services:

  # ─────────────────────────────────────────────
  # ONLYOFFICE Document Server (modalità lite)
  # Usa SQLite + memoria interna, niente PostgreSQL/RabbitMQ
  # ─────────────────────────────────────────────
  onlyoffice:
    image: onlyoffice/documentserver:latest
    container_name: onlyoffice
    restart: unless-stopped
    environment:
      JWT_ENABLED: "true"
      JWT_SECRET: ${JWT_SECRET}
      JWT_HEADER: Authorization
    volumes:
      - onlyoffice_data:/var/www/onlyoffice/Data
      - onlyoffice_logs:/var/log/onlyoffice
      - onlyoffice_lib:/var/lib/onlyoffice
    expose:
      - "80"
    # Limiti risorse — adatta in base alla RAM disponibile
    mem_limit: 1g
    mem_reservation: 512m
    cpus: "1.0"
    networks:
      - office_net

  # ─────────────────────────────────────────────
  # Cloudflare Tunnel — nessuna porta esposta
  # Instrada il traffico da Cloudflare → onlyoffice:80
  # ─────────────────────────────────────────────
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    restart: unless-stopped
    command: tunnel --no-autoupdate run --token ${CLOUDFLARE_TOKEN}
    mem_limit: 128m
    mem_reservation: 64m
    cpus: "0.25"
    depends_on:
      - onlyoffice
    networks:
      - office_net

# ─────────────────────────────────────────────
# Volumi persistenti
# ─────────────────────────────────────────────
volumes:
  onlyoffice_data:
  onlyoffice_logs:
  onlyoffice_lib:

# ─────────────────────────────────────────────
# Rete interna
# ─────────────────────────────────────────────
networks:
  office_net:
    driver: bridge