apps-int01/README.md

Ja. Dann wuerde ich fuer `apps-int01` die Dienste als **getrennte Compose-Dateien pro App** bauen. Das passt zu deiner Struktur unter `/srv/apps-int01/compose/...` und zu deiner App-Liste auf `apps-int01`: Vaultwarden, Paperless, XWiki, Nextcloud, Seafile und OnlyOffice [1].

Ich wuerde ausserdem pro App:
- ein eigenes internes Docker-Netz nehmen
- nur Web-Frontends zusaetzlich an `proxy-nw` haengen
- Daten konsequent unter `/srv/apps-int01/data/...` halten
- Konfigurationen unter `/srv/apps-int01/config/...` halten

## Vorab: externes Proxy-Netz einmalig anlegen
Falls noch nicht vorhanden:

```bash
docker network create proxy-nw
```

---

# 1. Vaultwarden
Datei:
`/srv/apps-int01/compose/vaultwarden/compose.yaml`

```yaml
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      TZ: Europe/Zurich
      SIGNUPS_ALLOWED: "false"
      WEBSOCKET_ENABLED: "true"
      ADMIN_TOKEN: "CHANGE_ME_ADMIN_TOKEN"
    volumes:
      - /srv/apps-int01/data/vaultwarden/data:/data
    networks:
      - proxy-nw
      - vaultwarden-nw
    healthcheck:
      test: ["CMD", "/vaultwarden", "--version"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s

networks:
  proxy-nw:
    external: true
  vaultwarden-nw:
    driver: bridge
```

Starten:
```bash
cd /srv/apps-int01/compose/vaultwarden
docker compose up -d
```

---

# 2. Paperless
Datei:
`/srv/apps-int01/compose/paperless/compose.yaml`

```yaml
services:
  broker:
    image: redis:7-alpine
    container_name: paperless-redis
    restart: unless-stopped
    volumes:
      - /srv/apps-int01/data/paperless/redis:/data
    networks:
      - paperless-nw

  db:
    image: postgres:16-alpine
    container_name: paperless-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: paperless
      POSTGRES_USER: paperless
      POSTGRES_PASSWORD: "CHANGE_ME_DB_PASSWORD"
    volumes:
      - /srv/apps-int01/data/paperless/db:/var/lib/postgresql/data
    networks:
      - paperless-nw
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U paperless -d paperless"]
      interval: 10s
      timeout: 5s
      retries: 5

  webserver:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    container_name: paperless
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      broker:
        condition: service_started
    environment:
      TZ: Europe/Zurich
      PAPERLESS_REDIS: redis://broker:6379
      PAPERLESS_DBHOST: db
      PAPERLESS_DBNAME: paperless
      PAPERLESS_DBUSER: paperless
      PAPERLESS_DBPASS: "CHANGE_ME_DB_PASSWORD"
      PAPERLESS_SECRET_KEY: "CHANGE_ME_SECRET_KEY"
      PAPERLESS_URL: "https://paperless.example.internal"
      PAPERLESS_TIME_ZONE: Europe/Zurich
      PAPERLESS_OCR_LANGUAGE: deu+eng
    volumes:
      - /srv/apps-int01/data/paperless/data:/usr/src/paperless/data
      - /srv/apps-int01/data/paperless/media:/usr/src/paperless/media
      - /srv/apps-int01/data/paperless/export:/usr/src/paperless/export
      - /srv/apps-int01/data/paperless/consume:/usr/src/paperless/consume
    networks:
      - proxy-nw
      - paperless-nw
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8000 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s

networks:
  proxy-nw:
    external: true
  paperless-nw:
    driver: bridge
```

Hinweis: In deiner bisherigen Ordnerstruktur fuer `paperless` waren `data`, `media`, `export` und `consume` bereits vorgesehen [1]. Fuer diese Compose kommt noch `db` und `redis` dazu.

---

# 3. XWiki
Datei:
`/srv/apps-int01/compose/xwiki/compose.yaml`

```yaml
services:
  db:
    image: postgres:16-alpine
    container_name: xwiki-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: xwiki
      POSTGRES_USER: xwiki
      POSTGRES_PASSWORD: "CHANGE_ME_DB_PASSWORD"
    volumes:
      - /srv/apps-int01/data/xwiki/db:/var/lib/postgresql/data
    networks:
      - xwiki-nw
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U xwiki -d xwiki"]
      interval: 10s
      timeout: 5s
      retries: 5

  xwiki:
    image: xwiki:stable-postgres-tomcat
    container_name: xwiki
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      TZ: Europe/Zurich
      DB_HOST: db
      DB_DATABASE: xwiki
      DB_USER: xwiki
      DB_PASSWORD: "CHANGE_ME_DB_PASSWORD"
    volumes:
      - /srv/apps-int01/data/xwiki/data:/usr/local/xwiki
    networks:
      - proxy-nw
      - xwiki-nw
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8080 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

networks:
  proxy-nw:
    external: true
  xwiki-nw:
    driver: bridge
```

---

# 4. Nextcloud
Datei:
`/srv/apps-int01/compose/nextcloud/compose.yaml`

```yaml
services:
  db:
    image: mariadb:11
    container_name: nextcloud-db
    restart: unless-stopped
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    environment:
      MYSQL_ROOT_PASSWORD: "CHANGE_ME_ROOT_PASSWORD"
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD"
    volumes:
      - /srv/apps-int01/data/nextcloud/db:/var/lib/mysql
    networks:
      - nextcloud-nw
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  redis:
    image: redis:7-alpine
    container_name: nextcloud-redis
    restart: unless-stopped
    volumes:
      - /srv/apps-int01/data/nextcloud/redis:/data
    networks:
      - nextcloud-nw

  app:
    image: nextcloud:apache
    container_name: nextcloud
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    environment:
      TZ: Europe/Zurich
      MYSQL_HOST: db
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD"
      REDIS_HOST: redis
      NEXTCLOUD_TRUSTED_DOMAINS: "nextcloud.example.internal"
      OVERWRITEHOST: "nextcloud.example.internal"
      OVERWRITEPROTOCOL: "https"
    volumes:
      - /srv/apps-int01/data/nextcloud/app:/var/www/html
      - /srv/apps-int01/data/nextcloud/data:/var/www/html/data
    networks:
      - proxy-nw
      - nextcloud-nw
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost/status.php || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

  cron:
    image: nextcloud:apache
    container_name: nextcloud-cron
    restart: unless-stopped
    entrypoint: /cron.sh
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    environment:
      TZ: Europe/Zurich
      MYSQL_HOST: db
      MYSQL_DATABASE: nextcloud
      MYSQL_USER: nextcloud
      MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD"
      REDIS_HOST: redis
    volumes:
      - /srv/apps-int01/data/nextcloud/app:/var/www/html
      - /srv/apps-int01/data/nextcloud/data:/var/www/html/data
    networks:
      - nextcloud-nw

networks:
  proxy-nw:
    external: true
  nextcloud-nw:
    driver: bridge
```

Da du Nextcloud nur fuer Kalender, Aufgaben und Kontakte nutzt, ist das auf `apps-int01` weiterhin gut vertretbar [1].

---

# 5. Seafile
Datei:
`/srv/apps-int01/compose/seafile/compose.yaml`

```yaml
services:
  db:
    image: mariadb:11
    container_name: seafile-db
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: "CHANGE_ME_ROOT_PASSWORD"
      MYSQL_DATABASE: seafile
      MYSQL_USER: seafile
      MYSQL_PASSWORD: "CHANGE_ME_DB_PASSWORD"
    volumes:
      - /srv/apps-int01/data/seafile/mariadb:/var/lib/mysql
    networks:
      - seafile-nw
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  memcached:
    image: memcached:alpine
    container_name: seafile-memcached
    restart: unless-stopped
    networks:
      - seafile-nw

  seafile:
    image: seafileltd/seafile-mc:latest
    container_name: seafile
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      memcached:
        condition: service_started
    environment:
      DB_HOST: db
      DB_ROOT_PASSWD: "CHANGE_ME_ROOT_PASSWORD"
      TIME_ZONE: Europe/Zurich
      SEAFILE_ADMIN_EMAIL: "admin@example.internal"
      SEAFILE_ADMIN_PASSWORD: "CHANGE_ME_ADMIN_PASSWORD"
      SEAFILE_SERVER_LETSENCRYPT: "false"
      SEAFILE_SERVER_HOSTNAME: "seafile.example.internal"
    volumes:
      - /srv/apps-int01/data/seafile/data:/shared
    networks:
      - proxy-nw
      - seafile-nw
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:80 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

networks:
  proxy-nw:
    external: true
  seafile-nw:
    driver: bridge
```

In deiner bisherigen Struktur fuer Seafile waren `data`, `db` und `mariadb` vorgesehen [1]. Ich wuerde fuer dieses Compose effektiv `mariadb` als Datenpfad nutzen; `db` kannst du reserviert lassen oder spaeter streichen.

---

# 6. OnlyOffice
Datei:
`/srv/apps-int01/compose/onlyoffice/compose.yaml`

```yaml
services:
  onlyoffice:
    image: onlyoffice/documentserver:latest
    container_name: onlyoffice
    restart: unless-stopped
    environment:
      TZ: Europe/Zurich
      JWT_ENABLED: "true"
      JWT_SECRET: "CHANGE_ME_JWT_SECRET"
    volumes:
      - /srv/apps-int01/data/onlyoffice/data:/var/www/onlyoffice/Data
      - /srv/apps-int01/data/onlyoffice/logs:/var/log/onlyoffice
    networks:
      - proxy-nw
      - onlyoffice-nw
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost/healthcheck || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s

networks:
  proxy-nw:
    external: true
  onlyoffice-nw:
    driver: bridge
```

---

## Startreihenfolge
Ich wuerde auf `apps-int01` so starten:

1. vaultwarden
2. paperless
3. xwiki
4. nextcloud
5. seafile
6. onlyoffice

Das passt auch dazu, dass `apps-int01` deine zentrale interne App-VM fuer genau diese Dienste ist [1].

## Startbefehle
Je App:

```bash
cd /srv/apps-int01/compose/vaultwarden && docker compose up -d
cd /srv/apps-int01/compose/paperless && docker compose up -d
cd /srv/apps-int01/compose/xwiki && docker compose up -d
cd /srv/apps-int01/compose/nextcloud && docker compose up -d
cd /srv/apps-int01/compose/seafile && docker compose up -d
cd /srv/apps-int01/compose/onlyoffice && docker compose up -d
```

## Wichtiger Hinweis
Ein Teil der Image-Details und Environment-Variablen oben stammt aus allgemeinem Docker-/App-Wissen, nicht direkt aus deinem Kontext. Die App-Zuordnung, die Struktur unter `/srv/apps-int01` und die Diensteliste fuer `apps-int01` kommen aus deinem vorhandenen Plan [1].

Wenn du willst, mache ich dir als naechstes die Compose-Dateien auch noch direkt:
- mit deinen echten FQDNs
- mit `10.100.20.49` als DNS
- und ohne Healthchecks, falls du sie erstmal schlanker willst.