Nextcloud with Collabora Online Office

Prerequisites

• An active Azure subscription.
• An SSH key pair.
• A VNet and subnet in the target region.
• NSG inbound rules that allow 22/tcp from your management network, and 80/tcp and 443/tcp for the web interface.

Standard_B2ms (2 vCPU / 8 GiB RAM) is the recommended starting size. The office engine pre-spawns LibreOffice kit processes alongside Nextcloud, PostgreSQL and Redis, and the image never uses swap.

Collabora's own guidance prefers four or more vCPUs for busier teams. Pick Standard_B4ms (4 vCPU / 16 GiB) if many people will edit at once.

Step 1 - Deploy from the Azure Marketplace

• Sign in to the Azure Portal, choose Create a resource, and search the Marketplace for Nextcloud Collabora by SecureAnyCloud. Select Create.
• On the Basics tab, pick your subscription, resource group, region and size (Standard_B2ms or larger).
• Under Administrator account, choose SSH public key and paste your key.
• Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443).
• On the Disks tab, review the dedicated 60 GiB data disk.
• Choose Review + create, then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name nextcloud-collabora \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name nextcloud-collabora --port 80,443 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

The message of the day shows where the credentials file and this guide live.

Step 4 - Confirm the services are running

The web tier, PHP runtime, database, cache and Collabora office engine all run as systemd units. Check them:

systemctl is-active nginx.service php8.3-fpm.service postgresql.service redis-server.service coolwsd.service

Each of the five lines reports active.

On first boot, the VM ran nextcloud-collabora-firstboot.service. It minted the TLS certificate, rotated every password and wired Nextcloud Office to the local Collabora server before nginx opened.

Step 5 - Confirm the health endpoint

nginx serves an unauthenticated health probe on both HTTP and HTTPS, separate from the Nextcloud web root (which redirects to the sign-in page). Request it:

curl -s http://localhost/health

It returns ok.

Step 6 - Confirm Nextcloud is installed and healthy

Nextcloud's status.php endpoint reports the install state and version without requiring a login. The -k flag accepts the per-VM self-signed certificate:

curl -sk https://localhost/status.php

The JSON response contains "installed":true and "versionstring":"34.0.3".

Step 7 - Retrieve your credentials

Every secret is generated uniquely on the first boot of your VM and written to a root-only file. Read the file:

sudo cat /root/nextcloud-collabora-credentials.txt

The file holds:

• NEXTCLOUD_URL, NEXTCLOUD_ADMIN_USER (admin) and NEXTCLOUD_ADMIN_PASSWORD.
• The PostgreSQL and Redis passwords.
• COLLABORA_ADMIN_CONSOLE_URL, COLLABORA_ADMIN_USER and COLLABORA_ADMIN_PASSWORD for the Collabora admin console.
• TLS_CERT_SHA256_FINGERPRINT, so you can verify the certificate your browser warns you about.

Store the passwords somewhere safe.

Step 8 - Sign in to the web interface

Browse to https://<vm-public-ip>/. The certificate is self-signed and issued to the VM's public IP, so your browser warns you once. Compare its SHA-256 fingerprint with TLS_CERT_SHA256_FINGERPRINT from Step 7, then accept it. Step 15 covers replacing it with a certificate for your own domain.

Sign in as admin with the password from Step 7.

On first boot, the image adds the VM's public and private IPv4 addresses to Nextcloud's trusted domains and sets the canonical URL to https://<vm-public-ip>/, so you can reach it immediately. If you later front the instance with your own DNS name and see an "access through untrusted domain" page, add the name once with:

sudo -u www-data php /var/www/nextcloud/occ config:system:set trusted_domains 4 --value your.domain.com

This host-header allowlist is a deliberate security control. The image never uses a wildcard.

After signing in, you land in the Files app, where you upload, organise and share files and folders.

Step 9 - Create and edit a document in the browser

In the Files app, choose + New > Document. Keep the suggested name or type your own, and select Create. Nextcloud Office offers its template picker, with Blank preselected. Choose Create again.

The document opens in the Collabora Online editor, served from the same https://<vm-public-ip> origin as Nextcloud. Type into the page. The word count in the status bar updates as you go.

The document is saved back into your Nextcloud files through the WOPI protocol. Use the toolbar save button, or close the editor, because Collabora saves on exit.

The first time the editor opens, it shows CODE's three-slide welcome. Close it with the button on the last slide.

Spreadsheets and presentations work the same way (+ New > Spreadsheet or Presentation). Existing .docx, .xlsx, .pptx and OpenDocument files you upload open in the editor when you click them.

Step 10 - How Nextcloud and Collabora are wired

Both legs of the WOPI conversation stay on the VM. The browser reaches the editor through nginx, on the same origin as Nextcloud. Read the configuration back:

OCC='sudo -u www-data php /var/www/nextcloud/occ' $OCC config:app:get richdocuments wopi_url $OCC config:app:get richdocuments wopi_callback_url $OCC config:app:get richdocuments public_wopi_url $OCC config:app:get richdocuments wopi_allowlist

• wopi_url is http://127.0.0.1:9980. Nextcloud talks to the local coolwsd over loopback.
• wopi_callback_url is http://127.0.0.1. coolwsd fetches and saves documents through a loopback-only nginx server, never over the public address.
• public_wopi_url is https://<vm-public-ip>. It is auto-detected from Collabora's discovery document, and it is where the browser loads the editor from.
• wopi_allowlist is 127.0.0.1,::1. Only the local office engine may call Nextcloud's WOPI file endpoints. The mirror-image allow-list on the Collabora side (storage.wopi.alias_groups in /etc/coolwsd/coolwsd.xml) admits only this instance.

Confirm that the office engine answers through the front door and identifies itself:

curl -sk https://localhost/hosting/capabilities | python3 -m json.tool | grep -E 'productName|productVersion'

It prints "productName": "Collabora Online Development Edition" and "productVersion": "26.04.3.2".

The same picture appears in Administration settings > Nextcloud Office (Collabora). That page reports the server as reachable, the URL used by the browser and the Nextcloud URL used by Collabora.

To switch to a supported Collabora Online subscription later, enter its URL under Use your own server and save.

Step 11 - The Collabora admin console

coolwsd ships an admin console with live document, memory and CPU statistics at COLLABORA_ADMIN_CONSOLE_URL from Step 7 (https://<vm-public-ip>/browser/dist/admin/admin.html).

The per-VM COLLABORA_ADMIN_USER / COLLABORA_ADMIN_PASSWORD credential protects the console and its Prometheus metrics endpoint. Unauthenticated requests are refused:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:9980/cool/getMetrics

It prints 401. With the credential from Step 7 (curl -u admin:<password> http://127.0.0.1:9980/cool/getMetrics), the same endpoint returns 200 and the metrics.

On a 2 vCPU size, the console notes that Collabora prefers four or more threads. That is a sizing hint for busy teams, not a fault.

Step 12 - Verify authentication over the API

Nextcloud's OCS user endpoint rejects unauthenticated requests and accepts your per-VM admin password. An unauthenticated request returns HTTP 401:

curl -sk -o /dev/null -w '%{http_code}\n' -H 'OCS-APIRequest: true' https://localhost/ocs/v2.php/cloud/user

To check end-to-end authentication, read your admin password from /root/nextcloud-collabora-credentials.txt (Step 7). Then run curl -k -u admin:<password> -H 'OCS-APIRequest: true' https://<vm-public-ip>/ocs/v2.php/cloud/user from a shell.

The request returns HTTP 200 with your user record as XML. A wrong password returns 401.

Step 13 - Confirm where your data and database live

Both the Nextcloud data directory and the PostgreSQL datadir sit on the dedicated Azure data disk, so you can grow or snapshot them independently of the OS disk. Check the mount:

df -h /var/lib/nextcloud | tail -1

The mount /var/lib/nextcloud holds data/ (user files) and pgsql/main (the PostgreSQL cluster).

Step 14 - The security model

Only three TCP ports are bound off the loopback interface. The office engine, the database and the cache are reachable from the VM itself alone. List the listeners:

sudo ss -lntH | awk '{print $4}' | grep -vE '^(127\.|\[::1\])' | sed -E 's/.*://' | sort -un

It prints exactly 22, 80 and 443. coolwsd listens on 127.0.0.1:9980, PostgreSQL on 127.0.0.1:5432 and Redis on 127.0.0.1:6379 (with a per-VM requirepass).

Nothing in the image carries a known credential. nextcloud-collabora-firstboot.service rotates the build-time throwaway passwords before nginx is allowed to start. The TLS key and the WOPI proof key are generated on your VM. The Nextcloud instance secret is re-minted, so no two VMs from this image share it. There is no swap on the OS disk.

Step 15 - Maintenance

• Your own domain and certificate: point a DNS name at the VM and add it to trusted_domains (Step 8). Replace /etc/nginx/ssl/nextcloud.crt and /etc/nginx/ssl/nextcloud.key with your certificate, for example from certbot (:80 already serves /.well-known/acme-challenge/ from /var/www/acme), and reload nginx. Update the canonical URL with occ config:system:set overwrite.cli.url --value https://your.domain.com/. Collabora advertises its own address, so set that with coolconfig set server_name your.domain.com. Then run systemctl restart coolwsd and re-run occ richdocuments:activate-config --wopi-url http://127.0.0.1:9980 --callback-url http://127.0.0.1.
• Admin CLI: run any management command with sudo -u www-data php /var/www/nextcloud/occ <command>, for example occ user:list or occ app:list.
• Background jobs: a systemd timer runs cron.php every 5 minutes (Nextcloud's recommended mode). No action is needed.
• Backups: back up /var/lib/nextcloud/data, the PostgreSQL database, /var/www/nextcloud/config/config.php and /etc/coolwsd/coolwsd.xml.
• Updates: unattended-upgrades applies OS security updates automatically. Upgrade Nextcloud with its built-in updater or occ upgrade. Upgrade Collabora with apt-get install coolwsd code-brand from the pinned Collabora repository already configured in /etc/apt/sources.list.d/collabora-code.sources.
• Supported Collabora Online: enter your subscription server's URL under Administration settings > Nextcloud Office > Use your own server and save. You can then stop the local CODE server with systemctl disable --now coolwsd.

Support

This image is maintained by SecureAnyCloud with 24/7 support. Contact sales@secureanycloud.com for assistance.

Deploy on Azure

Launch Nextcloud with Collabora Online Office on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com