Skip to content

feat(standalone): configurable file-size limits + Postgres schema bootstrap #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ckbaker10 wants to merge 2 commits into from
Closed

feat(standalone): configurable file-size limits + Postgres schema bootstrap #301

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
600d90c
Filesize env variables
ckbaker10 Jul 27, 2026
bcbdebc
Ensure schema is loaded
ckbaker10 Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 67 additions & 2 deletions build/scripts/standalone/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ EXAMPLE_LOCAL="${EXAMPLE_CONF_DIR}/local.json"
NGINX_CONFIG_PATH="/etc/nginx/nginx.conf"
NGINX_DS_DIR="${EO_CONF}/nginx"
NGINX_DS_CONF="${NGINX_DS_DIR}/ds.conf"
NGINX_DS_COMMON_CONF="${NGINX_DS_DIR}/includes/ds-common.conf"
NGINX_DS_SSL_TMPL="${NGINX_DS_DIR}/ds-ssl.conf.tmpl"
SUPERVISOR_CONF_DIR="/etc/supervisor/conf.d"

Expand Down Expand Up @@ -46,8 +47,13 @@ METRICS_PORT="${METRICS_PORT:-8125}"
METRICS_PREFIX="${METRICS_PREFIX:-ds.}"
GENERATE_FONTS="${GENERATE_FONTS:-true}"

MAX_FILE_SIZE="${MAX_FILE_SIZE:-104857600}"
MAX_ZIP_UNCOMPRESSED_DOC="${MAX_ZIP_UNCOMPRESSED_DOC:-50MB}"
MAX_ZIP_UNCOMPRESSED_XLSX="${MAX_ZIP_UNCOMPRESSED_XLSX:-300MB}"

NGINX_WORKER_PROCESSES="${NGINX_WORKER_PROCESSES:-1}"
NGINX_ACCESS_LOG="${NGINX_ACCESS_LOG:-false}"
NGINX_CLIENT_MAX_BODY_SIZE="${NGINX_CLIENT_MAX_BODY_SIZE:-100m}"
SSL_VERIFY_CLIENT="${SSL_VERIFY_CLIENT:-off}"
ONLYOFFICE_HTTPS_HSTS_ENABLED="${ONLYOFFICE_HTTPS_HSTS_ENABLED:-true}"
ONLYOFFICE_HTTPS_HSTS_MAXAGE="${ONLYOFFICE_HTTPS_HSTS_MAXAGE:-31536000}"
Expand Down Expand Up @@ -234,6 +240,20 @@ fi
[ "$ALLOW_META_IP_ADDRESS" = "true" ] && \
jq_set '.services.CoAuthoring["request-filtering-agent"].allowMetaIPAddress = true'

# Upload / conversion size limits
# limits_tempfile_upload and maxDownloadBytes are simple scalars — override via local.json
jq_set '.services.CoAuthoring.server.limits_tempfile_upload = ($maxFileSize | tonumber? // $maxFileSize)'
jq_set '.FileConverter.converter.maxDownloadBytes = ($maxFileSize | tonumber? // $maxFileSize)'
# inputLimits is an array that only exists in default.json; node-config would replace the
# whole array if we put it in local.json (losing the 'template' fields), so patch default.json
# directly with sed — the same approach the original manual recipe used.
DEFAULT_JSON="${EO_CONF}/default.json"
if [ -f "$DEFAULT_JSON" ]; then
# Replace all three 50MB entries (docx/pptx/vsdx) and the 300MB xlsx entry
sed -i "s/\"uncompressed\": \"300MB\"/\"uncompressed\": \"${MAX_ZIP_UNCOMPRESSED_XLSX}\"/g" "$DEFAULT_JSON"
sed -i "s/\"uncompressed\": \"50MB\"/\"uncompressed\": \"${MAX_ZIP_UNCOMPRESSED_DOC}\"/g" "$DEFAULT_JSON"
fi

# Metrics (statsd)
if [ "$METRICS_ENABLED" = "true" ]; then
jq_set '.statsd.useMetrics = true'
Expand Down Expand Up @@ -282,6 +302,7 @@ jq \
--arg metricsHost "$METRICS_HOST" \
--arg metricsPort "$METRICS_PORT" \
--arg metricsPrefix "$METRICS_PREFIX" \
--arg maxFileSize "$MAX_FILE_SIZE" \
"$jq_filter" \
"$CONFIG_FILE" > "${CONFIG_FILE}.tmp"
mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE"
Expand Down Expand Up @@ -312,6 +333,10 @@ if [ -f "$NGINX_CONFIG_PATH" ]; then
fi
fi

if [ -f "$NGINX_DS_COMMON_CONF" ]; then
sed -i "s/client_max_body_size[[:space:]]\+[^;]\+;/client_max_body_size ${NGINX_CLIENT_MAX_BODY_SIZE};/" "$NGINX_DS_COMMON_CONF"
fi

if [ -n "${SSL_CERTIFICATE_PATH:-}" ] && [ -n "${SSL_KEY_PATH:-}" ] \
&& [ -f "$SSL_CERTIFICATE_PATH" ] && [ -f "$SSL_KEY_PATH" ] \
&& [ -f "$NGINX_DS_SSL_TMPL" ]; then
Expand Down Expand Up @@ -359,12 +384,14 @@ enable_supervisor_program() {
# --------------------------------------------------------------------
if [ "${EXAMPLE_ENABLED:-false}" = "true" ] && [ -d "$EXAMPLE_CONF_DIR" ]; then
jq -n \
--arg secret "$JWT_SECRET" \
--arg header "$JWT_HEADER" \
--arg secret "$JWT_SECRET" \
--arg header "$JWT_HEADER" \
--arg maxFileSize "$MAX_FILE_SIZE" \
'{
"server": {
"siteUrl": "/",
"exampleUrl": "http://localhost/example/",
"maxFileSize": ($maxFileSize | tonumber? // $maxFileSize),
"token": {
"enable": true,
"secret": $secret,
Expand Down Expand Up @@ -427,6 +454,44 @@ fi
[ "$REDIS_SERVER_HOST" = "localhost" ] && service redis-server start
service nginx start

# --------------------------------------------------------------------
# Apply Postgres schema on first boot (idempotent).
#
# The stock image has no init step for this, so a fresh DB volume leaves
# docservice failing with `DB table "task_result" does not exist` and
# never binding to :8000 — nginx then serves 502 on /healthcheck.
# --------------------------------------------------------------------
ensure_db_schema() {
schema_file="${EO_ROOT}/server/schema/postgresql/createdb.sql"
[ -f "$schema_file" ] || return 0

db_psql() {
PGPASSWORD="${DB_PWD:-}" psql \
-v ON_ERROR_STOP=1 \
-h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" "$@"
}

tries=0
until db_psql -tAc 'SELECT 1' >/dev/null 2>&1; do
tries=$((tries + 1))
if [ "$tries" -gt 60 ]; then
echo "ERROR: Postgres not reachable at ${DB_HOST}:${DB_PORT} after 60s" >&2
return 1
fi
sleep 1
done

# Probe a table that createdb.sql creates. Skip if already populated.
if db_psql -tAc "SELECT to_regclass('public.task_result')::text" 2>/dev/null \
| grep -qx 'task_result'; then
return 0
fi

echo "Applying Postgres schema from ${schema_file}..."
db_psql -f "$schema_file"
}
ensure_db_schema

# --------------------------------------------------------------------
# Fonts + plugins (background where appropriate).
# --------------------------------------------------------------------
Expand Down