app:
  id: onlyoffice
  name: OnlyOffice
  version: 7.5.0
  description: Office suite and document collaboration. Edit documents, spreadsheets, and presentations.
  
  container:
    image: onlyoffice/documentserver:7.5.0
    image_signature: cosign://...
    pull_policy: if-not-present
    
  dependencies:
    - storage: 10Gi
    
  resources:
    cpu_limit: 4
    memory_limit: 4Gi
    disk_limit: 10Gi
    
  security:
    capabilities: []
    readonly_root: false  # OnlyOffice needs write access
    no_new_privileges: true
    user: 1000
    seccomp_profile: default
    network_policy: isolated
    apparmor_profile: onlyoffice
    
  ports:
    - host: 8088
      container: 80
      protocol: tcp  # Web UI
    
  volumes:
    - type: bind
      source: /var/lib/archipelago/onlyoffice
      target: /var/www/onlyoffice/Data
      options: [rw]
      
  environment:
    - JWT_ENABLED=false
    - JWT_SECRET=${ONLYOFFICE_JWT_SECRET}
    
  health_check:
    type: http
    endpoint: http://localhost:8088
    path: /healthcheck
    interval: 30s
    timeout: 5s
    retries: 3

  metadata:
    launch:
      open_in_new_tab: true