ONLYOFFICE Docs

Prerequisites

• An active Azure subscription, an SSH public key, and a VNet and subnet in the target region
• A subscription to the ONLYOFFICE Docs listing on Azure Marketplace

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) is a sensible starting point for evaluation and light use. For teams doing real-time co-editing or heavy conversion, use Standard_D2s_v5 or larger.

NSG inbound rules: allow 22/tcp from your management network, and allow 80/tcp for the document server from the host applications and browsers that use it.

Deploy from the Azure Marketplace

• Open the ONLYOFFICE Docs on Ubuntu 24.04 by SecureAnyCloud listing and select Get It Now, then Create.
• Choose your subscription, resource group and region, and a VM size (see above).
• Provide an SSH public key for the azureuser administrative account.
• On the Networking tab, attach the VM to your VNet and subnet and set the NSG inbound rules described above.
• Review and create the VM. When the deployment completes, note the VM's public IP address.

Deploy from the Azure CLI

Create the VM, then open the ports the document server needs: SSH for administration and HTTP for the service.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:onlyoffice-docs-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-rg \
  --name onlyoffice-docs \
  --image sac1647283583153:onlyoffice-docs-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-rg --name onlyoffice-docs --port 22 --priority 1001
az vm open-port --resource-group my-rg --name onlyoffice-docs --port 80 --priority 1002

First boot: the per instance JWT secret

On the first boot of each VM, a first boot service generates a unique JWT token secret. The service writes the secret into the document server configuration and into the built-in example, creates a bootstrap-ready marker that releases the document services, and then records the secret in a root-only credentials file. Nothing is baked into the image, and no two VMs share a secret.

Connect over SSH as azureuser and confirm that the whole stack is active and the service is healthy:

systemctl is-active onlyoffice-firstboot ds-docservice ds-converter nginx postgresql redis-server rabbitmq-server curl -s http://127.0.0.1/healthcheck

The health check prints true once the document server is ready.

Read the per-instance credentials file to see your VM's JWT secret and the service URLs. The file is 0600 root:root, so use sudo:

sudo cat /root/onlyoffice-credentials.txt

The welcome page

Browse to http://<vm-ip>/ to be redirected to the welcome page. The page confirms that the document server is installed and running, and it links to the integration options.

Try the editors: the built-in test page

The image enables the bundled test page at http://<vm-ip>/example/. Use it to create a new document, spreadsheet or presentation, or to upload a file. This confirms that the editors open and render before you integrate the API into your own app.

Select Document to open the word processor with a sample file. The editor loads with its full ribbon, and the document renders in the page.

Select Spreadsheet to open the spreadsheet editor. A sample workbook renders with its data, charts and filtered tables intact.

The JWT security model

The editing API is secured with a JSON Web Token. Token validation is enabled for browser requests and for inbound and outbound requests, so a host application must sign its requests to the document server with your VM's JWT secret. You can inspect the token configuration and prove the model from the command line.

A request signed with the per-instance secret is accepted and returns the server version, while an unsigned request is rejected with token error 6:

SECRET=$(sudo grep '^JWT_SECRET=' /root/onlyoffice-credentials.txt | cut -d= -f2-)
TOKEN=$(python3 -c 'import sys,hmac,hashlib,base64,json;s=sys.argv[1];b=lambda x:base64.urlsafe_b64encode(x).rstrip(b"=");h=b(json.dumps({"alg":"HS256","typ":"JWT"},separators=(",",":")).encode());p=b(json.dumps({"c":"version"},separators=(",",":")).encode());import hmac as H;sig=b(H.new(s.encode(),h+b"."+p,hashlib.sha256).digest());sys.stdout.write((h+b"."+p+b"."+sig).decode())' "$SECRET")
curl -s -H 'Content-Type: application/json' -H "Authorization: Bearer $TOKEN" \
  -X POST http://127.0.0.1/coauthoring/CommandService.ashx \
  -d "{\"c\":\"version\",\"token\":\"$TOKEN\"}" echo
curl -s -H 'Content-Type: application/json' \
  -X POST http://127.0.0.1/coauthoring/CommandService.ashx \
  -d '{"c":"version"}'

The signed call returns {"error":0,"version":"9.4.0.129"} and the unsigned call returns {"error":6}.

A bundled helper runs the full check in one step. The welcome page and health check return 200, a signed request is accepted, and both an unsigned request and a wrong-secret request are rejected.

sudo /usr/local/sbin/onlyoffice-roundtrip.sh

Integrate with your application

Point your host application (for example Nextcloud, ownCloud or your own software) at http://<vm-ip>/ as the Document Server address, and configure it with the JWT secret from /root/onlyoffice-credentials.txt. The host application signs the editor configuration and API requests with that secret, and the document server validates every request.

For public deployments, place the document server behind TLS, for example a reverse proxy or an Azure Application Gateway, so the token and document traffic are encrypted in transit.

To rotate the secret later, update services.CoAuthoring.secret.* in /etc/onlyoffice/documentserver/local.json, restart the document services and update the same secret in your host application.

Support

Every SecureAnyCloud image includes 24/7 support with a guaranteed 24-hour response SLA. Contact support through the SecureAnyCloud website for deployment help, integration questions or issues with this image.

Deploy on Azure

Launch ONLYOFFICE Docs on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com