Help with onlyoffice integration

[RikudouGoku]

I am struggling with integrating onlyoffice, they are both in the same compose using portainer on my synology, please help. I do not need external access the url below for onlyoffice is my reverse proxy and is not open for external access.

services:
  filebrowser:
    network_mode: bridge  
    environment:
      FILEBROWSER_CONFIG: "data/config.yaml"
      FILEBROWSER_ADMIN_PASSWORD: admin
      TZ: "Europe/Stockholm" # optionally set your local timezone https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
    volumes:
      - '/volume1:/folder' # Never mount root "/" directory to docker, always choose a sub-folder with your data.
      - '/volume2/docker2/filebrowser/data:/home/filebrowser/data' # mount the data folder you created with the config file.
      # (and if unraid) If you plan to run with a different user besides root or filebrowser, you will need to mount a tmp directory.
      #- './tmp/:/home/filebrowser/tmp/'
    ports:
      - '8885:80' # the left 80 is the port **you will use** to access. The right 80 is the container port that **must match the config.yaml**
    image: gtstef/filebrowser
    # Optionally run as non-root filebrowser user
    #user: filebrowser
    restart: unless-stopped

  onlyoffice:
    network_mode: bridge  


    container_name: OnlyOffice
    hostname: onlyoffice
    image: onlyoffice/documentserver:latest
    healthcheck:
      test: timeout 10s bash -c ':> /dev/tcp/127.0.0.1/80' || exit 1
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 90s
    ports:
      - 8467:80
    environment:
      JWT_ENABLED: true
      JWT_SECRET: J5HSKXAGVhoxAyjRbcJsc8zie395wss4evhVWV52omA0MHqwmZbsFgOMXXSuyvja
    volumes:
      - /volume2/docker2/onlyoffice/logs:/var/log/onlyoffice:rw
      - /volume2/docker2/onlyoffice/data:/var/www/onlyoffice/Data:rw
      - /volume2/docker2/onlyoffice/redis:/var/lib/redis:rw
      - /volume2/docker2/onlyoffice/rabbitmq:/var/lib/rabbitmq:rw
      - /volume2/docker2/onlyoffice/lib:/var/lib/onlyoffice:rw
      - /volume2/docker2/onlyoffice/fonts:/usr/share/fonts/truetype/custom:rw
      - /volume2/docker2/onlyoffice/database:/var/lib/postgresql:rw
    restart: on-failure:5
    

config file:

server:
  port: 80
  baseURL:  "/"
  logging:
    - levels: "info|warning|error"
  sources:
    - path: "/folder"
      config:
        defaultEnabled: true # add source for all users by default     
userDefaults:
  preview:
    image: true
    popup: true
    video: false
    office: false
    highQuality: false
  darkMode: true
  disableSettings: false
  singleClick: false
  permissions:
    admin: false
    modify: false
    share: false
    api: false
auth:
  adminUsername: admin
  adminPassword: admin

integrations:
  office:
    url: "https://onlyoffice.REDACTED.dedyn.io/welcome/"   # eg. a public internet IP/domain
    secret: J5HSKXAGVhoxAyjRbcJsc8zie395wss4evhVWV52omA0MHqwmZbsFgOMXXSuyvja      # same secret from above

I followed this guide for onlyoffice.
https://mariushosting.com/synology-install-onlyoffice-with-portainer/
and this for filebrowser
https://github.com/gtsteffaniak/filebrowser/wiki/Office-Support#adding-open-office-integration-for-docker

[gtsteffaniak]

Yeah I'm sorry it's challenging, debugging onlyoffice issues are currently very challenging.

I plan to put together a guide that should make it easier.

I think what you want is to populate the server.internalUrl with the local path your filebrowser container can use to talk to onlyoffice.

In the example you have, it looks like you can use the hostname. So something like:

server:
  internalUrl: http://filebrowser

This will allow the onlyoffice server to download and save the file directly with the container on the local docker bridge (is , the onlyoffice container will try to reach out to http://filebrowser/api/raw

If you open dev tools while opening an onlyoffice doc you should see the full onlyoffice config used. It will have two urls you can use to debug. One is the url with the onlyoffice server domain, the other is the callback url with the filebrowser domain. Once you have filebrowser talking to onlyoffice directly, you can also check the logs for onlyoffice to debug as well.

The process is pretty simple:

Your browser gets a onlyoffice config from FileBrowser. Then your browser takes that config and makes a request directly with the only office server from the config. This connection remains open directly with the only office server. Then, once the only office server connection is established, only office reaches out to FileBrowser to download the file for viewing. It uses the url from your config (see in dev tools). If it has a problem reaching out to filebrowser, you will see "download failed" error.

Sorry it's hard to debug, will be fixing that soon

[percevaq]

I have integrated onlyoffice workspace installed with the official workspace-install.sh script in docker and portainer.

On one side the server with document-server on the same domain as the other machine with the filebrowse quantum.

This installation adds in both document-server and community-server a nginx proxy server. Also in the filebrowse another nginx as proxy and cache.

It has been a madness to set it up and I had to modify the nginx server configurations in both document-server and community-server.

community-server is the one where the document viewing request comes in and redirects to document-server and it's pretty messy.

If it helps you I had to add the directive
add_header Content-Security-Policy "frame-ancestors 'self' *.<domain.com>;";
in the document-server
and in the community-server the same but in the part of nginx.conf because it makes a mapping that you cannot overwrite in the configuration files directly and I added the same directive.

All this is for the iframe it uses.
For the download errors the problem is mostly in the JWT key and the JWT header.

This in case it helps you even if it is not Traefik.

[RikudouGoku]

I think what you want is to populate the server.internalUrl with the local path your filebrowser container can use to talk to onlyoffice.

In the example you have, it looks like you can use the hostname. So something like:

server:
  internalUrl: http://filebrowser

This will allow the onlyoffice server to download and save the file directly with the container on the local docker bridge (is , the onlyoffice container will try to reach out to http://filebrowser/api/raw

I gave that a try but it didnt change anything and also tried the lan ip address. "http://192.168.0.100:8885"
which is the address used to access filebrowser on my other devices,

The weird thing is that it seems the onlyoffice logs show the first url i used.

==> /var/log/onlyoffice/documentserver/docservice/err.log <==

==> /var/log/onlyoffice/documentserver/nginx.error.log <==

2025/08/18 23:05:50 [error] 1099#1099: *16 connect() failed (111: Connection refused) while connecting to upstream, client: 172.17.0.1, server: , request: "GET /example/ HTTP/1.1", upstream: "http://127.0.0.1:3000/", host: "192.168.0.100:8467", referrer: "http://192.168.0.100:8467/welcome/"

2025/08/18 23:05:50 [error] 1099#1099: *16 connect() failed (111: Connection refused) while connecting to upstream, client: 172.17.0.1, server: , request: "GET /example/ HTTP/1.1", upstream: "http://127.0.0.1:3000/", host: "192.168.0.100:8467", referrer: "http://192.168.0.100:8467/welcome/"

2025/08/18 23:05:51 [error] 1099#1099: *16 no live upstreams while connecting to upstream, client: 172.17.0.1, server: , request: "GET /example/ HTTP/1.1", upstream: "http://example/", host: "192.168.0.100:8467", referrer: "http://192.168.0.100:8467/welcome/"

2025/08/18 23:15:21 [error] 9559#9559: *110 open() "/var/www/onlyoffice/documentserver-example/welcome/:8467/web-apps/apps/api/documents/api.js" failed (2: No such file or directory), client: 172.17.0.1, server: , request: "GET /welcome/:8467/web-apps/apps/api/documents/api.js?shardkey=459aa77b442c52a8ccc30743512cb0615d4027bf76c143795110ac0ae0b54695 HTTP/1.1", host: "onlyoffice.REDACTED.dedyn.io", referrer: "http://192.168.0.100:8885/"

2025/08/18 23:17:30 [error] 746#746: *2 connect() failed (111: Connection refused) while connecting to upstream, client: 172.17.0.1, server: , request: "GET /example/ HTTP/1.1", upstream: "http://127.0.0.1:3000/", host: "192.168.0.100:8467", referrer: "http://192.168.0.100:8467/welcome/"

2025/08/18 23:17:30 [error] 746#746: *2 connect() failed (111: Connection refused) while connecting to upstream, client: 172.17.0.1, server: , request: "GET /example/ HTTP/1.1", upstream: "http://127.0.0.1:3000/", host: "192.168.0.100:8467", referrer: "http://192.168.0.100:8467/welcome/"

==> /var/log/onlyoffice/documentserver-example/out.log <==

[gtsteffaniak]

Yeah it can be quite messy and I am not too happy with the experience either. I plan to add a docker image which has onlyoffice + filebrowser quantum without any configuration required (like how the ffmpeg integration works). But I haven't worked on it. It looks like a solution like that might simplify your setup since you run both locally.

As for the above logs, normally you should see multiple entries for a successfully configured server -- remember the only office server needs to be fully accessible by the client -- your web browser talks to the only office server not filebrowser... I really need a good diagram and wiki to make this easier.

But here is what a successfully configured setup looks like with both onlyoffice and filebrowser running locally in case it helps:

browser console logs (open an office file with developer console enabled):

my config:

server:
  port: 8080
  baseURL: "/testing"
  internalUrl: "http://host.docker.internal:8080/testing"
  logging:
    - levels: "info|debug|warning|error"
  sources:
    - path: "/Users/graham/Downloads"
      name: "downloads"
      config:
        defaultEnabled: true

integrations:
  media:
    ffmpegPath: /opt/homebrew/bin/
  office:
    url: "http://localhost:9052"
    secret: "6H1H7GzUk2alRkNxAPav0W02g8JS5oUd"

console logs

Client config: 
{
    "document": {
        "fileType": "csv",
        "key": "c288a6e59b9db60dd4260fc26cd0b403dddea4b64f3fd518e3976e3e650cd3ea",
        "permissions": {
            "download": true,
            "edit": true,
            "print": true
        },
        "title": "jira.csv",
        "url": "http://host.docker.internal:8080/testing/api/raw?files=downloads::/jira.csv&auth=redacted"
    },
    "editorConfig": {
        "callbackUrl": "http://host.docker.internal:8080/testing/api/onlyoffice/callback?files=downloads::%2Fjira.csv&auth=redacted",
        "customization": {
            "autosave": true,
            "forcesave": true,
            "uiTheme": "dark"
        },
        "lang": "en",
        "mode": "edit",
        "user": {
            "id": "1",
            "name": "admin"
        }
    },
    "token": "redacted",
    "type": "desktop"
}

my docker-compose config for onlyoffice:

services:
  onlyoffice:
    extra_hosts:
      - "host.docker.internal:host-gateway" # added so it can reach out to host.docker.internal:9052 host port (because filebrowser is running directly on host, not in docker)
    image: onlyoffice/documentserver
    environment:
      JWT_SECRET: 6H1H7GzUk2alRkNxAPav0W02g8JS5oUd
    ports:
      - '9052:80'

[RikudouGoku]

Yeah it can be quite messy and I am not too happy with the experience either. I plan to add a docker image which has onlyoffice + filebrowser quantum without any configuration required (like how the ffmpeg integration works). But I haven't worked on it. It looks like a solution like that might simplify your setup since you run both locally.

Would appreciate it.

[gtsteffaniak]

Shouldn't be too hard to add, I'll try setting something up that's easy to upgrade and use

[gtsteffaniak]

Closing -- please reopen after spending time debugging with https://github.com/gtsteffaniak/filebrowser/wiki/Office-Support#debugging-tips (v0.8.4)