Opencloud docker compose minimal with S3 driver

compose.yml

services:
  opencloud:
    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-7.3.0}
    container_name: yuma_opencloud
    user: ${OC_CONTAINER_UID_GID:-1000:1000}
    entrypoint:
      - /bin/sh
    # `opencloud init` generates the config file with random secrets on first run.
    # It fails on subsequent runs because the config already exists, so ignore the error.
    command: ["-c", "opencloud init || true; opencloud server"]
    environment:
      OC_URL: https://${OC_DOMAIN}
      # bind to all interfaces inside the container so the published port works
      PROXY_HTTP_ADDR: "0.0.0.0:9200"
      # no TLS between Caddy and OpenCloud
      PROXY_TLS: "false"
      OC_INSECURE: "false"

      # Blobs go to B2 (S3); metadata stays on the local volume below.
      STORAGE_USERS_DRIVER: decomposeds3
      STORAGE_USERS_DECOMPOSEDS3_ENDPOINT: "${B2_S3_ENDPOINT}"
      STORAGE_USERS_DECOMPOSEDS3_REGION: "${B2_S3_REGION}"
      STORAGE_USERS_DECOMPOSEDS3_ACCESS_KEY: "${B2_S3_ACCESS_KEY}"
      STORAGE_USERS_DECOMPOSEDS3_SECRET_KEY: "${B2_S3_SECRET_KEY}"
      STORAGE_USERS_DECOMPOSEDS3_BUCKET: "${B2_S3_BUCKET}"

      OC_LOG_LEVEL: ${LOG_LEVEL:-info}
      OC_LOG_COLOR: "false"
      OC_LOG_PRETTY: "false"

      # initial admin password (user: admin). Only read on first init.
      IDM_ADMIN_PASSWORD: "${INITIAL_ADMIN_PASSWORD}"
      IDM_CREATE_DEMO_USERS: "false"

      # needed for WebDAV clients that cannot do OpenID Connect
      PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"

      FRONTEND_ARCHIVER_MAX_SIZE: "10000000000"
      FRONTEND_CHECK_FOR_UPDATES: "true"
      OC_DEFAULT_LANGUAGE: ${DEFAULT_LANGUAGE:-en}

      # sharing / password policy
      OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD:-true}"
      OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD:-false}"
      OC_PASSWORD_POLICY_MIN_CHARACTERS: "8"

      # SMTP for notifications / share mails (optional — leave empty to disable)
      NOTIFICATIONS_SMTP_HOST: "${SMTP_HOST}"
      NOTIFICATIONS_SMTP_PORT: "${SMTP_PORT}"
      NOTIFICATIONS_SMTP_SENDER: "${SMTP_SENDER}"
      NOTIFICATIONS_SMTP_USERNAME: "${SMTP_USERNAME}"
      NOTIFICATIONS_SMTP_PASSWORD: "${SMTP_PASSWORD}"
      NOTIFICATIONS_SMTP_AUTHENTICATION: "${SMTP_AUTHENTICATION}"
      NOTIFICATIONS_SMTP_ENCRYPTION: "${SMTP_TRANSPORT_ENCRYPTION:-none}"
      NOTIFICATIONS_SMTP_INSECURE: "false"
    # The proxy validates OIDC tokens by fetching the discovery doc over the
    # public URL. Inside the container that name resolves to the Tailscale IP,
    # which is unroutable from here — pin it to Caddy on the shared network.
    extra_hosts:
      - "${OC_DOMAIN}:172.24.0.13"
    volumes:
      - ./oc-config:/etc/opencloud
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: always