Nextcloud with Collabora Online Office on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of Nextcloud with Collabora Online Office on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Nextcloud is the open-source content-collaboration platform: file sync and share, calendars, contacts and a large app ecosystem, self-hosted inside your own Azure subscription. On its own Nextcloud stores and shares documents; to edit them in the browser it needs a separate office server that speaks the WOPI protocol. This image ships that assembly finished: Nextcloud Server 34.0.3 (AGPL-3.0) with the Nextcloud Office app (richdocuments 11.1.0, AGPL-3.0) enabled, and a native Collabora Online Development Edition (CODE) server (coolwsd 26.04.3.2, MPL-2.0) on the same VM, so Writer, Calc and Impress documents open for real-time collaborative editing straight after first boot. Backed by 24/7 cloudimg support.

CODE is Collabora's free development edition. As shipped here it places no limit on concurrent users or documents; what it lacks is Collabora's commercial support contract, and its welcome slideshow and feedback prompts cannot be switched off. Collabora describes CODE as suited to "testing, home use or small teams" and recommends its supported Collabora Online subscription for production estates. If you buy one, point the Nextcloud Office settings at that server (Step 10) - nothing else in the image changes.

What is included:

• Nextcloud Server 34.0.3 (web root /var/www/nextcloud), served by nginx on :443 with a per-VM self-signed certificate; :80 serves the health probe and ACME challenges and redirects everything else to HTTPS
• Nextcloud Office (richdocuments 11.1.0) pre-installed from the Nextcloud app store and pointed at the local Collabora server
• Collabora Online Development Edition 26.04.3.2 (coolwsd + code-brand) installed natively from Collabora's signed apt repository, bound to 127.0.0.1:9980 and reverse-proxied by nginx under the same origin as Nextcloud
• PHP 8.3-FPM with every extension Nextcloud requires, a local PostgreSQL 16 database and a password-protected Redis 7 for file locking and caching
• A dedicated 60 GiB Azure data disk at /var/lib/nextcloud holding both the Nextcloud data/ directory and the PostgreSQL datadir
• Per-VM secrets generated on first boot and recorded in a root-only file: the Nextcloud admin password, the database and Redis passwords, the Collabora admin-console password, the WOPI proof key pair and the TLS certificate
• nginx.service, php8.3-fpm.service, postgresql.service, redis-server.service and coolwsd.service as enabled systemd units, plus a 5-minute background-jobs timer
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) is the recommended starting size: the office engine pre-spawns LibreOffice kit processes alongside Nextcloud, PostgreSQL and Redis, and the image never uses swap. Collabora's own guidance prefers four or more vCPUs for busier teams, so pick Standard_B4ms (4 vCPU / 16 GiB) if many people will edit at once. NSG inbound: allow 22/tcp from your management network, and 80/tcp + 443/tcp for the web interface.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Nextcloud Collabora by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size (Standard_B2ms or larger); under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22), HTTP (80) and HTTPS (443). Review the dedicated 60 GiB data disk on the Disks tab, then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name nextcloud-collabora \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name nextcloud-collabora --port 80,443 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

The message of the day tells you where the credentials file and this guide live.

Step 4 - Confirm the services are running

The web tier, PHP runtime, database, cache and the Collabora office engine all run as systemd units:

systemctl is-active nginx.service php8.3-fpm.service postgresql.service redis-server.service coolwsd.service

Each of the five lines reports active. On first boot the VM ran nextcloud-collabora-firstboot.service, which minted the TLS certificate, rotated every password and wired Nextcloud Office to the local Collabora server before nginx opened.

Step 5 - Confirm the health endpoint

nginx serves an unauthenticated health probe on both HTTP and HTTPS, separate from the Nextcloud web root (which redirects to the sign-in page):

curl -s http://localhost/health

It returns ok.

Step 6 - Confirm Nextcloud is installed and healthy

Nextcloud's status.php endpoint reports the install state and version without requiring a login (-k accepts the per-VM self-signed certificate):

curl -sk https://localhost/status.php

The JSON response contains "installed":true and "versionstring":"34.0.3".

Step 7 - Retrieve your credentials

Every secret is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/nextcloud-collabora-credentials.txt

It holds NEXTCLOUD_URL, NEXTCLOUD_ADMIN_USER (admin) and NEXTCLOUD_ADMIN_PASSWORD; the PostgreSQL and Redis passwords; COLLABORA_ADMIN_CONSOLE_URL, COLLABORA_ADMIN_USER and COLLABORA_ADMIN_PASSWORD for the Collabora admin console; and TLS_CERT_SHA256_FINGERPRINT so you can verify the certificate your browser is about to warn you about. Store the passwords somewhere safe.

Step 8 - Sign in to the web interface

Browse to https://<vm-public-ip>/. The certificate is self-signed and issued to the VM's public IP, so your browser warns once; compare its SHA-256 fingerprint with TLS_CERT_SHA256_FINGERPRINT from Step 7 and accept it (Step 12 covers replacing it with a certificate for your own domain). Sign in as admin with the password from Step 7.

On first boot the image adds the VM's public and private IPv4 addresses to Nextcloud's trusted domains and sets the canonical URL to https://<vm-public-ip>/, so you can reach it immediately. If you later front the instance with your own DNS name and see an "access through untrusted domain" page, whitelist it once with:

sudo -u www-data php /var/www/nextcloud/occ config:system:set trusted_domains 4 --value your.domain.com

(This host-header allowlist is a deliberate security control - the image never uses a wildcard.)

After signing in you land in the Files app, where you upload, organise and share files and folders.

Step 9 - Create and edit a document in the browser

In the Files app choose + New -> Document, keep the suggested name or type your own, and select Create. Nextcloud Office offers its template picker (Blank is preselected); choose Create again.

The document opens in the Collabora Online editor, served from the same https://<vm-public-ip> origin as Nextcloud. Type into the page: the word count in the status bar updates as you go, and the document is saved back into your Nextcloud files through the WOPI protocol (use the toolbar save button, or just close the editor - Collabora saves on exit). The first time the editor opens it shows CODE's three-slide welcome; close it with the button on the last slide.

Spreadsheets and presentations work the same way (+ New -> Spreadsheet / Presentation), and existing .docx, .xlsx, .pptx and OpenDocument files you upload open in the editor when clicked.

Step 10 - How Nextcloud and Collabora are wired

Both legs of the WOPI conversation stay on the VM, and the browser reaches the editor through nginx on the same origin as Nextcloud. Read the configuration back:

OCC='sudo -u www-data php /var/www/nextcloud/occ'
$OCC config:app:get richdocuments wopi_url
$OCC config:app:get richdocuments wopi_callback_url
$OCC config:app:get richdocuments public_wopi_url
$OCC config:app:get richdocuments wopi_allowlist

• wopi_url is http://127.0.0.1:9980 - Nextcloud talks to the local coolwsd over loopback.
• wopi_callback_url is http://127.0.0.1 - coolwsd fetches and saves documents through a loopback-only nginx server, never over the public address.
• public_wopi_url is https://<vm-public-ip> - auto-detected from Collabora's discovery document; it is what the browser loads the editor from.
• wopi_allowlist is 127.0.0.1,::1 - only the local office engine may call Nextcloud's WOPI file endpoints. The mirror-image allow-list on the Collabora side (storage.wopi.alias_groups in /etc/coolwsd/coolwsd.xml) admits only this instance.

Confirm the office engine answers through the front door and identifies itself:

curl -sk https://localhost/hosting/capabilities | python3 -m json.tool | grep -E 'productName|productVersion'

It prints "productName": "Collabora Online Development Edition" and "productVersion": "26.04.3.2".

The same picture appears in Administration settings -> Nextcloud Office (Collabora), which reports the server reachable, the URL used by the browser and the Nextcloud URL used by Collabora. To switch to a supported Collabora Online subscription later, enter its URL under Use your own server and save.

Step 11 - The Collabora admin console

coolwsd ships an admin console with live document, memory and CPU statistics at COLLABORA_ADMIN_CONSOLE_URL from Step 7 (https://<vm-public-ip>/browser/dist/admin/admin.html). It is protected by the per-VM COLLABORA_ADMIN_USER / COLLABORA_ADMIN_PASSWORD credential, and so is its Prometheus metrics endpoint. Unauthenticated requests are refused:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:9980/cool/getMetrics

It prints 401. With the credential from Step 7 (curl -u admin:<password> http://127.0.0.1:9980/cool/getMetrics) the same endpoint returns 200 and the metrics. On a 2 vCPU size the console notes that Collabora prefers four or more threads; that is a sizing hint for busy teams, not a fault.

Step 12 - Verify authentication over the API

Nextcloud's OCS user endpoint rejects unauthenticated requests and accepts your per-VM admin password. An unauthenticated request returns HTTP 401:

curl -sk -o /dev/null -w '%{http_code}\n' -H 'OCS-APIRequest: true' https://localhost/ocs/v2.php/cloud/user

To prove end-to-end authentication, read your admin password from /root/nextcloud-collabora-credentials.txt (Step 7) and run curl -k -u admin:<password> -H 'OCS-APIRequest: true' https://<vm-public-ip>/ocs/v2.php/cloud/user from a shell - it returns HTTP 200 with your user record as XML. A wrong password returns 401.

Step 13 - Confirm where your data and database live

Both the Nextcloud data directory and the PostgreSQL datadir sit on the dedicated Azure data disk, so you can grow or snapshot them independently of the OS disk:

df -h /var/lib/nextcloud | tail -1

The mount /var/lib/nextcloud holds data/ (user files) and pgsql/main (the PostgreSQL cluster).

Step 14 - The security model

Only three TCP ports are bound off the loopback interface; the office engine, the database and the cache are reachable from the VM itself alone:

sudo ss -lntH | awk '{print $4}' | grep -vE '^(127\.|\[::1\])' | sed -E 's/.*://' | sort -un

It prints exactly 22, 80 and 443. coolwsd listens on 127.0.0.1:9980, PostgreSQL on 127.0.0.1:5432 and Redis on 127.0.0.1:6379 (with a per-VM requirepass). Nothing in the image carries a known credential: the build-time throwaway passwords are rotated by nextcloud-collabora-firstboot.service before nginx is allowed to start, the TLS key and the WOPI proof key are generated on your VM, and the Nextcloud instance secret is re-minted so no two VMs from this image share it. There is no swap on the OS disk.

Step 15 - Maintenance

• Your own domain and certificate: point a DNS name at the VM, add it to trusted_domains (Step 8), then replace /etc/nginx/ssl/nextcloud.crt and /etc/nginx/ssl/nextcloud.key with your certificate (for example from certbot - :80 already serves /.well-known/acme-challenge/ from /var/www/acme) and reload nginx. Update the canonical URL with occ config:system:set overwrite.cli.url --value https://your.domain.com/ and, because Collabora advertises its own address, set it with coolconfig set server_name your.domain.com, then systemctl restart coolwsd and re-run occ richdocuments:activate-config --wopi-url http://127.0.0.1:9980 --callback-url http://127.0.0.1.
• Admin CLI: run any management command with sudo -u www-data php /var/www/nextcloud/occ <command> (for example occ user:list or occ app:list).
• Background jobs: a systemd timer runs cron.php every 5 minutes (Nextcloud's recommended mode) - no action needed.
• Backups: back up /var/lib/nextcloud/data, the PostgreSQL database, /var/www/nextcloud/config/config.php and /etc/coolwsd/coolwsd.xml.
• Updates: OS security updates are applied automatically by unattended-upgrades. Upgrade Nextcloud with its built-in updater or occ upgrade; upgrade Collabora with apt-get install coolwsd code-brand from the pinned Collabora repository already configured in /etc/apt/sources.list.d/collabora-code.sources.
• Supported Collabora Online: enter your subscription server's URL under Administration settings -> Nextcloud Office -> Use your own server and save; the local CODE server can then be stopped with systemctl disable --now coolwsd.

Support

This image is maintained by cloudimg with 24/7 support. Contact support@cloudimg.co.uk for assistance.