Homelab 11: your files and office suite instead of Google Drive and Docs

Level IntermediateEstimated time 2 hRead first Homelab 2: one HTTPS entrance for all your servicesA word you don't know? Glossary

Nextcloud keeps your files, syncs them to every device, and adds calendars, contacts and sharing links. Paired with OnlyOffice, it edits Word, Excel and PowerPoint files in the browser, several people at once. It is the heaviest replacement in this series, and the one where understanding the mechanism saves the most time.

Opening a document involves three parties. Your browser gets the file list from Nextcloud but loads the editor from the document server; the document server fetches the file from Nextcloud and saves it back. Every request between them is signed with the same shared secret.

A bit of history

Nextcloud was founded in 2016 by Frank Karlitschek and most of the developers of ownCloud, the project he had started in 2010, after a disagreement over its direction. It covers files, calendars, contacts and more. For documents edited in the browser, it plugs in an office suite such as OnlyOffice, so a spreadsheet opens and saves without leaving your server.

1. Nextcloud

Run the official Nextcloud image with a PostgreSQL database and Redis for caching, pin the major version, and publish it through your HTTPS proxy (Homelab 2). Behind a proxy, tell Nextcloud how it is reached, in config/config.php:

'trusted_domains' => ['cloud.yourdomain.tld'],
'trusted_proxies' => ['<your proxy's local address>'],
'overwriteprotocol' => 'https',

Without overwriteprotocol, Nextcloud believes it is served over plain HTTP and builds broken links and redirect loops.

Background jobs: in Administration → Basic settings, choose Cron, and run it every five minutes from the host:

*/5 * * * * docker exec -u www-data nextcloud php -f /var/www/html/cron.php

2. OnlyOffice

Run the OnlyOffice Document Server image, version pinned, with a shared secret so that only your Nextcloud can use it:

environment:
  - JWT_ENABLED=true
  - JWT_SECRET=<a long random value>

Publish it through the proxy under its own name (for example office.yourdomain.tld). In Nextcloud, install the ONLYOFFICE app, then give it the document server's HTTPS address and the same secret.

Why it fails, and where to look

The diagram above is the whole debugging guide. If the editor stays blank, your browser cannot reach the document server's address. If the editor opens but the file does not load or save, the document server cannot reach Nextcloud's address, or the secrets differ. Check each arrow from the place it starts.

Traps

On its first start, the document server downloads its default plugins from the internet. If that download hangs, the server loops in its initialisation and never becomes healthy. If the first start never ends, look at the plugin manager process first.

Both services must be HTTPS if the page is HTTPS: a browser refuses to load an HTTP editor inside an HTTPS page, without a clear message.

Do not test the document server's internal port over HTTPS if it serves plain HTTP behind the proxy: you will get no answer at all and suspect the wrong component.

Sources

Found this useful? Tell us what to measure next.