OnlyOffice Document Server as an ansible role for srv.ordner.fyi, mirroring the lab-verified deployment of 2026-10-11 (docs.ordner.fyi on the lab) so both instances behave identically.
Route (the lab-verified one): docker.io + docker-cli from Debian main — compose v2 does not exist in trixie, so the running container is a recorded docker run and the auditable spec lives at /opt/onlyoffice/docker-compose.yml. Image pinned (onlyoffice/documentserver:9.3), publish loopback-only 127.0.0.1:8880→80 (outside the suite's 808x–819x band), volumes under /opt/onlyoffice/{data,logs,postgresql,lib,fonts}.
Security posture (the operator's lock-down direction, applied here first):
- JWT required for the command APIs: the role mints a fresh 256-bit secret on the box (/opt/onlyoffice/jwt.env, root:root 0600) — never shipped in the playbook; the container starts with JWT_ENABLED=true, JWT_HEADER=Authorization.
- EXAMPLE_ENABLED=false explicitly — the demo document surface is off.
- The container runs with no-new-privileges and a minimal capability set (cap-drop ALL; CHOWN/DAC_OVERRIDE/FOWNER/SETGID/SETUID/KILL/NET_BIND_SERVICE added back).
- The vhost is its own file (docs.ordner.fyi.conf) on the wildcard lineage with websocket upgrade headers and a 3600s read timeout for co-editing; it asserts the lineage exists before installing.
Idempotence/upgrades: the container is created only when absent; upgrades are a reviewed docker rm + rerun so the pinned version cannot drift on a schedule.
Wiring: a new onlyoffice tag in site-srv.yml after nginx-srv (the cert must exist first — the role asserts it).