Add ONLYOFFICE Kasm workspace

apps/only-office-kasm/1.19.0-rolling-weekly/.env.sample

@@ -0,0 +1,5 @@
+PANEL_APP_PORT_HTTPS=41013
+HTTP_PWD=replace-with-a-random-value
+SHM_SIZE=1024m
+APP_DATA_DIR=./data
+CONTAINER_NAME=

apps/only-office-kasm/1.19.0-rolling-weekly/data.yml

@@ -0,0 +1,69 @@
+additionalProperties:
+  formFields:
+    - default: 41013
+      edit: true
+      envKey: PANEL_APP_PORT_HTTPS
+      labelEn: HTTPS Port
+      labelZh: HTTPS 端口
+      label:
+        en: HTTPS Port
+        zh: HTTPS 端口
+        zh-Hant: HTTPS 連接埠
+        ja: HTTPS ポート
+        ko: HTTPS 포트
+        ru: Порт HTTPS
+        ms: Port HTTPS
+        pt-br: Porta HTTPS
+      required: true
+      rule: paramPort
+      type: number
+    - default: ""
+      edit: true
+      envKey: HTTP_PWD
+      labelEn: Access Password
+      labelZh: 访问密码
+      label:
+        en: Access Password
+        zh: 访问密码
+        zh-Hant: 存取密碼
+        ja: アクセスパスワード
+        ko: 접속 비밀번호
+        ru: Пароль доступа
+        ms: Kata Laluan Akses
+        pt-br: Senha de Acesso
+      random: true
+      required: true
+      rule: paramComplexity
+      type: password
+    - default: 1024m
+      edit: true
+      envKey: SHM_SIZE
+      labelEn: Shared Memory Size
+      labelZh: 共享内存大小
+      label:
+        en: Shared Memory Size
+        zh: 共享内存大小
+        zh-Hant: 共享記憶體大小
+        ja: 共有メモリサイズ
+        ko: 공유 메모리 크기
+        ru: Размер общей памяти
+        ms: Saiz Memori Dikongsi
+        pt-br: Tamanho da Memória Compartilhada
+      required: true
+      type: text
+    - default: ./data
+      edit: true
+      envKey: APP_DATA_DIR
+      labelEn: Data Directory
+      labelZh: 数据目录
+      label:
+        en: Data Directory
+        zh: 数据目录
+        zh-Hant: 資料目錄
+        ja: データディレクトリ
+        ko: 데이터 디렉터리
+        ru: Каталог данных
+        ms: Direktori Data
+        pt-br: Diretório de Dados
+      required: true
+      type: text

apps/only-office-kasm/1.19.0-rolling-weekly/docker-compose.yml

@@ -0,0 +1,35 @@
+services:
+  only-office-kasm:
+    image: "kasmweb/only-office:1.19.0-rolling-weekly@sha256:c2d9651d9d600d1633dbc2d56fbfa1a67dbbe780d498d6de0677594780e68d50"
+    container_name: ${CONTAINER_NAME}
+    restart: unless-stopped
+    networks:
+      - 1panel-network
+    ports:
+      - "${PANEL_APP_PORT_HTTPS}:6901"
+    environment:
+      - VNC_PW=${HTTP_PWD}
+    shm_size: ${SHM_SIZE}
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - >-
+          curl --insecure --fail --silent --show-error
+          --user "kasm_user:$$VNC_PW"
+          https://127.0.0.1:6901/
+      interval: 30s
+      timeout: 10s
+      start_period: 90s
+      retries: 5
+    volumes:
+      - "${APP_DATA_DIR}:/home/kasm-user"
+    labels:
+      createdBy: "Apps"
+
+networks:
+  1panel-network:
+    external: true

apps/only-office-kasm/1.19.0-rolling-weekly/scripts/init.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
+
+read_env_value() {
+  local key="$1"
+  [[ -f "$ENV_FILE" ]] || return 0
+  local value
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
+  esac
+  printf '%s\n' "$value"
+}
+
+data_raw="${APP_DATA_DIR:-}"
+if [[ -z "$data_raw" ]]; then
+  data_raw="$(read_env_value APP_DATA_DIR)"
+fi
+data_raw="${data_raw:-./data}"
+
+[[ "$data_raw" != /* ]] || {
+  printf '%s\n' 'APP_DATA_DIR must be a relative path' >&2
+  exit 1
+}
+
+data_dir="$(realpath -m -- "$ROOT_DIR/${data_raw#./}")"
+case "$data_dir" in
+  "$ROOT_DIR"/*) ;;
+  *)
+    printf '%s\n' 'APP_DATA_DIR must remain inside the application version directory' >&2
+    exit 1
+    ;;
+esac
+
+mkdir -p -- "$data_dir"
+resolved_data_dir="$(realpath -e -- "$data_dir")"
+case "$resolved_data_dir" in
+  "$ROOT_DIR"/*) ;;
+  *)
+    printf '%s\n' 'APP_DATA_DIR resolves outside the application version directory' >&2
+    exit 1
+    ;;
+esac
+
+chown 1000:1000 -- "$resolved_data_dir"
+chmod 0700 -- "$resolved_data_dir"

apps/only-office-kasm/1.19.0-rolling-weekly/scripts/uninstall.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Preserve APP_DATA_DIR so uninstall does not destroy user files.

apps/only-office-kasm/1.19.0-rolling-weekly/scripts/upgrade.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+"$(dirname "$0")/init.sh"

apps/only-office-kasm/README.md

@@ -0,0 +1,55 @@
+# Only Office (Kasm)
+
+## 产品介绍
+
+Only Office (Kasm) 将 Only Office 作为浏览器工作区运行。镜像由 Kasm Technologies 构建，1Panel 应用包直接使用固定 digest，不在本地重打包镜像。
+
+## 主要功能
+
+- 在浏览器中使用完整的 Linux 图形界面
+- 将用户配置、下载和工作文件保存在独立数据目录
+- 通过 KasmVNC 的 HTTPS 入口和安装时随机生成的密码访问
+
+## 访问说明
+
+安装后访问 `https://<服务器 IP>:<HTTPS 端口>`，用户名为 `kasm_user`，密码为安装表单中的访问密码。镜像使用自签名证书，浏览器首次访问会显示证书警告；公网部署应在可信反向代理后使用有效 HTTPS 证书，并限制来源地址。
+
+Kasm 官方说明，音频、上传、下载和麦克风透传等部分功能只有在完整 Kasm Workspaces 平台编排下才能完整使用。独立部署不应假定这些集成功能可用。
+
+## 数据持久化
+
+`APP_DATA_DIR` 挂载到 `/home/kasm-user`，保存用户配置和文件，默认值为版本目录下的 `./data`。该值必须是版本目录内的相对路径；生命周期脚本会拒绝绝对路径、目录逃逸和指向目录外的符号链接。卸载或迁移前请备份该目录；不要把多个实例指向同一目录。
+
+`SHM_SIZE` 控制浏览器工作区共享内存，默认 `1024m`。大型文件或高分辨率会话可适当提高，但必须确认主机有足够内存。
+
+## 版本与安全说明
+
+- `workspaces-images` 使用 MIT 许可文本（SPDX: MIT），但上游声明只覆盖该仓库直接维护的源码，不自动覆盖镜像内第三方应用或依赖。各产品许可和商标条款仍独立适用；本应用包只引用上游镜像，不重分发镜像内容。
+- 本包固定 Kasm 官方 `1.19.0-rolling-weekly` 在 2026-07-22 发布的 amd64 digest `sha256:c2d9651d9d600d1633dbc2d56fbfa1a67dbbe780d498d6de0677594780e68d50`，不会随远端标签静默变化。
+- 2026-07-28 对此精确 digest 的 fresh Trivy 扫描结果为 `0 Critical / 0 High`。
+- 容器以上游 UID 1000 运行，移除全部 Linux capabilities，并启用 `no-new-privileges`。上游启动过程需要写入 `/dockerstartup` 和 `/var/run/pulse`，因此不能使用只读根文件系统。
+- `VNC_PW` 通过 1Panel 随机密码字段传入并保存在应用 `.env` 中。不要复用其他系统密码，并限制 1Panel、Docker 和应用目录的读取权限。
+
+## Introduction
+
+Only Office (Kasm) runs Only Office as a browser-accessible workspace. Kasm Technologies builds the image, and this package references a pinned digest without rebuilding it.
+
+The `workspaces-images` source uses the MIT license text (SPDX: MIT) only for code directly maintained in that repository. It does not extend to third-party applications or dependencies in the image. This package references the upstream image without redistributing its contents.
+
+## Features
+
+- Full Linux graphical application streamed through the browser
+- Per-install persistence for user settings, downloads, and working files
+- KasmVNC HTTPS access protected by an installation-time random password
+
+Open `https://<server-ip>:<HTTPS-port>`, sign in as `kasm_user`, and use the access password generated during installation. The image presents a self-signed certificate. Use a trusted HTTPS reverse proxy and restrict source addresses for Internet-facing deployments.
+
+`APP_DATA_DIR` persists `/home/kasm-user`. The image is pinned to the 2026-07-22 `1.19.0-rolling-weekly` digest. A fresh Trivy scan of this exact digest on 2026-07-28 found `0 Critical / 0 High`.
+
+## References
+
+- Product website: <https://www.onlyoffice.com/>
+- Kasm official registry: <https://registry.kasmweb.com/1.1/>
+- Docker Hub image and stand-alone instructions: <https://hub.docker.com/r/kasmweb/only-office>
+- Pinned image source: <https://github.com/kasmtech/workspaces-images/blob/bafab6d531eefd5a5aa6f2c9088ebc8f02e12fae/dockerfile-kasm-only-office>
+- Source license: <https://github.com/kasmtech/workspaces-images/blob/bafab6d531eefd5a5aa6f2c9088ebc8f02e12fae/LICENSE.md>

apps/only-office-kasm/data.yml

@@ -0,0 +1,29 @@
+name: Only Office (Kasm)
+tags:
+  - 实用工具
+title: 浏览器版 Only Office
+description: 可通过浏览器访问的 Only Office 工作区
+additionalProperties:
+  key: only-office-kasm
+  name: Only Office (Kasm)
+  tags:
+    - Tool
+  shortDescZh: 可通过浏览器访问的 Only Office 工作区
+  shortDescEn: Browser-accessible Only Office workspace
+  description:
+    en: Browser-accessible Only Office workspace
+    zh: 可通过浏览器访问的 Only Office 工作区
+    zh-Hant: 可透過瀏覽器存取的 Only Office 工作區
+    ja: ブラウザーから利用できる Only Office ワークスペース
+    ko: 브라우저에서 사용할 수 있는 Only Office 워크스페이스
+    ru: Рабочее пространство Only Office с доступом через браузер
+    ms: Ruang kerja Only Office yang boleh diakses melalui pelayar
+    pt-br: Ambiente Only Office acessível pelo navegador
+  type: tool
+  crossVersionUpdate: true
+  limit: 0
+  website: https://www.onlyoffice.com/
+  github: https://github.com/kasmtech/workspaces-images/blob/bafab6d531eefd5a5aa6f2c9088ebc8f02e12fae/dockerfile-kasm-only-office
+  document: https://hub.docker.com/r/kasmweb/only-office
+  architectures:
+    - amd64

apps/only-office-kasm/logo-LICENSE.txt

@@ -0,0 +1,10 @@
+Only Office (Kasm) typographic workspace icon
+
+Created in this repository on 2026-07-28 with ImageMagick using only geometric shapes and the text "Only Office" and "WEB WORKSPACE".
+Font: DejaVu Sans and DejaVu Sans Bold
+Font source: https://dejavu-fonts.github.io/
+Font license: Bitstream Vera font license; DejaVu changes are public domain
+Font license text: https://dejavu-fonts.github.io/License.html
+SHA-256: 3552f2f29df1f036ac08285c9a5037f2166a1ac060b8db8f10763a76b1305ff3
+
+The generated composition is original project artwork. Product names may be trademarks of their respective owners and are used only for identification.