feat: ONLYOFFICE inline editor integration with JWT auth and docker-compose

docker-compose.yml

@@ -0,0 +1,97 @@
+# ============================================================
+# CV Application - Docker Compose
+# 
+# Containers:
+#   cv-backend     - FastAPI + Node Carbone service (existing code, containerized)
+#   cv-postgres     - PostgreSQL database
+#   onlyoffice-server - ONLYOFFICE Document Server (inline .docx editing)
+# 
+# Networking:
+#   - Internal Docker network: cvnet
+#   - Backend talks to ONLYOFFICE via http://onlyoffice-server/ (internal)
+#   - Browser talks to ONLYOFFICE via http://<host>:8080/ (public)
+#   - JWT tokens secure all document session communication
+# ============================================================
+
+version: "3.8"
+
+services:
+  # PostgreSQL Database
+  cv-postgres:
+    image: postgres:16-alpine
+    container_name: cv-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: cvapp
+      POSTGRES_USER: cvapp
+      POSTGRES_PASSWORD: cvapp2026
+      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --template=template0"
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    networks:
+      - cvnet
+    ports:
+      - "5433:5432"  # Different host port to avoid conflict with local PG
+
+  # ONLYOFFICE Document Server
+  onlyoffice-server:
+    image: onlyoffice/documentserver:latest
+    container_name: onlyoffice-server
+    restart: unless-stopped
+    environment:
+      # JWT Security - shared secret with backend
+      JWT_ENABLED: "true"
+      JWT_SECRET: "${JWT_SECRET:-cvapp_onlyoffice_jwt_secret_2026}"
+      JWT_HEADER: "Authorization"
+      JWT_IN_BODY: "true"
+      # Disable example apps (not needed in production)
+      ONLYOFFICE_EXAMPLE: "false"
+    volumes:
+      - onlyoffice_data:/var/www/onlyoffice/Data
+      - onlyoffice_logs:/var/log/onlyoffice
+      - onlyoffice_cache:/var/lib/onlyoffice
+    networks:
+      - cvnet
+    ports:
+      - "8080:80"  # Public URL for browser to load ONLYOFFICE JS API
+    depends_on:
+      - cv-postgres
+
+  # CV Application Backend (FastAPI + Carbone Express)
+  # We keep this as the existing systemd service for now, but this config
+  # shows how to containerize it. The backend talks to ONLYOFFICE internally.
+  # cv-backend:
+  #   build: .
+  #   container_name: cv-backend
+  #   restart: unless-stopped
+  #   environment:
+  #     DB_HOST: cv-postgres
+  #     DB_PORT: 5432
+  #     DB_NAME: cvapp
+  #     DB_USER: cvapp
+  #     DB_PASSWORD: cvapp2026
+  #     OLLAMA_API_KEY: "${OLLAMA_API_KEY}"
+  #     JWT_SECRET: "${JWT_SECRET:-cvapp_onlyoffice_jwt_secret_2026}"
+  #     ONLYOFFICE_INTERNAL_URL: "http://onlyoffice-server/"
+  #     ONLYOFFICE_PUBLIC_URL: "http://localhost:8080/"
+  #   volumes:
+  #     - ./uploads:/app/uploads
+  #     - ./renderer/carbone-templates:/app/carbone-templates
+  #   networks:
+  #     - cvnet
+  #   ports:
+  #     - "8770:8770"  # FastAPI
+  #     - "8771:8771"  # Carbone Express
+  #   depends_on:
+  #     - cv-postgres
+  #     - onlyoffice-server
+
+volumes:
+  pgdata:
+  onlyoffice_data:
+  onlyoffice_logs:
+  onlyoffice_cache:
+
+networks:
+  cvnet:
+    driver: bridge