ONLYOFFICE Setup Guide

This guide covers the installation, configuration, and maintenance of ONLYOFFICE Document Server for use with PowerFolder Server. Docker is the recommended installation method as it simplifies upgrades and repairs.

Contents

1 Supported Versions & Compatibility

Latest Supported Version

ONLYOFFICE Docs™ Enterprise Edition (EE) v9.2.x

ONLYOFFICE Docs™ EE is compatible with PowerFolder Server. Licences can be purchased directly from PowerFolder Sales.

Do not use any newer version until it is explicitly marked as "tested" here. We cannot support versions that have not been tested with the current PowerFolder Server release.

Due to API and backend changes, this version is compatible with PFS v20.1.100 and onwards.

Minimum Supported Version

Due to security fixes from ONLYOFFICE, the minimum supported version is v7.2. Older versions are not supported.

Supported File Formats

ONLYOFFICE does not support DOC / XLS / PPT (MS Office 2003) file formats. Ensure all files are converted to the current formats (DOCX, XLSX, PPTX) before use.

Quality Assurance & Test Cases

ONLYOFFICE versions are marked as compatible with PowerFolder Server based on our test cases. The test cases are available under: ONLYOFFICE – Quality Assurance and Test Cases.

Updating from Version 4.x

When updating from version 4, a full re-installation is required — in-place upgrades are not supported. A new licence key is also required. Licence keys for v4.x are invalid for v5.x and above.

Useful Links

2 Docker Installation

Docker is the recommended installation method. Install Docker first:

apt-get install docker.io

Then follow the official ONLYOFFICE Docker guide:
helpcenter.onlyoffice.com – Docker Installation

3 Certificates & License

Place the certificate and licence files in the correct locations:

mkdir -p /app/onlyoffice/DocumentServer/data/certs
cp onlyoffice.key /app/onlyoffice/DocumentServer/data/certs/
cp onlyoffice.crt /app/onlyoffice/DocumentServer/data/certs/
cp license.lic    /app/onlyoffice/DocumentServer/data/
chmod 600 /app/onlyoffice/DocumentServer/data/certs/onlyoffice.key

The certificate files must be named exactly onlyoffice.key and onlyoffice.crt. Custom file names are not supported.

Provide the complete SSL chain in the CRT file in the following order: End-User Certificate → Intermediate Certificate(s) → Root Certificate.

4 PowerFolder Server Configuration

After a successful ONLYOFFICE installation, configure the ONLYOFFICE URL in PowerFolder:

Log in to the PowerFolder web portal as Admin.
Click on Preferences.
Open the Web tab in the top drop-down menu.
Under Open files in web, enter the URL of your ONLYOFFICE server.

5 Auto-Save

To configure ONLYOFFICE to auto-save open documents every minute:

List running containers: docker container list
Enter the container: docker exec -it <container_id> /bin/bash
Edit the config: vi /etc/onlyoffice/documentserver/default.json
Find the autoAssembly section. Set enabled to true and interval to 1m.
Restart services: supervisorctl restart all
Exit the container: exit

This configuration must be re-applied after every update of the ONLYOFFICE Docker container.

6 Info Page & Statistics

The ONLYOFFICE Document Server info page shows connection statistics (last hour, 24h, week, month) — useful for estimating the number of concurrent connections needed for licence renewal.

Open the info page at: https://<documentserver_address>/info/

If you receive an Access Denied error, modify the Nginx configuration inside the container:

Find the container ID: docker ps
Enter the container: docker exec -it <container_id> bash
Edit: /etc/nginx/includes/ds-docservice.conf
Find the section below and comment out the allow / deny lines:
# Allow server info only from 127.0.0.1 location ~* ^(\/[\d]+\.[\d]+\.[\d]+[\.|-][\d]+)?\/(info|internal)(\/.*)$ { # allow 127.0.0.1; # deny all; proxy_pass http://docservice; }
Reload Nginx: service nginx restart

7 Update & Downgrade

Save the info page statistics before updating — they will be lost after the container is replaced.

Forceful Stop of All Running Sessions

Before updating, stop all active sessions:

documentserver-prepare4shutdown.sh

Update Steps

docker container list
docker container stop <container_id>
docker container rm <container_id>
docker image list
docker rmi -f <image_id>
docker system prune

Start the latest version (HTTPS only):

docker run – update

sudo docker run -i -t -d -p 443:443 --restart=always \
    -v /app/onlyoffice/DocumentServer/logs:/var/log/onlyoffice  \
    -v /app/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data  \
    -v /app/onlyoffice/DocumentServer/lib:/var/lib/onlyoffice \
    -v /app/onlyoffice/DocumentServer/db:/var/lib/postgresql \
    onlyoffice/documentserver-ee

After an update of the Docker daemon itself, the container may become unreliable. A full server restart is required — restarting only the container or daemon is not sufficient.

Downgrade Steps

Follow the same stop/remove steps as above, then start a specific version:

docker run – downgrade

sudo docker run -i -t -d -p 443:443 --restart=always \
    -v /app/onlyoffice/DocumentServer/logs:/var/log/onlyoffice  \
    -v /app/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data  \
    -v /app/onlyoffice/DocumentServer/lib:/var/lib/onlyoffice \
    -v /app/onlyoffice/DocumentServer/db:/var/lib/postgresql \
    onlyoffice/documentserver-ee<version>

8 Changing the Default File Size Limit

The default maximum file size that can be opened in ONLYOFFICE is 100 MB (104,857,600 bytes). Two parameters control this:

Parameter	Description

Parameter	Description
`FileConverter.converter.maxDownloadBytes`	Maximum size (in bytes) of a document the server is allowed to download and open.
`FileConverter.converter.inputLimits.zip.uncompressed`	Maximum uncompressed size of XML contents inside OOXML files (e.g. PPTX are ZIP archives containing XML).

Edit /etc/onlyoffice/documentserver/default.json:

"FileConverter": {
    "converter": {
        "maxDownloadBytes": 1073741824, // 1 GB in bytes
        "downloadTimeout": {
            "connectionAndInactivity": "10s",
            "wholeCycle": "2m"
        },
        "inputLimits": [
            {
                "type": "pptx;ppsx;potx;pptm;ppsm;potm",
                "zip": {
                    "uncompressed": "1000MB",
                    "template": "*.xml"
                }
            }
        ]
    }
}

Apply the changes by restarting Document Server services:

supervisorctl restart all

If a file previously failed to open, re-upload it after increasing the limit. The system may have stored an error state for the old file identifier.

9 Restricting ONLYOFFICE to Specific Domains

Edit /etc/onlyoffice/documentserver/default.json and update the ipfilter section:

"ipfilter": {
    "rules": [
        {"address": "produktiv@domain.de", "allowed": true},
        {"address": "testsrv@domain.de",   "allowed": true},
        {"address": "*",                    "allowed": false}
    ],
    "useforrequest": false,
    "errorcode": 403
}

Restart all services after saving:

supervisorctl restart all

10 JWT Authentication

Enable JWT

Generate a secure token:

openssl rand -hex 32

Example output:

9fae88f82c41a2c33bc5b35ae4dcbbf19b26e4e3f224dc5eb0c62f4a2fc54171

Start the Docker container with JWT enabled (the token persists across updates/downgrades):

docker run – JWT enabled

docker run -e JWT_ENABLED=true \
    -e JWT_SECRET=9fae88f82c41a2c33bc5b35ae4dcbbf19b26e4e3f224dc5eb0c62f4a2fc54171 \
    -i -t -d -p 443:443 --restart=always --name onlyoffice \
    -v /app/onlyoffice/DocumentServer/logs:/var/log/onlyoffice  \
    -v /app/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data  \
    -v /app/onlyoffice/DocumentServer/lib:/var/lib/onlyoffice \
    -v /app/onlyoffice/DocumentServer/db:/var/lib/postgresql \
    onlyoffice/documentserver-ee

Verify JWT is active:

docker exec onlyoffice printenv | grep JWT

Expected output:

JWT_ENABLED=true
JWT_SECRET=9fae88f82c41a2c33bc5b35ae4dcbbf19b26e4e3f224dc5eb0c62f4a2fc54171

PowerFolder Configuration

Add the JWT secret to PowerFolder.config and restart the server:

web.inline_view.onlyoffice.jwt=9fae88f82c41a2c33bc5b35ae4dcbbf19b26e4e3f224dc5eb0c62f4a2fc54171

Disable JWT

Since ONLYOFFICE Document Server v7.2, JWT is enabled by default. See the changelog for details. Only disable JWT if your integration does not use it.

docker run – JWT disabled

docker run -e JWT_ENABLED=false \
    -i -t -d -p 443:443 --restart=always \
    -v /app/onlyoffice/DocumentServer/logs:/var/log/onlyoffice  \
    -v /app/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data  \
    -v /app/onlyoffice/DocumentServer/lib:/var/lib/onlyoffice \
    -v /app/onlyoffice/DocumentServer/db:/var/lib/postgresql \
    onlyoffice/documentserver-ee

11 Disable Plugins & Macros

Disable Plugins

cd /var/www/onlyoffice/documentserver/sdkjs-plugins
sudo mkdir -v plugin_backup
sudo cp -av highlightcode macros marketplace mendeley ocr photoeditor \
            speech thesaurus translator youtube zotero plugin_backup
sudo rm -rf highlightcode macros marketplace mendeley ocr photoeditor \
            speech thesaurus translator youtube zotero
sudo systemctl restart ds-docservice.service && systemctl status ds-docservice.service

Disable Macros

List containers: docker container list
Enter container: docker exec -it <container_id> /bin/bash
Navigate to plugins: cd /var/www/onlyoffice/documentserver/sdkjs-plugins/
Remove Macros plugin: rm -rf E6978D28-0441-4BD7-8346-82FAD68BCA3B
Restart services: supervisorctl restart all
Exit: exit

On Windows: %ProgramFiles%\ONLYOFFICE\DocumentServer\config\local.json

12 Enabling WOPI

WOPI in ONLYOFFICE Docs 7.x

Enter container: docker exec -it <container_id> /bin/bash
Edit: vi /etc/onlyoffice/documentserver/local.json
Add the following:
"wopi": { "enable": true },
Restart: supervisorctl restart all then exit

WOPI in ONLYOFFICE Docs 8.x

Enter container: docker exec -it <container_id> /bin/bash
Edit: vi /etc/onlyoffice/documentserver/default.json
Set wopi.enable to true:
"wopi": { "enable": true,
Restart: supervisorctl restart all then exit

Alternatively, pass WOPI as an environment variable at container start:

docker run – WOPI enabled

docker run -e JWT_ENABLED=false -e WOPI_ENABLED=true \
    -i -t -d -p 443:443 --restart=always \
    -v /app/onlyoffice/DocumentServer/logs:/var/log/onlyoffice  \
    -v /app/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data  \
    -v /app/onlyoffice/DocumentServer/lib:/var/lib/onlyoffice \
    -v /app/onlyoffice/DocumentServer/db:/var/lib/postgresql \
    onlyoffice/documentserver-ee

Test WOPI

https://<ONLYOFFICE-URL>/example/wopi?userid=uid-1&lang=en

Activate WOPI Server in PowerFolder

Provide the WOPI Server URL in the PowerFolder Settings as server admin.

Read-Only File Links with WOPI

Enter container: docker exec -it <container_id> /bin/bash
Edit: vi /var/www/onlyoffice/documentserver/web-apps/apps/api/wopi/editor-wopi.ejs
Update the permissions section:
"permissions": { "print": !fileInfo.DisablePrint && !fileInfo.HidePrintOption && !fileInfo.ReadOnly && fileInfo.UserCanWrite, "download": !fileInfo.ReadOnly && fileInfo.UserCanWrite, }
Restart: supervisorctl restart all then exit

More info: ONLYOFFICE API Documentation

13 Using ONLYOFFICE with Nginx

ONLYOFFICE can be run behind an external Nginx reverse proxy with SSL offloading. Start the container on port 80 (or any other TCP port):

docker run – no SSL (behind reverse proxy)

docker run -e JWT_ENABLED=false -e WOPI_ENABLED=true \
    -i -t -d -p 80:80 --restart=always \
    -v /app/onlyoffice/DocumentServer/logs:/var/log/onlyoffice \
    -v /app/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data \
    -v /app/onlyoffice/DocumentServer/lib:/var/lib/onlyoffice \
    -v /app/onlyoffice/DocumentServer/db:/var/lib/postgresql \
    onlyoffice/documentserver-ee

Example Nginx configuration:

nginx.conf (example)

upstream docservice {
    server 10.0.0.0:80;
}

map $http_host $this_host {
    "" $host; default $http_host;
}
map $http_x_forwarded_proto $the_scheme {
    default $http_x_forwarded_proto; "" $scheme;
}
map $http_x_forwarded_host $the_host {
    default $http_x_forwarded_host; "" $this_host;
}
map $http_upgrade $proxy_connection {
    default upgrade; "" close;
}

proxy_set_header Upgrade          $http_upgrade;
proxy_set_header Connection       $proxy_connection;
proxy_set_header X-Forwarded-Host $the_host;
proxy_set_header X-Forwarded-Proto $the_scheme;
proxy_set_header X-Forwarded-For  $proxy_add_x_forwarded_for;

# Redirect HTTP → HTTPS
server {
    listen 80;
    server_name oo.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name oo.example.com;
    server_tokens off;

    ssl_certificate     /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    ssl_prefer_server_ciphers on;
    ssl_session_cache   shared:SSL:10m;

    add_header X-Content-Type-Options nosniff;

    location / {
        proxy_pass         http://docservice;
        proxy_http_version 1.1;
    }
}

The above is an example configuration only. Adapt it to your specific infrastructure.

Further reading:
ONLYOFFICE – Nginx Proxy Setup
Apache proxy configuration (GitHub)