
services:
  opencloud:
    image: opencloudeu/opencloud-rolling:latest
    container_name: opencloud
    ports:
      - "0.0.0.0:9200:9200"
    volumes:
      - /rpool/encrypted/docker/opencloud4/opencloud-sandbox/config:/etc/opencloud
      - /rpool/encrypted/docker/opencloud4/opencloud-sandbox/data:/var/lib/opencloud
      - /DD-12T/opencloud-tmp:/tmp
      - /rpool/encrypted/docker/opencloud4/opencloud-sandbox/csp.yaml:/etc/opencloud/csp.yaml
      - /rpool/encrypted/docker/opencloud4/opencloud-sandbox/proxy.yaml:/etc/opencloud/proxy.yaml
    environment:
      PROXY_HTTP_ADDR: "0.0.0.0:9200"

      # URL publique (doc OpenCloud)
      OC_URL: "https://owncloud2.home.patat-monnot.com"

      # Reverse proxy TLS
      OC_PROXY_TLS: "true"  #changement

      # Domaine autorisé
      OC_TRUSTED_DOMAINS: "owncloud2.home.patat-monnot.com"
      INSECURE: "false"     #changement

      OC_LOG_LEVEL: debug
      OC_LOG_COLOR: true 
      OC_LOG_PRETTY: true 
      # do not use SSL between the reverse proxy and OpenCloud
      PROXY_TLS: "false"

      # activate decomposeds3 storage driver
      STORAGE_USERS_DRIVER: decomposeds3
      # keep system data on opencloud storage since this are only small files atm
      STORAGE_SYSTEM_DRIVER: decomposed
      # decomposeds3 specific settings
      STORAGE_USERS_DECOMPOSEDS3_ENDPOINT: http://minio:9000
      STORAGE_USERS_DECOMPOSEDS3_REGION: default 
      STORAGE_USERS_DECOMPOSEDS3_ACCESS_KEY: root
      STORAGE_USERS_DECOMPOSEDS3_SECRET_KEY: MaNu2506
      STORAGE_USERS_DECOMPOSEDS3_BUCKET: ocis
      STORAGE_USERS_EVENTS_NUM_CONSUMERS: 5

# OIDC
      OC_OIDC_ISSUER: "https://auth.home.patat-monnot.com"
      WEB_OIDC_CLIENT_ID: id-opencloud
      ## Proxy
      PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD: none
      PROXY_AUTOPROVISION_ACCOUNTS: "true"
      #PROXY_ROLE_ASSIGNMENT_DRIVER: "oidc"
      PROXY_ROLE_ASSIGNMENT_DRIVER: "default"
      PROXY_USER_OIDC_CLAIM: "preferred_username"
      PROXY_USER_CS3_CLAIM: "username"
      ## role assignment
      PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM: 'groups'
      WEB_OIDC_SCOPE: openid profile email groups
      GRAPH_ASSIGN_DEFAULT_USER_ROLE: "true"
      GRAPH_USERNAME_MATCH: "none"
      OC_EXCLUDE_RUN_SERVICES: "idp"
      PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml
#adone
            # --- Configuration Desktop / OIDC ---
      PROXY_OIDC_REWRITE_WELLKNOWN: "true"
      PROXY_OIDC_NATIVE_CLIENT_ID: "OpenCloudDesktop"
    
    
      # Ajout du scope offline_access (vérifié dans la doc oCIS pour le refresh token)
      OCIS_OIDC_SCOPE: "openid profile email groups offline_access ocis"

    networks:
      - internalnet
    restart: unless-stopped

  radicale:
    image: opencloudeu/radicale 
    networks:
     - internalnet
    restart: always
    volumes:
      - /rpool/encrypted/docker/opencloud4/opencloud-sandbox/radicale/config:/etc/radicale/config:ro
      - /rpool/encrypted/docker/opencloud4/opencloud-sandbox/data/radicale:/var/lib/radicale

networks:
  internalnet:
    external: true
    name: ocis-internalnet


