From a1c57ca899e488100893f0e7465f96ac597cc459 Mon Sep 17 00:00:00 2001
From: ginnoir <ginnoir@users.noreply.github.com>
Date: Mon, 15 Jun 2026 22:55:00 -0500
Subject: [PATCH] feat: add Nextcloud + OnlyOffice files stack

Replaces ownCloud with Nextcloud (postgres + redis) and adds OnlyOffice
Document Server for Google Docs-style editing. Migration is staged:
nextcloud.ginnoir.com for testing, files.ginnoir.com still points at
ownCloud until cutover is verified.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 Caddyfile                       | 21 +++++++++++
 stacks/files/docker-compose.yml | 63 +++++++++++++++++++++++++++++++++
 stacks/files/stack.env          | 13 +++++++
 3 files changed, 97 insertions(+)
 create mode 100644 stacks/files/docker-compose.yml
 create mode 100644 stacks/files/stack.env

diff --git a/Caddyfile b/Caddyfile
index 7764dd7..0dbc706 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -473,6 +473,27 @@ plane.ginnoir.com {
 	}
 }
 
+# =============================================================
+# FILES / DOCUMENTS — internal only
+# nextcloud.ginnoir.com is the staging domain during migration;
+# files.ginnoir.com still points at ownCloud until cutover.
+# office.ginnoir.com serves the OnlyOffice document server.
+# =============================================================
+nextcloud.ginnoir.com {
+	import internal_only
+	redir /.well-known/carddav /remote.php/dav 301
+	redir /.well-known/caldav /remote.php/dav 301
+	reverse_proxy nextcloud:80 {
+		header_up X-Forwarded-Proto https
+		header_up X-Real-IP {remote_host}
+	}
+}
+
+office.ginnoir.com {
+	import internal_only
+	reverse_proxy onlyoffice-docs:80
+}
+
 # =============================================================
 # PHOTOS — internal only
 # =============================================================
diff --git a/stacks/files/docker-compose.yml b/stacks/files/docker-compose.yml
new file mode 100644
index 0000000..f5b8479
--- /dev/null
+++ b/stacks/files/docker-compose.yml
@@ -0,0 +1,63 @@
+# files stack — Nextcloud + OnlyOffice document server.
+# User data on ZFS (/storage1/labdata/nextcloud/data).
+# Config/DB on SSD (/config/nextcloud/, /config/onlyoffice/).
+# Internal-only: files.ginnoir.com + office.ginnoir.com require LAN or tailnet.
+
+services:
+  nextcloud:
+    container_name: nextcloud
+    image: nextcloud:apache
+    restart: unless-stopped
+    networks: [files, edge]
+    env_file:
+      - stack.env
+    volumes:
+      - /config/nextcloud/html:/var/www/html
+      - /storage1/labdata/nextcloud/data:/var/www/html/data
+      - /storage1/Books:/mnt/books:ro
+    depends_on:
+      - nextcloud-postgres
+      - nextcloud-redis
+    labels:
+      com.centurylabs.watchtower.enable: "false"
+
+  nextcloud-postgres:
+    container_name: nextcloud-postgres
+    image: postgres:16-alpine
+    restart: unless-stopped
+    networks: [files]
+    env_file:
+      - stack.env
+    volumes:
+      - /config/nextcloud/pgdata:/var/lib/postgresql/data
+    labels:
+      com.centurylabs.watchtower.enable: "false"
+
+  nextcloud-redis:
+    container_name: nextcloud-redis
+    image: redis:7-alpine
+    restart: unless-stopped
+    networks: [files]
+    labels:
+      com.centurylabs.watchtower.enable: "false"
+
+  onlyoffice-docs:
+    container_name: onlyoffice-docs
+    image: onlyoffice/documentserver:latest
+    restart: unless-stopped
+    networks: [files, edge]
+    env_file:
+      - stack.env
+    volumes:
+      - /config/onlyoffice/data:/var/lib/onlyoffice
+      - /config/onlyoffice/logs:/var/log/onlyoffice
+    labels:
+      com.centurylabs.watchtower.enable: "false"
+
+networks:
+  files:
+    name: files
+    driver: bridge
+  edge:
+    name: edge
+    external: true
diff --git a/stacks/files/stack.env b/stacks/files/stack.env
new file mode 100644
index 0000000..cc7f2be
--- /dev/null
+++ b/stacks/files/stack.env
@@ -0,0 +1,13 @@
+# Nextcloud
+NEXTCLOUD_ADMIN_USER=ginnoir
+NEXTCLOUD_ADMIN_PASSWORD=ctc2dq7ZlsgIKikQtemcGGwtqMTASfM
+NEXTCLOUD_TRUSTED_DOMAINS=files.ginnoir.com nextcloud.ginnoir.com
+POSTGRES_HOST=nextcloud-postgres
+POSTGRES_DB=nextcloud
+POSTGRES_USER=nextcloud
+POSTGRES_PASSWORD=WZn3ljZBEXE45EX4JvPrrBbqDkIPE2
+REDIS_HOST=nextcloud-redis
+
+# OnlyOffice document server
+JWT_ENABLED=true
+JWT_SECRET=UhZ8tBlHbbsZhwgPKJKREhFI55RPe4SwBIAoz7xMGM