feat: add Nextcloud + OnlyOffice files stack

Replaces ownCloud with Nextcloud (postgres + redis) and adds OnlyOffice
Document Server for Google Docs-style editing. Migration is staged:
nextcloud.ginnoir.com for testing, files.ginnoir.com still points at
ownCloud until cutover is verified.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Caddyfile

@@ -473,6 +473,27 @@ plane.ginnoir.com {
 	}
 }
 
+# =============================================================
+# FILES / DOCUMENTS — internal only
+# nextcloud.ginnoir.com is the staging domain during migration;
+# files.ginnoir.com still points at ownCloud until cutover.
+# office.ginnoir.com serves the OnlyOffice document server.
+# =============================================================
+nextcloud.ginnoir.com {
+	import internal_only
+	redir /.well-known/carddav /remote.php/dav 301
+	redir /.well-known/caldav /remote.php/dav 301
+	reverse_proxy nextcloud:80 {
+		header_up X-Forwarded-Proto https
+		header_up X-Real-IP {remote_host}
+	}
+}
+
+office.ginnoir.com {
+	import internal_only
+	reverse_proxy onlyoffice-docs:80
+}
+
 # =============================================================
 # PHOTOS — internal only
 # =============================================================

stacks/files/docker-compose.yml

@@ -0,0 +1,63 @@
+# files stack — Nextcloud + OnlyOffice document server.
+# User data on ZFS (/storage1/labdata/nextcloud/data).
+# Config/DB on SSD (/config/nextcloud/, /config/onlyoffice/).
+# Internal-only: files.ginnoir.com + office.ginnoir.com require LAN or tailnet.
+
+services:
+  nextcloud:
+    container_name: nextcloud
+    image: nextcloud:apache
+    restart: unless-stopped
+    networks: [files, edge]
+    env_file:
+      - stack.env
+    volumes:
+      - /config/nextcloud/html:/var/www/html
+      - /storage1/labdata/nextcloud/data:/var/www/html/data
+      - /storage1/Books:/mnt/books:ro
+    depends_on:
+      - nextcloud-postgres
+      - nextcloud-redis
+    labels:
+      com.centurylabs.watchtower.enable: "false"
+
+  nextcloud-postgres:
+    container_name: nextcloud-postgres
+    image: postgres:16-alpine
+    restart: unless-stopped
+    networks: [files]
+    env_file:
+      - stack.env
+    volumes:
+      - /config/nextcloud/pgdata:/var/lib/postgresql/data
+    labels:
+      com.centurylabs.watchtower.enable: "false"
+
+  nextcloud-redis:
+    container_name: nextcloud-redis
+    image: redis:7-alpine
+    restart: unless-stopped
+    networks: [files]
+    labels:
+      com.centurylabs.watchtower.enable: "false"
+
+  onlyoffice-docs:
+    container_name: onlyoffice-docs
+    image: onlyoffice/documentserver:latest
+    restart: unless-stopped
+    networks: [files, edge]
+    env_file:
+      - stack.env
+    volumes:
+      - /config/onlyoffice/data:/var/lib/onlyoffice
+      - /config/onlyoffice/logs:/var/log/onlyoffice
+    labels:
+      com.centurylabs.watchtower.enable: "false"
+
+networks:
+  files:
+    name: files
+    driver: bridge
+  edge:
+    name: edge
+    external: true

stacks/files/stack.env

@@ -0,0 +1,13 @@
+# Nextcloud
+NEXTCLOUD_ADMIN_USER=ginnoir
+NEXTCLOUD_ADMIN_PASSWORD=ctc2dq7ZlsgIKikQtemcGGwtqMTASfM
+NEXTCLOUD_TRUSTED_DOMAINS=files.ginnoir.com nextcloud.ginnoir.com
+POSTGRES_HOST=nextcloud-postgres
+POSTGRES_DB=nextcloud
+POSTGRES_USER=nextcloud
+POSTGRES_PASSWORD=WZn3ljZBEXE45EX4JvPrrBbqDkIPE2
+REDIS_HOST=nextcloud-redis
+
+# OnlyOffice document server
+JWT_ENABLED=true
+JWT_SECRET=UhZ8tBlHbbsZhwgPKJKREhFI55RPe4SwBIAoz7xMGM