bump to 0.3.2+v5.1.0

Wire up the file-upload conversion path that CONVERSION_UPLOAD_ENABLED
exposes:

- Add Y_PROVIDER_API_BASE_URL and Y_PROVIDER_API_KEY_FILE to common-env
  so the backend can call y-provider (used for .md→Yjs).
- Add DOCSPEC_API_URL to common-env and a new docspec service
  (ghcr.io/docspecio/api:3.0.1) for the .docx→BlockNote→Yjs path.

These were missing because they were dormant while
CONVERSION_UPLOAD_ENABLED defaulted to false upstream. Now that the
recipe defaults it to true (0.3.1+v5.1.0), they're required for the
upload endpoint to function.

Upstream reference:
- https://github.com/suitenumerique/docs/blob/v5.1.0/compose.yml (docspec service)
- https://github.com/suitenumerique/docs/blob/v5.1.0/env.d/development/common (DOCSPEC_API_URL, Y_PROVIDER_API_BASE_URL)
- https://github.com/docspecio/api (DocSpec source)

.env.sample

@@ -71,4 +71,38 @@ LOGGING_LEVEL_LOGGERS_APP=INFO
 # MIGRATIONS
 ##############################################################################
 # Set to false to disable automatic migrations on backend startup
-AUTO_MIGRATIONS=true
+# AUTO_MIGRATIONS=true
+
+##############################################################################
+# CONVERSION (file upload → Yjs via y-provider)
+##############################################################################
+# Allow uploading .docx/.md files for conversion to Yjs.
+# Recipe sets this to true (upstream default is false).
+# CONVERSION_UPLOAD_ENABLED=true
+# Upstream defaults (uncomment to override):
+# CONVERSION_FILE_MAX_SIZE=20971520
+# CONVERSION_FILE_EXTENSIONS_ALLOWED=.docx,.md
+# CONVERSION_API_ENDPOINT=convert
+# CONVERSION_API_CONTENT_FIELD=content
+# CONVERSION_API_TIMEOUT=30
+# CONVERSION_API_SECURE=false
+
+##############################################################################
+# DATABASE CONNECTION POOL
+##############################################################################
+# Upstream default (uncomment to override):
+# DB_PSYCOPG_POOL_ENABLED=false
+
+##############################################################################
+# EMAIL APP URL
+##############################################################################
+# DJANGO_EMAIL_URL_APP is set automatically in compose.yml to https://${DOMAIN}.
+# Override is not exposed via .env — edit compose.yml directly if needed.
+# (Upstream default falls back to Django's Site framework, not configured here.)
+
+##############################################################################
+# MEDIA AUTH HEADER
+##############################################################################
+# Header the backend reads for media auth subrequests.
+# Upstream default matches the recipe's nginx config (X-Original-URL).
+# MEDIA_AUTH_ORIGINAL_URL_HEADER=HTTP_X_ORIGINAL_URL

compose.yml

@@ -49,13 +49,32 @@ x-common-env: &common-env
   LOGOUT_REDIRECT_URL:
   OIDC_REDIRECT_ALLOWED_HOSTS:
   OIDC_AUTH_REQUEST_EXTRA_PARAMS:
-  # AI (Fixme: remove?)
+  # AI
   AI_FEATURE_ENABLED: "false"
-  AI_BASE_URL: https://openaiendpoint.com
-  AI_API_KEY: password
+  OPENAI_SDK_BASE_URL: https://openaiendpoint.com
+  OPENAI_SDK_API_KEY: password
   AI_MODEL: llama
   # Collaboration
   COLLABORATION_API_URL: https://$DOMAIN/collaboration/api/
+  # Email app URL (used in email templates; matches recipe DOMAIN)
+  DJANGO_EMAIL_URL_APP: "https://${DOMAIN}"
+  # Conversion (file upload → Yjs via y-provider)
+  CONVERSION_UPLOAD_ENABLED: "${CONVERSION_UPLOAD_ENABLED:-true}"
+  CONVERSION_FILE_MAX_SIZE:
+  CONVERSION_FILE_EXTENSIONS_ALLOWED:
+  CONVERSION_API_ENDPOINT:
+  CONVERSION_API_CONTENT_FIELD:
+  CONVERSION_API_TIMEOUT:
+  CONVERSION_API_SECURE:
+  # Y-Provider base URL + API key (needed when CONVERSION_UPLOAD_ENABLED is true)
+  Y_PROVIDER_API_BASE_URL: http://y-provider:4444/api/
+  Y_PROVIDER_API_KEY_FILE: /run/secrets/y_api_key
+  # DocSpec — converts .docx → BlockNote JSON, then y-provider turns that into Yjs
+  DOCSPEC_API_URL: http://docspec:4000/conversion
+  # Database connection pool
+  DB_PSYCOPG_POOL_ENABLED:
+  # Media auth header (matches recipe nginx by default)
+  MEDIA_AUTH_ORIGINAL_URL_HEADER:
 
 x-postgres-env: &postgres-env
   # Postgresql db container configuration
@@ -84,14 +103,14 @@ x-minio-env: &minio-env
 
 services:
   app:
-    image: lasuite/impress-frontend:v4.5.0
+    image: lasuite/impress-frontend:v5.1.0
     networks:
       - backend
     deploy:
       labels:
         - "traefik.enable=false"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=0.2.8+v4.5.0"
+        - "coop-cloud.${STACK_NAME}.version=0.3.2+v5.1.0"
     user: "${DOCKER_USER:-1000}"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8080"]
@@ -101,7 +120,7 @@ services:
       start_period: 10s
 
   backend:
-    image: lasuite/impress-backend:v4.5.0
+    image: lasuite/impress-backend:v5.1.0
     networks:
       - backend
     environment:
@@ -136,9 +155,15 @@ services:
       - email_pass
 
   celery:
-    image: lasuite/impress-backend:v4.5.0
+    image: lasuite/impress-backend:v5.1.0
     networks:
       - backend
+    healthcheck:
+      test: ["CMD", "celery", "-A", "impress.celery_app", "inspect", "ping", "--timeout", "5"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     user: "${DOCKER_USER:-1000}"
     command: ["celery", "-A", "impress.celery_app", "worker", "-l", "INFO"]
     environment:
@@ -160,18 +185,36 @@ services:
 
 
   y-provider:
-    image: lasuite/impress-y-provider:v4.5.0
+    image: lasuite/impress-y-provider:v5.1.0
     networks:
-      - backend 
+      - backend
+    healthcheck:
+      # y-provider returns 403 on unauthenticated requests; wget exit 4 = network error (server down), anything else = server is responding
+      test: ["CMD-SHELL", "wget -qO /dev/null http://localhost:4444/ 2>/dev/null; test $$? -ne 4"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
     environment: *yprovider-env
     user: "${DOCKER_USER:-1000}"
     entrypoint: >
       sh -c "export Y_PROVIDER_API_KEY=\"$$(cat /run/secrets/y_api_key)\" && exec /usr/local/bin/entrypoint \"$$@\"" --
     command: ["yarn", "start"]
-    # NOTE: healthcheck - `wget` is available in the container, but `wget http://localhost:4444` gives a 403
     secrets:
       - y_api_key
 
+  docspec:
+    image: ghcr.io/docspecio/api:3.0.1
+    networks:
+      - backend
+    healthcheck:
+      # Use 127.0.0.1, which is required instead of localhost for this healtcheck because of elixir/busybox bindings
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:4000/health"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
   db:
     image: pgautoupgrade/pgautoupgrade:18-debian
     networks:
@@ -200,9 +243,14 @@ services:
       - postgres_p
 
   redis:
-    image: redis:8
+    image: redis:8.2.6
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
     networks:
-      - backend 
+      - backend
 
   minio:
     image: minio/minio:RELEASE.2025-05-24T17-08-30Z
@@ -235,7 +283,13 @@ services:
       - minio_ru
 
   web:
-    image: nginx:1.29
+    image: nginx:1.30.0
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8083"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
     configs:
       - source: nginx_conf
         target: /etc/nginx/conf.d/default.conf