-stopped
    environment:
      JWT_ENABLED: "true"
      JWT_SECRET: ${JWT_SECRET}
      JWT_HEADER: Authorization
      # Necessario per funzionare correttamente dietro proxy/tunnel
      WOPI_ENABLED: "true"
    volumes:
      - onlyoffice_data:/var/www/onlyoffice/Data
      - onlyoffice_logs:/var/log/onlyoffice
      - onlyoffice_lib:/var/lib/onlyoffice
    expose:
      - "80"
    mem_limit: 1g
    mem_reservation: 512m
    cpus: "1.0"
    networks:
      - office_net

  # ─────────────────────────────────────────────
  # Cloudflare Tunnel
  # Espone onlyoffice:80 verso il dominio configurato
  # ─────────────────────────────────────────────
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    restart: unless-stopped
    command: tunnel --no-autoupdate run --token ${CLOUDFLARE_TOKEN}
    mem_limit: 128m
    mem_reservation: 64m
    cpus: "0.25"
    depends_on:
      - onlyoffice
    networks:
      - office_net

# ─────────────────────────────────────────────
# Volumi persistenti
# ─────────────────────────────────────────────
volumes:
  onlyoffice_data:
  onlyoffice_logs:
  onlyoffice_lib:

# ─────────────────────────────────────────────
# Rete interna
# ─────────────────────────────────────────────
networks:
  office_net:
    driver: bridge