dsh-better-sidebar-onlyoffice

Configuration

All keys are optional; the profile's cordis.patch.yml layer carries them:

- id: dsh-better-sidebar-onlyoffice
  config:
    jwtSecret: ""          # empty = unsigned (only for JWT_ENABLED=false servers)
    # documentServerUrl: http://192.168.1.10:3082  # browser-side api.js base; empty = derive from the page Origin
    # internalDocumentServerUrl: http://onlyoffice-documentserver  # server-side fetch base for DS save URLs (see below)
    # internalBaseUrl: http://172.31.255.4:3080    # how the DS reaches dsh web; empty = auto-detect
    # documentServerPort: 3082
    # defaultMode: edit                             # edit | view
    # fileLimitMb: 100
    # tokenTtlSec: 600

Field	Default	Description
jwtSecret	''	Shared secret with the Document Server (its JWT_SECRET). Editor configs and callbacks are JWT-signed/verified when set; empty only fits a DS running JWT_ENABLED=false.
documentServerUrl	(derived)	Browser-side DS base URL (e.g. http://192.168.1.10:3082). Empty = derive from each request's Origin host + documentServerPort.
documentServerPort	3082	Port appended when deriving the DS URL from the page Origin.
internalDocumentServerUrl	''	Base URL this server fetches DS-reported save URLs through (docker-network direct, e.g. http://onlyoffice-documentserver). Empty = fetch exactly as reported (through the public entry).
internalBaseUrl	''	Base URL the DS uses to reach this dsh web server (document download + callbacks). Empty = auto-detect the first non-loopback IPv4 + the webserver port.
defaultMode	edit	Default open mode; the viewer's gear setting overrides it per user.
fileLimitMb	100	Max file size (MB) for serving and saving back.
tokenTtlSec	600	Signed URL token lifetime in seconds.

Each viewer's gear settings add two shared toggles: open mode (edit/view) and document server URL (browser-side override; a value set on any card applies to all three viewers).

In-network save fetch (internalDocumentServerUrl)

The three directions are configured independently: browser → DS via documentServerUrl, DS → this server via internalBaseUrl, and this server → DS (downloading saved bytes) defaults to the URL the DS reports in its callback — behind a reverse proxy that points back through the public entry, so save traffic hairpins out (DNS + TLS + terminator + gateway). Setting internalDocumentServerUrl (e.g. http://onlyoffice-documentserver, the docker-network container name) rewrites the browser-side prefix (scheme/host/sub-path) of reported save URLs onto that base — path suffix and query stay intact — for a direct container-to-container fetch.

Safety verified against Document Server 9.4: /cache/files auth is an nginx secure_link md5 over expires + request-path + server secret, where the request path is the one AFTER the proxy strips the sub-path prefix — host and stripped prefix are not signed material, so a rewritten URL still returns 200. A reported URL outside the browser base is fetched as-is with a warn log.

Deployment shape

The canonical deployment: the Document Server container and dsh web share a docker network (DS container name resolvable, e.g. onlyoffice-documentserver), DS published on host port 3082, JWT enabled with a fixed secret, and ALLOW_PRIVATE_IP_ADDRESS=true on the DS container.