Zum Inhalt

Self-Hosting Office Suite Backend: OnlyOffice Docs (DocumentServer) on Debian Linux (JWT & OOXML)

Executive Summary: OnlyOffice Docs (DocumentServer) is the gold standard when 100% pixel-perfect Microsoft Office (OOXML: .docx, .xlsx, .pptx) compatibility and smooth client-side browser responsiveness are your top priorities. Unlike Collabora Online (which uses ODF natively and renders bitmap tiles on the server), OnlyOffice sends document geometry to an HTML5 <canvas> engine in the user's browser—offloading rendering CPU work to the client's laptop while synchronizing real-time co-authoring edits via Node.js, PostgreSQL, and RabbitMQ.

  • Native OOXML (.docx/.xlsx) Engine

    Uses Microsoft's native OpenXML specification as its internal data model—eliminating format conversion artifacts on complex Excel pivot tables and Word layouts.

  • Client-Side HTML5 Canvas Rendering

    Renders fonts and vector shapes at 60 fps directly on the client's GPU, keeping server CPU load near zero even during heavy scrolling.

  • Mandatory JWT Authentication

    Enforce cryptographic JSON Web Tokens (JWT_SECRET) on all API and WOPI requests so unauthorized third parties can never hijack your DocumentServer.

  • Nextcloud & Seafile Ready

    Integrates seamlessly as the default browser office editor inside both Nextcloud and Seafile.

1. Collabora Online vs. OnlyOffice Docs: Engineering Comparison

Architectural Dimension OnlyOffice Docs Collabora Online (COOL)
Native Internal Format Microsoft OOXML (.docx, .xlsx, .pptx) OpenDocument Format (ODF) (.odt, .ods, .odp)
Rendering Location Client Browser (HTML5 Canvas) — Ultra-smooth scrolling, low server CPU Server-Side (C++ Tile Bitmap Stream) — Document bytes never leave server RAM
Server RAM Footprint ~1.2 GB – 2.0 GB (Bundles Node.js, PostgreSQL, RabbitMQ, Nginx) ~450 MB – 800 MB (Single coolwsd daemon)
Mobile Touch Editing Dedicated mobile web view / native app Full responsive touch UI directly in mobile browser 
%%{init: {'flowchart': {'wrappingWidth': 600}}}%%
flowchart TB
    BRO["💻 Client Browser<br/>(HTML5 Canvas Engine)"]
    PROXY["🔒 Reverse Proxy (TLS 1.3)<br/>onlyoffice.nejat-hakan.de"]
    OO["📊 OnlyOffice DocumentServer<br/>127.0.0.1:8083<br/>(Node.js + RabbitMQ + PG)"]
    HOST["☁️ Nextcloud / Seafile<br/>(Signs Requests via JWT)"]

    BRO <-->|"1. Co-Editing WebSockets"| PROXY
    PROXY <--> OO
    OO <==>|"2. JWT-Verified Download/Save"| HOST

2. Production Container Deployment (compose.yaml)

Never Deploy OnlyOffice with JWT_ENABLED=false!

An unauthenticated OnlyOffice DocumentServer exposed to the internet allows anyone to use your server's CPU/RAM for document conversion and SSRF attacks. Always enforce JWT_ENABLED: "true" with a 32-byte cryptographic JWT_SECRET generated via openssl rand -hex 32.

# File: /srv/containers/onlyoffice/compose.yaml
services:
  onlyoffice-docs:
    image: docker.io/onlyoffice/documentserver:latest
    container_name: onlyoffice-docs
    restart: unless-stopped
    ports:
      - "127.0.0.1:8083:80/tcp"
    environment:
      - TZ=Europe/Berlin
      # Mandatory JWT Cryptographic Authentication
      - JWT_ENABLED=true
      - JWT_SECRET=${ONLYOFFICE_JWT_SECRET}
      - JWT_HEADER=Authorization
      - JWT_IN_BODY=true
      - WOPI_ENABLED=false
    volumes:
      - /srv/containers/onlyoffice/logs:/var/log/onlyoffice:rw
      - /srv/containers/onlyoffice/data:/var/www/onlyoffice/Data:rw
      - /srv/containers/onlyoffice/lib:/var/lib/onlyoffice:rw
      - /srv/containers/onlyoffice/db:/var/lib/postgresql:rw

3. Reverse Proxy Headers (X-Forwarded-Proto) & Nextcloud Connection

OnlyOffice's internal Nginx server requires explicit X-Forwarded-Proto: https and X-Forwarded-Host headers when TLS is terminated by an upstream reverse proxy:

# File: /etc/caddy/Caddyfile
onlyoffice.nejat-hakan.de {
    encode zstd gzip
    reverse_proxy 127.0.0.1:8083 {
        header_up X-Forwarded-Proto https
        header_up X-Forwarded-Host {host}
    }
}

# File: /opt/onlyoffice-ops/connect_nextcloud_onlyoffice.sh
#!/usr/bin/env bash
set -euo pipefail

docker exec -u www-data nextcloud-app php occ app:install onlyoffice
docker exec -u www-data nextcloud-app php occ config:app:set onlyoffice DocumentServerUrl --value="https://onlyoffice.nejat-hakan.de/"
docker exec -u www-data nextcloud-app php occ config:app:set onlyoffice jwt_secret --value="${ONLYOFFICE_JWT_SECRET}"
docker exec -u www-data nextcloud-app php occ config:app:set onlyoffice jwt_header --value="Authorization"

Where to Go Next

Explore alternative document engines and cloud storage platforms:

  • Collabora Online (COOL)

    Compare OnlyOffice's client-side OOXML canvas with Collabora's server-side LibreOffice tile streaming.

    Collabora Guide

  • Nextcloud Cloud Stack

    Review the complete Nextcloud + PostgreSQL + Redis production architecture.

    Nextcloud Guide

  • Seafile High-Speed Sync

    Integrate OnlyOffice Docs with Seafile for lightning-fast file chunk synchronization.

    Seafile Guide