# only-office

The `only-office` module of the mesh catalogue: runs the container image `onlyoffice/documentserver`.

## Files it does not know

Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).

- `${dir:state}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
- `${dir:box}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
- `${dir:logs}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
- `${dir:data}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
- `${dir:server-lib}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
- `${dir:lib}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
- `${dir:db}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
- `${dir:rabbitmq}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
- `${dir:redis}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
- `${dir:fonts}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).

## Where its directories live

Everything the container mounts sits in `${dir:box}` (`/var/lib/only-office/box`), root-owned and 0700 (issue 1843).
The image opens what is below each mount to every account on every start (`chmod -R 755`), so the barrier is a
parent the container never sees. The module root stays root-owned 0711: the converter, which runs on the host
as `only-office-converter`, passes through it to its two secrets and nothing else.

`${dir:lib}` (`/var/lib/only-office/lib`) is the copy the container used before, no longer mounted, kept by the
mesh because it is not empty and closed to 0700. It keeps its id so mesh-host sets that mode: a new id at a path
the image owns would be used as found (issue 339). Its contents, and those of the old `logs`, `data`, `db`,
`rabbitmq`, `redis` and `fonts` beside it, are removed on the operator's word, and then `lib` leaves the manifest.