Nextcloud with ONLYOFFICE Docs

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is the recommended starting size. The document server runs alongside Nextcloud, PostgreSQL and Redis, and the image never uses swap. A fully validated VM idles at roughly 1.1 GiB of the 8 GiB. Pick Standard_B4ms (4 vCPU / 16 GiB) if many people will edit at once.

Configure the NSG to allow inbound 22/tcp from your management network, and 80/tcp and 443/tcp for the web interface.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Nextcloud ONLYOFFICE by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size (Standard_B2ms or larger). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443).

Review the dedicated 60 GiB data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name nextcloud-onlyoffice \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name nextcloud-onlyoffice --port 80,443 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

The message of the day tells you where the credentials file and this guide are.

Step 4 - Confirm the services are running

The web tier, PHP runtime, database, cache and both ONLYOFFICE Docs services run as systemd units:

systemctl is-active nginx.service php8.3-fpm.service postgresql.service redis-server.service ds-docservice.service ds-converter.service

Each of the six lines reports active. On first boot, the VM ran nextcloud-onlyoffice-firstboot.service. That service minted the TLS certificate, rotated every password and secret, and opened the document server's start gate before nginx was allowed to serve.

Step 5 - Confirm the health endpoint

nginx serves an unauthenticated health probe on both HTTP and HTTPS. It is separate from the Nextcloud web root, which redirects to the sign-in page:

curl -s http://localhost/health

The probe returns ok.

Step 6 - Confirm Nextcloud is installed and healthy

Nextcloud's status.php endpoint reports the install state and version without requiring a login. The -k option accepts the per-VM self-signed certificate:

curl -sk https://localhost/status.php

The JSON response contains "installed":true and "versionstring":"34.0.3".

Step 7 - Retrieve your credentials

Every secret is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/nextcloud-onlyoffice-credentials.txt

The file holds:

• NEXTCLOUD_URL, NEXTCLOUD_ADMIN_USER (admin) and NEXTCLOUD_ADMIN_PASSWORD
• The PostgreSQL and Redis passwords
• ONLYOFFICE_DOCS_URL and ONLYOFFICE_JWT_SECRET, the shared secret that signs every request between Nextcloud and the document server
• TLS_CERT_SHA256_FINGERPRINT, so you can verify the certificate your browser is about to warn you about

Store the passwords somewhere safe.

Step 8 - Sign in to the web interface

Browse to https://<vm-public-ip>/. The certificate is self-signed and issued to the VM's public IP, so your browser warns once. Compare its SHA-256 fingerprint with TLS_CERT_SHA256_FINGERPRINT from Step 7, then accept it. Step 15 covers replacing it with a certificate for your own domain.

Sign in as admin with the password from Step 7.

On first boot, the image adds the VM's public and private IPv4 addresses to Nextcloud's trusted domains. It also sets the canonical URL to https://<vm-public-ip>/, so you can reach Nextcloud immediately. If you later front the instance with your own DNS name and see an "access through untrusted domain" page, allow the name once with:

sudo -u www-data php /var/www/nextcloud/occ config:system:set trusted_domains 4 --value your.domain.com

This host-header allowlist is a deliberate security control. The image never uses a wildcard.

After you sign in, you land in the Files app, where you upload, organize and share files and folders.

Step 9 - Edit a document in the browser

Click any .docx, .xlsx or .pptx file in the Files app. It opens in the ONLYOFFICE editor, served from the same https://<vm-public-ip> origin as Nextcloud. To start from scratch, choose + New, then pick New document, New spreadsheet or New presentation.

Type into the page. The status bar reports All changes saved as you work. ONLYOFFICE streams your edits to the document server, and the document server writes the file back into your Nextcloud files through its save callback. Closing the editor flushes the final save.

Real-time co-editing works the same way. Share the file with another Nextcloud account, and both of you see each other's cursors and changes as they happen.

Step 10 - Understand how Nextcloud and ONLYOFFICE Docs are wired

Three connections make the editor work, and all three stay on this VM. Read the configuration back:

OCC='sudo -u www-data php /var/www/nextcloud/occ' $OCC config:app:get onlyoffice DocumentServerUrl $OCC config:app:get onlyoffice DocumentServerInternalUrl $OCC config:app:get onlyoffice StorageUrl

• DocumentServerUrl is /onlyoffice/, a relative path rather than an address. Your browser loads the editor from whatever origin it reached Nextcloud on, so moving the VM behind a DNS name or a load balancer needs no change here. nginx proxies that path to the document server on 127.0.0.1:8083.
• DocumentServerInternalUrl is http://127.0.0.1:8083/. Nextcloud talks to the document server over loopback.
• StorageUrl is http://127.0.0.1/. The document server fetches and saves documents through a loopback-only nginx server, never over the public address. Azure does not route a VM back to its own public IP, so this leg has to be loopback.

Ask the connector to check the link end to end. It runs the document server's health check, reads its version, and converts a test document through the save-callback leg:

sudo -u www-data php /var/www/nextcloud/occ onlyoffice:documentserver --check

The command prints Document server /onlyoffice/ version 9.4.0.129 is successfully connected.

The same settings appear in Administration settings -> ONLYOFFICE, which shows the ONLYOFFICE Docs address, the secret key and both internal addresses. Select Save to re-run the same check.

Step 11 - Verify the JWT-secured document API

Every request between Nextcloud and the document server is signed with ONLYOFFICE_JWT_SECRET from Step 7, which is unique to your VM. An unsigned request to the document server's command service is refused:

curl -s -H 'Content-Type: application/json' -d '{"c":"version"}' http://127.0.0.1:8083/coauthoring/CommandService.ashx

The request returns {"error":6}, which is ONLYOFFICE's token error. A request signed with your VM's secret returns {"error":0} and the version.

The same secret stops anyone who can reach the editor from asking the document server to open arbitrary files.

Step 12 - Verify authentication over the API

Nextcloud's OCS user endpoint rejects unauthenticated requests and accepts your per-VM admin password. An unauthenticated request returns HTTP 401:

curl -sk -o /dev/null -w '%{http_code}\n' -H 'OCS-APIRequest: true' https://localhost/ocs/v2.php/cloud/user

To prove end-to-end authentication, read your admin password from /root/nextcloud-onlyoffice-credentials.txt (Step 7). Then run curl -k -u admin:<password> -H 'OCS-APIRequest: true' https://<vm-public-ip>/ocs/v2.php/cloud/user from a shell. It returns HTTP 200 with your user record as XML. A wrong password returns 401.

Step 13 - Confirm where your data and database live

Both the Nextcloud data directory and the PostgreSQL datadir sit on the dedicated Azure data disk, so you can grow or snapshot them independently of the OS disk:

df -h /var/lib/nextcloud | tail -1

The mount /var/lib/nextcloud holds data/ (user files) and pgsql/main (the PostgreSQL cluster).

Step 14 - Review the security model

Only three TCP ports are reachable from outside the VM. The document server, the database and the cache never leave loopback:

sudo ufw status verbose | head -3

ufw reports Status: active and Default: deny (incoming), allow (outgoing), with 22/tcp, 80/tcp and 443/tcp as the only allowed services.

The host firewall matters here. ONLYOFFICE's docservice process binds :8000 on every interface, and upstream provides no setting to change that. ufw keeps it off-box. Everything else is pinned to loopback directly:

sudo ss -lntH | grep -E ':(8083|5432|6379) ' | awk '{print $4}'

The command prints 127.0.0.1:8083 (ONLYOFFICE Docs), 127.0.0.1:5432 (PostgreSQL) and 127.0.0.1:6379 (Redis, with a per-VM requirepass).

Nothing in the image carries a known credential. nextcloud-onlyoffice-firstboot.service rotates the build-time throwaway passwords before nginx is allowed to start. The TLS key and the document server's signing secrets are generated on your VM. The Nextcloud instance secret is re-minted, so no two VMs from this image share it. There is no swap on the OS disk.

Step 15 - Maintain the VM

• Your own domain and certificate: point a DNS name at the VM and add it to trusted_domains (Step 8). Then replace /etc/nginx/ssl/nextcloud.crt and /etc/nginx/ssl/nextcloud.key with your certificate, and reload nginx. For example, use certbot: :80 already serves /.well-known/acme-challenge/ from /var/www/acme. Update the canonical URL with occ config:system:set overwrite.cli.url --value https://your.domain.com/. The editor needs no changes, because DocumentServerUrl is a relative path and follows your new address automatically.
• Admin CLI: run any management command with sudo -u www-data php /var/www/nextcloud/occ <command>, for example occ user:list or occ app:list.
• Background jobs: a systemd timer runs cron.php every 5 minutes, which is Nextcloud's recommended mode. No action is needed.
• Backups: back up /var/lib/nextcloud/data, the PostgreSQL database, /var/www/nextcloud/config/config.php and /etc/onlyoffice/documentserver/local.json.
• Updates: unattended-upgrades applies OS security updates automatically. Upgrade Nextcloud with its built-in updater or occ upgrade. Upgrade the document server with apt-get install onlyoffice-documentserver, from the ONLYOFFICE repository already configured in /etc/apt/sources.list.d/onlyoffice.list.
• Using a different ONLYOFFICE Docs server: enter its address and secret under Administration settings -> ONLYOFFICE, and save. You can then stop the local document server with systemctl disable --now ds-docservice ds-converter.

Support

This image is maintained by SecureAnyCloud with 24/7 support. Contact sales@secureanycloud.com for assistance.

Deploy on Azure

Launch Nextcloud with ONLYOFFICE Docs on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com