docs: run Collabora Online (CODE) in the docker-compose example

[DeepDiver1975]

Summary

Extends the Server v11 docker-compose example so it also starts a Collabora Online Development Edition (CODE) container, wired to ownCloud end-to-end. Previously the example ran only owncloud/server + mariadb + redis over plain HTTP.

Because the Collabora editor is embedded via an iframe and a WebSocket, both ownCloud and Collabora must be served over HTTPS on their own hostnames — browsers block the mixed HTTP/HTTPS content a plain-HTTP setup produces. A Traefik reverse proxy is therefore added to terminate TLS (Let's Encrypt), redirect HTTP→HTTPS, and route the two domains; the owncloud service moves from a published port to proxy labels.

Changes

• docker-compose.yml — new always-on collabora (collabora/code, 9980) and proxy (Traefik) services; ownCloud exposed via Traefik labels; new acme volume for certificates.
• dot.env — real hostnames instead of localhost; new COLLABORA_DOMAIN, OWNCLOUD_DOMAIN_REGEX, COLLABORA_IMAGE, Collabora admin creds, TRAEFIK_IMAGE, LETSENCRYPT_EMAIL; dropped obsolete HTTP_PORT.
• installing_with_docker.adoc — TLS/two-host explanation, expanded .env settings table, updated docker compose ps output (collabora + proxy), and a new "Enabling Collabora Online (CODE)" section covering app:enable richdocuments and config:app:set richdocuments wopi_url, linking to the existing Collabora / occ pages.

Notes

• The CODE integration is documented against the Enterprise richdocuments app (what the repo documents today); the repo's own note flags its OC11 availability as "under review". The collabora container itself is edition-independent.

Verification

• docker compose config validates the file.
• Full Antora build of the page succeeds; rendered HTML shows the new services, the new section/anchor, and the wopi_url command, with no unresolved AsciiDoc attribute tokens.

🤖 Generated with Claude Code

[DeepDiver1975]

Follow-up QA commit (a2e8af8): security review, a local test harness, and CI.

Security hardening of the compose example

• Removed the published host ports on MariaDB (3306) and Redis (6379) — they now live on an internal backend network only. Reframed as an internet-facing setup, an exposed weakly-authenticated DB and an unauthenticated Redis were directly exploitable.
• Split the topology into frontend (proxy, ownCloud, Collabora) and backend (ownCloud, MariaDB, Redis) so the edge proxy and Collabora cannot reach the data tier.
• Restricted the Collabora CODE admin console (/browser/dist/admincontrol, /cool/adminws) behind a higher-priority Traefik router + ipallowlist middleware instead of exposing it publicly with admin/admin.
• Added an HSTS middleware on the ownCloud router only (a framing policy would break the embedded editor iframe).
• Moved all credentials to .env with CHANGE_ME_* placeholders; defined the previously-undefined ADMIN_*/DB vars; distinct root vs. app DB passwords.
• Documented the residual caveats next to the compose block (change credentials, keep the data tier private, never expose the admin console, the Docker-socket-as-root trade-off, pin image versions).

Local test harness (tests/docker-compose/, kept out of the Antora examples/ tree)

• A self-signed-TLS override + runnable test.env boot the actual shipped compose file, then assert: all healthchecks green, status.php → installed:true, Collabora /hosting/discovery returns WOPI XML, and 3306/6379 are closed on the host.
• Run with npm run test:compose. Verified locally: passes end to end and tears down cleanly.

CI + Dependabot

• New paths-filtered compose-test.yml workflow lints (docker compose config) and runs the smoke test on PRs touching the example/harness. Action SHA-pinned.
• Added the docker ecosystem to Dependabot.

Note: the compose image tags are .env-interpolated, so the Dependabot docker entry will not find literal tags to bump in the shipped file (the concrete pins live in test.env); the entry is kept to future-proof any literal tags. The test harness pins Traefik v3.6 (vs. the example's v3.3) because Traefik < 3.6 probes the Docker daemon with API v1.24, which Docker Engine >= 29 refuses — routing/TLS behaviour under test is identical.