OpenCloud on Railway

Deployment sources for OpenCloud on Railway. Two images are built from this repository:

Path	Service	Base image
Dockerfile	opencloud	opencloudeu/opencloud:7
collabora/Dockerfile	collabora	collabora/code:latest
tika/Dockerfile	tika	apache/tika:latest

Why these layers exist

OpenCloud. Upstream's compose file mounts two directories (/etc/opencloud for the generated configuration and /var/lib/opencloud for data) and bind mounts three configuration files from the compose checkout. A Railway service gets exactly one volume and cannot bind mount anything, so entrypoint.sh points OC_CONFIG_DIR and OC_BASE_DATA_PATH at one volume, takes ownership of it for the image's uid 1000, and the image carries csp.yaml, apps.yaml and the banned-password list. The entrypoint also runs opencloud init once, which generates the JWT, WOPI and service secrets that must stay stable across redeploys.

Collabora. The published image ships no WOPI proof key and cannot create one at boot -- it is near-distroless and /etc/coolwsd is root-owned while coolwsd runs as uid 1001. Unsigned WOPI requests are rejected by OpenCloud, so the key is generated in a build stage and copied in owned by the runtime user.

Tika. The published image binds 0.0.0.0. Railway's private network is IPv6-first, so the entrypoint is restated with -h :: to get one dual-stack listener.

Configuration

Every setting is an environment variable read by OpenCloud itself; see the OpenCloud environment variable reference. The only variable that must be supplied is IDM_ADMIN_PASSWORD, the password for the built-in admin account. It is read once, on the first boot, and can only be changed afterwards through the OpenCloud user settings UI.