feat(docker): standalone entrypoint env-var parity with upstream

[juliusknorr]

Summary

• Brings build/scripts/standalone/entrypoint.sh to feature parity with the upstream run-document-server.sh, turning the standalone container into a drop-in replacement for the upstream one.
• Wires every relevant env var into /etc/euro-office/documentserver/local.json (and into nginx for SSL) before handing off to supervisord.
• Adds netcat-openbsd, xxd, and openssl to the standalone image; flips ds-metrics supervisor program to opt-in via METRICS_ENABLED.

Env vars now supported

Group	Vars
JWT	JWT_ENABLED, JWT_SECRET, JWT_HEADER, JWT_IN_BODY, and *_INBOX / *_OUTBOX variants for each
Database (postgres)	DB_TYPE (postgres only), DB_HOST, DB_PORT, DB_NAME, DB_USER, DB_PWD (alias: DB_PASSWORD, logs deprecation)
Redis	REDIS_SERVER_HOST, REDIS_SERVER_PORT, REDIS_SERVER_USER, REDIS_SERVER_PASS, REDIS_SERVER_DB
AMQP	AMQP_URI, AMQP_HOST, AMQP_PORT, AMQP_USER, AMQP_PWD, AMQP_VHOST
WOPI	WOPI_ENABLED (auto-generates RSA keypair under /var/www/euro-office/Data)
SSL/nginx	SSL_CERTIFICATE_PATH, SSL_KEY_PATH, SSL_DHPARAM_PATH, SSL_VERIFY_CLIENT, ONLYOFFICE_HTTPS_HSTS_ENABLED, ONLYOFFICE_HTTPS_HSTS_MAXAGE, NGINX_WORKER_PROCESSES, NGINX_WORKER_CONNECTIONS, NGINX_ACCESS_LOG
Metrics	METRICS_ENABLED, METRICS_HOST, METRICS_PORT, METRICS_PREFIX
Misc	DS_LOG_LEVEL, PLUGINS_ENABLED, GENERATE_FONTS, USE_UNAUTHORIZED_STORAGE, ALLOW_PRIVATE_IP_ADDRESS, ALLOW_META_IP_ADDRESS, SECURE_LINK_SECRET

Defaults match upstream where reasonable (JWT_ENABLED=true, WOPI_ENABLED=false, PLUGINS_ENABLED=true, METRICS_ENABLED=false, GENERATE_FONTS=true, JWT_IN_BODY=false, JWT_HEADER=Authorization). METRICS_PREFIX defaults to ds. to line up with our cluster image instead of upstream's .ds (per review feedback).

Behavior notes

• Persisted secrets: JWT_SECRET, SECURE_LINK_SECRET, and the WOPI keypair are auto-generated on first boot and stored under /var/www/euro-office/Data/.private/ (directory 0700, files 0600 — including the WOPI RSA private key). Mount that directory as a volume to keep them stable across restarts; the JWT message printed at boot reminds operators of this.
• Conditional bundled services: postgresql, redis-server, and rabbitmq-server only start when the corresponding *_HOST points at localhost. For remote hosts the entrypoint waits for the port to open before starting supervisord.
• DB type restriction: the standalone image only ships postgresql-client, so non-postgres DB_TYPE values are rejected with a clear error. Users needing MariaDB/MySQL/MSSQL/Oracle should use the cluster image.
• AMQP_VHOST normalization: a value like myvhost is normalized to /myvhost before assembling the amqp:// URI, so users don't have to know the leading-slash detail.
• Deliberately not implemented: Let's Encrypt automation (LETS_ENCRYPT_*) and the upstream ONLYOFFICE_DATA_CONTAINER split-deployment mode. The cluster image covers split deployments; users with public TLS termination typically run a reverse proxy in front.
• Behavior change: boolean env vars (ALLOW_PRIVATE_IP_ADDRESS, USE_UNAUTHORIZED_STORAGE, etc.) are now compared against "true" rather than emptiness, matching upstream semantics. Anyone passing 1 or yes before will need to switch to true.

This PR also picks up the existing JWT_HEADER inbox/outbox fix (commit 5ba0cad), so it closes both #94 and #95.

Test plan

All items verified against a derivative image (nightly base + new entrypoint + new packages). The container-level checks were exercised end-to-end with live docker runs.

• JWT_SECRET=mysecret JWT_HEADER=AuthorizationJwt → secret.{browser,session,inbox,outbox}.string == "mysecret" and token.{inbox,outbox}.header == "AuthorizationJwt" (closes JWT_HEADER env variable is only partially working #94)
• DB_PASSWORD=oldpwd emits WARNING: DB_PASSWORD is deprecated, use DB_PWD instead on stderr and populates services.CoAuthoring.sql.dbPass
• DB_HOST=db.internal DB_PWD=… DB_USER=… DB_NAME=… wires the external host into services.CoAuthoring.sql
• REDIS_SERVER_HOST=redis.internal REDIS_SERVER_PASS=… REDIS_SERVER_DB=2 populates services.CoAuthoring.redis.{host,options.password,options.database}
• AMQP_URI=amqp://u:p@rabbit.internal:5672/vhost lands in rabbitmq.url; AMQP_VHOST=myvhost normalizes to /myvhost
• DB_TYPE=mysql is rejected at startup with a clear error
• WOPI_ENABLED=true generates the RSA keypair under /var/www/euro-office/Data and re-uses it across restarts (modulus stable); private key is 0600
• Auto-generated JWT_SECRET persists across restarts when the data dir is mounted
• Baseline docker run prints the generated JWT secret on stdout and serves /welcome/ (welcome page contains "Euro-Office Docs Community Edition")
• With DB_HOST=<external pg>, pgrep postgres returns nothing inside the container and docservice's queries hit the external host (proven by schema-not-bootstrapped errors against the external DB)
• With REDIS_SERVER_HOST=<external redis>, pgrep redis-server returns nothing inside the container; redis.host set to external host in local.json
• SSL_CERTIFICATE_PATH + SSL_KEY_PATH produce a working HTTPS listener (HTTP/2 200) with HSTS header (strict-transport-security: max-age=31536000)
• Full docker buildx bake standalone from scratch — not re-verified in this round; the prior bake hung partway in the WASM/closure-compiler stages (likely OOM in the buildkit VM, not in our diff). Recommend re-running in CI or with more memory before merge.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR expands the standalone Docker entrypoint to better match upstream DocumentServer container behavior by wiring more environment variables into runtime configuration, adding service/SSL setup logic, and making metrics opt-in.

Changes:

• Reworks build/scripts/standalone/entrypoint.sh to configure JWT, DB, Redis, AMQP, WOPI, nginx/SSL, metrics, logging, fonts, plugins, and bundled service startup.
• Changes standalone metrics supervisor autostart behavior to opt-in via METRICS_ENABLED.
• Adds runtime tools needed by the new entrypoint logic to the standalone Docker image.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
build/scripts/standalone/entrypoint.sh	Implements the expanded standalone startup/configuration flow and env-var support.
build/configs/standalone/supervisor/ds-metrics.conf	Disables metrics autostart so the entrypoint can enable it conditionally.
build/.docker/standalone.bake.Dockerfile	Installs additional utilities required by the new entrypoint behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[juliusknorr]

Addressed Copilot's three review comments in ed75701:

• METRICS_PREFIX default changed from .ds (upstream's odd convention) to ds. (matches our cluster entrypoint, also the more typical statsd prefix shape).
• AMQP_VHOST normalized to add a leading slash if missing, so AMQP_VHOST=myvhost produces a valid URI.
• WOPI private key gets chmod 600 after generation so the RSA key isn't world-readable on the Data volume.

[rikled]

tested locally, works fine. fixed some missed static paths.