Your own ONLYOFFICE Document Server: browser editing for Nextcloud or Seafile

What it adds, and how big a team it suits

A file cloud can store a spreadsheet but cannot open it in the browser on its own. The Document Server fills that gap: someone clicks a file, the editor opens in a tab, several people work on it at once, and the result lands back in the same folder. Set up the storage first with our Nextcloud or Seafile guide.

ONLYOFFICE's comparison of its editions puts the free Community Edition at up to 20 users, as a recommendation rather than a cap. Its Community licensing FAQ says the free edition is intended for testing, for personal use, for development and for small-scale deployments; for production and for commercial distribution, it recommends a commercial licence.

How much server do you need?

ONLYOFFICE's Docker install guide lists these system requirements:

• processor: two cores, 2 GHz or faster;
• memory: 4 GB or more; swap: 4 GB minimum;
• disk: 40 GB free or more;
• system: 64-bit (amd64) Linux, kernel 3.10 or later.

The image's README gives lighter numbers (2 GB of swap, 2 GB of disk), so treat the install guide as your floor, and add Nextcloud's or Seafile's needs if they share the machine.

The server that fits

A dedicated server means one physical computer doing your work and nobody else's, so the editors never wait on a neighbour. Root access is yours, the port is unmetered, and nothing ties you in: month to month, cancel when any month ends. A ready server reaches you within 30 minutes of approval.

• Editors on their own: a one-processor everyday server built on an x86 chip from Intel or AMD, not the Ampere Altra; these start at 16 GB of memory.
• Editors and file cloud on one machine: a two-processor server, with memory you can add later to the same box.
• Skip the ARM cartridge: ONLYOFFICE asks for amd64, and that cartridge runs nothing newer than Ubuntu 18.04.

Every rack server and blade includes a remote console, the screen and power button that still work if SSH stops answering after a firewall mistake; on the small cartridges, that console exists only on the m510 and m710x models. Choose the city nearest your team from our five data centers.

Up and running in one paste

First, point a DNS record for office.example.com at your server (an AAAA record only if you added IPv6), set up Docker Engine (with its compose plugin) by following Docker's install guide, and log in as root. Then paste the block. It switches on the firewall with IPv6 rules and SSH allowed before anything else, stops unless Docker is version 28 or newer (only then does a 127.0.0.1 port stay private), and stops if a secret file already exists, so a second paste cannot swap your secret. The file is made readable by root alone before anything goes in it; ONLYOFFICE starts last, reachable only from the server itself.

# 1. Firewall first: IPv6 copies on, SSH kept open, then the web ports
sed -i 's/^IPV6=.*/IPV6=yes/' /etc/default/ufw
ufw allow OpenSSH
ufw --force enable
ufw allow 80,443/tcp
# 2. Secret and compose file; refuses to run if the secret file exists
v=$(docker version -f '{{.Server.Version}}' 2>/dev/null | cut -d. -f1)
if [ "${v:-0}" -lt 28 ]; then
  echo "STOP: Docker Engine 28 or later is needed for a loopback-only port"
elif [ -e /srv/onlyoffice/.env ]; then
  echo "STOP: /srv/onlyoffice/.env exists; not replacing the JWT secret"
else
  mkdir -p -m 700 /srv/onlyoffice && cd /srv/onlyoffice &&
  mkdir -p logs data lib &&
  install -m 600 /dev/null .env &&
  s=$(openssl rand -hex 32) && [ -n "$s" ] && echo "JWT_SECRET=$s" > .env &&
  cat > compose.yaml <<'EOF' &&
services:
  documentserver:
    image: onlyoffice/documentserver:10.0.0.1
    container_name: onlyoffice-docs
    restart: always
    stop_grace_period: 60s
    env_file: /srv/onlyoffice/.env
    environment:
      - JWT_ENABLED=true
    ports:
      - "127.0.0.1:8080:80"
    volumes:
      - /srv/onlyoffice/logs:/var/log/onlyoffice
      - /srv/onlyoffice/data:/var/www/onlyoffice/Data
      - /srv/onlyoffice/lib:/var/lib/onlyoffice
EOF
  docker compose -f /srv/onlyoffice/compose.yaml up -d && echo started
fi

The logs, data and lib folders are the three volumes from ONLYOFFICE's install guide, holding logs, certificates, and a cache of files being edited. The guide allows a minute or two for the first start. After that, curl -fs http://127.0.0.1:8080/healthcheck; echo should answer true; it is the check the image's Dockerfile uses to report the container healthy.

Why your own secret matters

Since version 7.2, ONLYOFFICE checks a JWT signature on requests by default, so only an app holding the secret can open documents through it. Leave the secret to chance and the help centre warns it is regenerated at every reboot, after which your file cloud cannot open anything. That is why the block writes your own JWT_SECRET.

Check signing with docker exec onlyoffice-docs documentserver-jwt-status, the tool named by the image's start-up script, run-document-server.sh. That script also passes the secret to a settings command at each start, so for a moment anyone else logged in to the server could see it in the process list. On a server only you use, the risk is small.

Why 127.0.0.1? Docker publishes an address-less port mapping on every host address; IPv4 traffic to it bypasses ufw, and IPv6 traffic does too if Docker's IPv6 networking has been enabled. Bound to 127.0.0.1, ONLYOFFICE is reachable only through nginx.

Putting it on HTTPS

Browsers and your file cloud both talk to ONLYOFFICE, so it needs a real certificate. The image can do HTTPS itself; here the host's nginx handles it, keeping the container private. nginx refuses a config that names a missing certificate, hence this order:

1. Wait until office.example.com resolves to your server.
2. Ubuntu 24.04: apt install -y certbot python3-certbot-nginx nginx.
3. Request the certificate: certbot certonly --nginx -d office.example.com --deploy-hook 'systemctl reload nginx'.
4. Save the file below, then cd /etc/nginx/sites-enabled && ln -s ../sites-available/office-docs . && nginx -t && systemctl reload nginx.

# /etc/nginx/sites-available/office-docs
map $http_upgrade $proxy_connection {
  default upgrade;
  "" close;
}
server {
  listen 80;
  listen [::]:80;
  server_name office.example.com;
  return 301 https://$host$request_uri;
}
server {
  listen 443 ssl;
  listen [::]:443 ssl;
  server_name office.example.com;
  server_tokens off;
  ssl_certificate     /etc/letsencrypt/live/office.example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/office.example.com/privkey.pem;
  location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $proxy_connection;
    proxy_set_header X-Forwarded-Host $http_host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }
}

This is a shortened version of ONLYOFFICE's sample proxy-https-to-http.conf, linked from its help centre. Upgrade and Connection keep the live co-editing link (a websocket) open; X-Forwarded-Proto and X-Forwarded-Host pass on the public address, as the proxy guide requires. Left out, among other lines: the sample's upstream and map fallback blocks, its older TLS protocol and cipher list, a security header and its commented extras.

Connecting Nextcloud or Seafile

ONLYOFFICE makes and documents the Nextcloud connector. Browsers and the Nextcloud server must both reach office.example.com, and ONLYOFFICE must be able to send requests back to Nextcloud.

1. As a Nextcloud administrator, install ONLYOFFICE from Apps.
2. In its admin settings, set https://office.example.com/ as the server address.
3. Paste the JWT_SECRET value from /srv/onlyoffice/.env in the Secret key box and save, so it never lands in your shell history.
4. Test it: occ onlyoffice:documentserver --check.

Nextcloud keeps the files: ONLYOFFICE fetches one when it opens and, about ten seconds after the last person closes it, Nextcloud collects the saved copy. The connector docs add two cautions: a self-signed certificate is rejected unless you tick a box they call insecure, and on a shared machine ONLYOFFICE needs its own port or a proxy in front, as here.

Seafile appears in ONLYOFFICE's list of supported file platforms; ONLYOFFICE's help centre covers Seafile only in a Desktop Editors article, and says nothing about wiring Seafile's server to it, so the link is made in Seafile's settings, per Seafile's manual. If your storage is on a private network address, the image's ALLOW_PRIVATE_IP_ADDRESS setting (off by default) decides whether ONLYOFFICE may reach it.

Backups, restores and updates without surprises

Your documents are backed up with your file cloud. This server holds the rest: secret, compose file, data and cache, nginx config, certificates. You manage the server; we keep the hardware and the network running. Setting up the nightly job below is your part. ONLYOFFICE only saves a document once everyone has closed it, so the job first runs documentserver-prepare4shutdown (up to 5 minutes), stops the container, archives, restarts and test-opens the archive. Editing pauses briefly at 03:30.

install -d -m 700 /var/backups/office-docs /var/log/docs-backup
install -m 700 /dev/null /usr/local/sbin/docs-backup.sh
cat > /usr/local/sbin/docs-backup.sh <<'EOF'
set -o pipefail
umask 077
c=/srv/onlyoffice/compose.yaml
f=/var/backups/office-docs/onlyoffice-$(date +%F).tar.gz
docker exec onlyoffice-docs documentserver-prepare4shutdown
docker compose -f "$c" stop
tar --numeric-owner -czf "$f" -C / srv/onlyoffice \
  etc/nginx/sites-available/office-docs etc/letsencrypt
rc=$?
docker compose -f "$c" start
[ "$rc" -eq 0 ] && tar -tzf "$f" > /dev/null && echo "ok $f" ||
  { echo "FAILED $f"; exit 1; }
find /var/backups/office-docs -name 'onlyoffice-*.tar.gz' -mtime +14 -delete
EOF
printf '%s\n' '30 3 * * * root bash /usr/local/sbin/docs-backup.sh > /var/log/docs-backup/last.log 2>&1' > /etc/cron.d/docs-backup

Keep copies on another machine too. Logged in as root, run ssh-keygen -t ed25519 and accept the defaults, copy the key over with ssh-copy-id backup@203.0.113.10 so the job never sits at a password prompt, end the script with rsync -a /var/backups/office-docs/ backup@203.0.113.10:office-docs/, and prune with a job over there. Never add rsync's delete option: an empty folder here would empty the copies.

Restoring on the live server, as root (sudo -i first): each step must end with its ok, or you stop there.

1. Test the archive: tar -tzf /var/backups/office-docs/onlyoffice-DATE.tar.gz > /dev/null && echo backup readable ok.
2. Save open work and stop: docker exec onlyoffice-docs documentserver-prepare4shutdown; docker compose -f /srv/onlyoffice/compose.yaml down && echo container stopped ok.
3. Archive today's state, test it, move it aside: tar --numeric-owner -czf /root/docs-pre-restore.tar.gz -C / srv/onlyoffice && tar -tzf /root/docs-pre-restore.tar.gz > /dev/null && [ ! -e /srv/onlyoffice.previous ] && mv /srv/onlyoffice /srv/onlyoffice.previous && echo moved aside ok.
4. Unpack: tar -C / -xzpf /var/backups/office-docs/onlyoffice-DATE.tar.gz --numeric-owner srv/onlyoffice && echo unpacked ok (on a new server, the nginx and letsencrypt folders too).
5. Bring it up: docker compose -f /srv/onlyoffice/compose.yaml up -d, repeat the curl check, then occ onlyoffice:documentserver --check from Nextcloud.
6. Both fine? Delete /srv/onlyoffice.previous.

ONLYOFFICE supports only its newest stable release, so update regularly. Its guide says: back up, let users save with prepare4shutdown, start the new image on the same folders. Here: run the backup script, edit the version in the compose file's image line, fetch it (docker compose -f /srv/onlyoffice/compose.yaml pull). The backup restarted ONLYOFFICE, so people may be editing again: run docker exec onlyoffice-docs documentserver-prepare4shutdown once more, then restart on the new image (docker compose -f /srv/onlyoffice/compose.yaml up -d). If it misbehaves, set the image line to the previous tag and bring back the archive from the backup you ran minutes before updating.

The licence in plain words

You pay nothing for the Community Edition; it is licensed under the GNU AGPL version 3, and the LICENSE file in ONLYOFFICE's Docker image repository adds terms through the AGPL's section 7: keep all copyright, licence and attribution notices; mark any modified copy with the dates you changed it and a statement that it builds on ONLYOFFICE's original; make the legal notices visible in the user interface; icons and other non-code material fall under CC BY-SA 4.0; and no right to ONLYOFFICE's trademarks or logos is granted. Its Community licensing FAQ also says the free version keeps ONLYOFFICE's branding.

How we read it, as a general reading only and not legal advice: using the image unchanged inside your own team adds nothing to do. Handing copies to anyone, changed or unchanged, means making the matching source available under the AGPL. And if you change it and people use your changed version over a network, the AGPL also has you offer them that source.

Questions people ask

Is the free edition limited to 20 people?

ONLYOFFICE's edition comparison lists 'up to 20 recommended' as the Community Edition's user count: guidance, not a stated cap. ONLYOFFICE's licensing FAQ adds that for production use or commercial distribution, a commercial licence is the recommended route.

Will my files be stored on the ONLYOFFICE server?

No, they stay in Nextcloud or Seafile. ONLYOFFICE fetches a file while it is being edited and hands the saved version back once everyone has closed it; its own folders hold logs, a cache and certificates.

Do I need a database for the free edition?

No separate step. The current Docker install guide mounts three folders for the Community Edition: logs, data and lib. The README lists database, RabbitMQ and Redis folders only for the paid Enterprise and Developer images. If an older setup of yours mounts a db folder, as the update guide's backup command does, back it up as well.

Can ONLYOFFICE share a machine with Nextcloud?

Yes. The connector docs allow both on one server if ONLYOFFICE gets its own port or sits behind a proxy, since both default to port 80. Its own name behind nginx, as in this guide, covers that.

What happens if I skip setting the secret?

Signing stays on with a generated secret, but the help centre says it is replaced at every reboot. Your file cloud keeps the old one and stops opening documents until you update it.