Self-Hosting Office Suite Backend: Collabora Online (`COOL`) on Debian Linux (WOPI & Nextcloud)

Executive Summary: Collabora Online (COOL / CODE) brings the full LibreOffice C++ document engine into the web browser via the WOPI (Web Application Open Platform Interface) protocol. Unlike client-side JavaScript Canvas editors that download the entire document to the user's browser, Collabora renders documents server-side inside isolated Linux namespaces (coolforkit) and streams only compressed tile bitmaps and keystrokes over WebSockets—meaning confidential spreadsheets and contracts never leave your server's RAM even when viewed by an external guest!

Server-Side Tile Rendering

Renders .odt, .docx, .ods, .xlsx, and .pptx on the server and streams encrypted visual tiles—preventing raw file exfiltration on view-only shares.
coolforkit Jail Isolation

Spawns each active document session inside an isolated chroot/namespace jail (cap_sys_chroot, cap_fowner) to contain malformed macro/parser bugs.
Strict WOPI Host Whitelisting

Lock down aliasgroups so only your own cloud.nejat-hakan.de Nextcloud/Seafile instance is permitted to request document rendering sessions.
Custom TrueType Font Sync

Mount /usr/share/fonts (including Liberation and MS Core Fonts) so corporate Word and Excel layouts render with zero pagination drift.

1. Collabora Online WOPI & WebSocket Architecture

Collabora Online does not store files itself. Your storage platform (Nextcloud or Seafile) acts as the WOPI Host, issuing a short-lived cryptographic access token to the browser, which then opens a bidirectional WebSocket (/cool/.../ws) to the Collabora WOPI Client:

%%{init: {'flowchart': {'wrappingWidth': 600}}}%%
flowchart TB
    BRO["🌐 User Web Browser<br/>(Collabora JS Canvas)"]
    PROXY["🔒 Reverse Proxy (TLS 1.3)<br/>office.nejat-hakan.de"]
    COOL["📄 Collabora Online (coolwsd)<br/>127.0.0.1:9980<br/>(Server-Side Tile Engine)"]
    NC["☁️ Nextcloud (WOPI Host)<br/>cloud.nejat-hakan.de<br/>(Stores .docx / .odt Files)"]

    BRO <-->|"1. Open File Iframe"| NC
    BRO <==>|"2. WebSocket Tiles (/cool/*/ws)"| PROXY
    PROXY <==>|"HTTP / WS"| COOL
    COOL <==>|"3. WOPI GetFile / PutFile"| NC

2. Production Container Deployment (`compose.yaml`)

Install core fonts on the Debian host so documents created in Microsoft Office render with identical metric-compatible fonts (fonts-liberation2, fonts-crosextra-carlito, fonts-crosextra-caladea), then deploy collabora/code:

# File: /opt/collabora-ops/01_install_metric_fonts.sh
sudo apt update && sudo apt install -y \
    fonts-liberation2 \
    fonts-dejavu \
    fonts-crosextra-carlito \
    fonts-crosextra-caladea

# File: /srv/containers/collabora/compose.yaml
services:
  collabora:
    image: docker.io/collabora/code:latest
    container_name: collabora-code
    restart: unless-stopped
    ports:
      - "127.0.0.1:9980:9980/tcp"
    cap_add:
      - MKNOD
      - SYS_CHROOT
      - FOWNER
    environment:
      # 1. Whitelist ONLY your Nextcloud/Seafile domain (escape dots with double backslashes)
      aliasgroup1: "https://cloud\\.nejat-hakan\\.de:443"
      server_name: "office.nejat-hakan.de"
      username: "admin"
      password: "${COLLABORA_ADMIN_PASSWORD}"
      # 2. Terminate TLS at the upstream Reverse Proxy (Caddy / Traefik / Nginx)
      extra_params: "--o:ssl.enable=false --o:ssl.termination=true --o:logging.level=warning"
      TZ: "Europe/Berlin"
    volumes:
      - /usr/share/fonts/truetype:/usr/share/fonts/truetype/host-fonts:ro

3. Reverse Proxy & Nextcloud `allow_list` Hardening

Reverse Proxy Configuration (Caddy vs. Nginx)

1. Caddyfile (office.nejat-hakan.de)2. Nextcloud WOPI Allowlist (occ CLI)

# File: /etc/caddy/Caddyfile
office.nejat-hakan.de {
    encode zstd gzip
    reverse_proxy 127.0.0.1:9980
}

# File: /opt/collabora-ops/02_connect_nextcloud.sh
#!/usr/bin/env bash
set -euo pipefail

# 1. Install the Nextcloud Office (richdocuments) app
docker exec -u www-data nextcloud-app php occ app:install richdocuments

# 2. Point Nextcloud to your external Collabora domain
docker exec -u www-data nextcloud-app php occ config:app:set richdocuments wopi_url --value="https://office.nejat-hakan.de"

# 3. CRITICAL SECURITY: Restrict WOPI callback requests strictly to your reverse proxy / server IPs!
docker exec -u www-data nextcloud-app php occ config:app:set richdocuments wopi_allowlist --value="127.0.0.1/32,172.16.0.0/12,203.0.113.5/32"

Where to Go Next

Compare Collabora Online with OnlyOffice Docs and review your Nextcloud host configuration:

OnlyOffice Docs Backend

Compare Collabora's server-side LibreOffice engine with OnlyOffice's client-side HTML5 Canvas OOXML engine.

OnlyOffice Guide
Nextcloud Cloud Stack

Integrate Collabora Online directly into your hardened Nextcloud + Redis + PostgreSQL server.

Nextcloud Guide
Caddy Reverse Proxy

Route WebSocket /cool/ connections with automatic TLS 1.3 termination in Caddy.

Caddy Guide

Self-Hosting Office Suite Backend: Collabora Online (COOL) on Debian Linux (WOPI & Nextcloud)