Add Audiobookshelf, Jellyfin, Wiki, Music Assistant, InfluxDB,
Proxmox Backup Server, and Proxmox VE endpoints.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Check actual response content not just status codes:
- ownCloud: use OCS capabilities endpoint, check ocs.meta.status
- ONLYOFFICE: verify body is 'true'
- Grafana: check database == ok
- Immich: check res == pong
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Woodpecker returns 204, accept both 200 and 204
- Home Assistant is at home.renner.uno not ha.renner.uno
- Skip TLS verify for Grafana (EOL VM cert issue)
- Add Proxmox DNS to container for hostname resolution
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
LXC 237 on jupiter, 512MB RAM, 1 core.
Monitors all web services, DNS, RustFS, and PostgreSQL.
Status page at https://status.renner.uno.
Supports email alerts and webhook notifications.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Mount point volume format needs numeric size without G suffix.
Restore separate taint and apply commands in pipeline.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Taint with same VMID causes create-before-destroy which destroys
the newly created container. -replace handles this correctly.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Store user data on /mnt/data/owncloud (dedicated disk) instead of
the root filesystem. Reduces root disk to 10G.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Both replaced by ownCloud with ONLYOFFICE for spreadsheet needs
and no longer required.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Collaboration container gets its own env vars (not shared .env).
WOPI_SRC points to collaboration container, not public URL.
Follows owncloud/ocis deployments/examples/ocis_full/onlyoffice.yml.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
NATS defaults to 127.0.0.1 which blocks the collaboration container.
Set NATS_NATS_HOST=0.0.0.0 on main container, and point collaboration
to ocis:9233 via MICRO_REGISTRY_ADDRESS.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Separate container can't reach 127.0.0.1:9233. Configure NATS
and service registry to connect to ocis container via Docker network.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
OCIS_ADD_RUN_SERVICES doesn't work in v8.0.0. Run collaboration
as a separate container with shared config/data volumes, depending
on both oCIS and ONLYOFFICE health.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
EXCLUDE and ADD are not mutually exclusive (only RUN and EXCLUDE are).
Need to exclude IDP for Authentik OIDC while adding collaboration.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The two env vars are mutually exclusive. Use only ADD to include
collaboration, which keeps the default service list plus IDP.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Per docs, these are mutually exclusive. OCIS_RUN_SERVICES takes
precedence and OCIS_EXCLUDE_RUN_SERVICES has no effect when both set.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
OCIS_ADD_RUN_SERVICES and background process don't work.
Explicitly list all services including collaboration via OCIS_RUN_SERVICES.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
oCIS needs to iframe ONLYOFFICE. ONLYOFFICE's own CSP/X-Frame-Options
headers need to be stripped by Caddy to allow cross-origin framing.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Collaboration service needs NATS (from ocis server) and ONLYOFFICE
to be ready before it starts. Add 15s delay and depends_on health.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The collaboration service doesn't start with 'ocis server' by default.
It needs to be started separately via 'ocis collaboration server'.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
oCIS collaboration service connects to ONLYOFFICE via the
docker-compose network (http://onlyoffice:80), not the public URL.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds ONLYOFFICE container alongside oCIS with WOPI integration.
Includes Caddy backend at office.renner.uno and DNS CNAME.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Documents Loki + Grafana Alloy log aggregation setup.
Clarifies that logs should be checked via Grafana, not SSH.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
App store loads images from raw.githubusercontent.com.
Allow frame-ancestors 'self' for oCIS internal iframes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The JSON env var wasn't being parsed correctly. oCIS reads
per-service YAML configs from /etc/ocis/<service>.yaml.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
PROXY_ROLE_ASSIGNMENT_FILE doesn't exist. Role mappings must be
set via PROXY_ROLE_ASSIGNMENT_OIDC_ROLE_MAPPER_ROLE_MAPPING.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Authentik now has a signing key configured, enabling RS256 JWT
verification via JWKS. This allows oCIS to read claims (including
groups) directly from the access token.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Maps Authentik groups (ocis-admin, ocis-spaceadmin, ocis-user)
to oCIS roles. Requires groups scope in OIDC token.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Force overwrite regenerates JWT secrets on every restart,
invalidating all tokens and breaking OIDC authentication.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Users authenticated via Authentik need to be auto-provisioned
in oCIS since they don't exist in the built-in IDM.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Browser blocks connect to auth.renner.uno due to default CSP
'connect-src self'. Add custom csp.yaml allowing the OIDC issuer.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use --force-overwrite so env vars (including OIDC config) are
always applied to the generated ocis.yaml config.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
oCIS runs as UID 1000 inside the container and needs write access
to /etc/ocis for init and /var/lib/ocis for data storage.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
