Nextcloud with ONLYOFFICE Docs on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of Nextcloud with ONLYOFFICE Docs on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Nextcloud is the open-source content-collaboration platform: file sync and share, calendars, contacts and a large app ecosystem, self-hosted inside your own Azure subscription. On its own Nextcloud stores and shares documents; to edit them in the browser it needs a separate document server. This image ships that assembly finished: Nextcloud Server 34.0.3 (AGPL-3.0) with the official ONLYOFFICE connector (onlyoffice 10.1.2, AGPL-3.0) enabled, and ONLYOFFICE Docs Community 9.4.0 (AGPL-3.0) on the same VM, so DOCX, XLSX and PPTX files open for real-time collaborative editing straight after first boot. Backed by 24/7 cloudimg support.

ONLYOFFICE Docs Community is the free, self-hosted edition of the ONLYOFFICE editors. Earlier releases limited it to 20 simultaneously opened documents; version 9.4.0 - the version in this image - removed that limitation, along with its dependencies on RabbitMQ and on a separate database, which is why this appliance runs neither. What the Community edition lacks relative to ONLYOFFICE's paid Docs Enterprise is the vendor's own support contract and a handful of enterprise integrations, not capacity.

What is included:

• Nextcloud Server 34.0.3 (web root /var/www/nextcloud), served by nginx on :443 with a per-VM self-signed certificate; :80 serves the health probe and ACME challenges and redirects everything else to HTTPS
• The official ONLYOFFICE connector for Nextcloud (onlyoffice 10.1.2), pre-installed from the project's own signed release and pointed at the local document server
• ONLYOFFICE Docs Community 9.4.0 installed from ONLYOFFICE's signed apt repository, bound to 127.0.0.1:8083 and reverse-proxied by nginx at /onlyoffice/ on the same origin as Nextcloud
• PHP 8.3-FPM with every extension Nextcloud requires, a local PostgreSQL 16 database and a password-protected Redis 7 for file locking and caching
• A dedicated 60 GiB Azure data disk at /var/lib/nextcloud holding both the Nextcloud data/ directory and the PostgreSQL datadir
• Per-VM secrets generated on first boot and recorded in a root-only file: the Nextcloud admin password, the database and Redis passwords, the ONLYOFFICE JWT secret and the TLS certificate
• nginx.service, php8.3-fpm.service, postgresql.service, redis-server.service, ds-docservice.service and ds-converter.service as enabled systemd units, plus a 5-minute background-jobs timer
• A ufw host firewall in default-deny-inbound mode, allowing only 22, 80 and 443
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) is the recommended starting size: the document server runs alongside Nextcloud, PostgreSQL and Redis, and the image never uses swap. A fully validated VM idles at roughly 1.1 GiB of the 8 GiB; pick Standard_B4ms (4 vCPU / 16 GiB) if many people will edit at once. NSG inbound: allow 22/tcp from your management network, and 80/tcp + 443/tcp for the web interface.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Nextcloud ONLYOFFICE by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size (Standard_B2ms or larger); under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22), HTTP (80) and HTTPS (443). Review the dedicated 60 GiB data disk on the Disks tab, then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name nextcloud-onlyoffice \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name nextcloud-onlyoffice --port 80,443 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

The message of the day tells you where the credentials file and this guide live.

Step 4 - Confirm the services are running

The web tier, PHP runtime, database, cache and both ONLYOFFICE Docs services run as systemd units:

systemctl is-active nginx.service php8.3-fpm.service postgresql.service redis-server.service ds-docservice.service ds-converter.service

Each of the six lines reports active. On first boot the VM ran nextcloud-onlyoffice-firstboot.service, which minted the TLS certificate, rotated every password and secret, and opened the document server's start gate before nginx was allowed to serve.

Step 5 - Confirm the health endpoint

nginx serves an unauthenticated health probe on both HTTP and HTTPS, separate from the Nextcloud web root (which redirects to the sign-in page):

curl -s http://localhost/health

It returns ok.

Step 6 - Confirm Nextcloud is installed and healthy

Nextcloud's status.php endpoint reports the install state and version without requiring a login (-k accepts the per-VM self-signed certificate):

curl -sk https://localhost/status.php

The JSON response contains "installed":true and "versionstring":"34.0.3".

Step 7 - Retrieve your credentials

Every secret is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/nextcloud-onlyoffice-credentials.txt

It holds NEXTCLOUD_URL, NEXTCLOUD_ADMIN_USER (admin) and NEXTCLOUD_ADMIN_PASSWORD; the PostgreSQL and Redis passwords; ONLYOFFICE_DOCS_URL and ONLYOFFICE_JWT_SECRET (the shared secret that signs every request between Nextcloud and the document server); and TLS_CERT_SHA256_FINGERPRINT so you can verify the certificate your browser is about to warn you about. Store the passwords somewhere safe.

Step 8 - Sign in to the web interface

Browse to https://<vm-public-ip>/. The certificate is self-signed and issued to the VM's public IP, so your browser warns once; compare its SHA-256 fingerprint with TLS_CERT_SHA256_FINGERPRINT from Step 7 and accept it (Step 14 covers replacing it with a certificate for your own domain). Sign in as admin with the password from Step 7.

On first boot the image adds the VM's public and private IPv4 addresses to Nextcloud's trusted domains and sets the canonical URL to https://<vm-public-ip>/, so you can reach it immediately. If you later front the instance with your own DNS name and see an "access through untrusted domain" page, allow it once with:

sudo -u www-data php /var/www/nextcloud/occ config:system:set trusted_domains 4 --value your.domain.com

(This host-header allowlist is a deliberate security control - the image never uses a wildcard.)

After signing in you land in the Files app, where you upload, organise and share files and folders.

Step 9 - Edit a document in the browser

Click any .docx, .xlsx or .pptx file in the Files app and it opens in the ONLYOFFICE editor, served from the same https://<vm-public-ip> origin as Nextcloud. To start from scratch, choose + New and pick New document, New spreadsheet or New presentation.

Type into the page. The status bar reports All changes saved as you work: ONLYOFFICE streams your edits to the document server, and the document server writes the file back into your Nextcloud files through its save callback. Closing the editor flushes the final save.

Real-time co-editing works the same way: share the file with another Nextcloud account and both of you see each other's cursors and changes as they happen.

Step 10 - How Nextcloud and ONLYOFFICE Docs are wired

Three connections make the editor work, and all three stay on this VM. Read the configuration back:

OCC='sudo -u www-data php /var/www/nextcloud/occ'
$OCC config:app:get onlyoffice DocumentServerUrl
$OCC config:app:get onlyoffice DocumentServerInternalUrl
$OCC config:app:get onlyoffice StorageUrl

• DocumentServerUrl is /onlyoffice/ - a relative path, not an address. Your browser loads the editor from whatever origin it reached Nextcloud on, so moving the VM behind a DNS name or a load balancer needs no change here. nginx proxies that path to the document server on 127.0.0.1:8083.
• DocumentServerInternalUrl is http://127.0.0.1:8083/ - Nextcloud talks to the document server over loopback.
• StorageUrl is http://127.0.0.1/ - the document server fetches and saves documents through a loopback-only nginx server, never over the public address. Azure does not route a VM back to its own public IP, so this leg has to be loopback.

Ask the connector to check the link end to end. It runs the document server's health check, reads its version, and converts a test document through the save-callback leg:

sudo -u www-data php /var/www/nextcloud/occ onlyoffice:documentserver --check

It prints Document server /onlyoffice/ version 9.4.0.129 is successfully connected.

The same picture appears in Administration settings -> ONLYOFFICE, where the ONLYOFFICE Docs address, the secret key and both internal addresses are shown. Pressing Save re-runs the same check.

Step 11 - The document API is JWT-secured

Every request between Nextcloud and the document server is signed with ONLYOFFICE_JWT_SECRET from Step 7, which is unique to your VM. An unsigned request to the document server's command service is refused:

curl -s -H 'Content-Type: application/json' -d '{"c":"version"}' http://127.0.0.1:8083/coauthoring/CommandService.ashx

It returns {"error":6} - ONLYOFFICE's token error. A request signed with your VM's secret returns {"error":0} and the version. The same secret is what stops anyone who can reach the editor from asking the document server to open arbitrary files.

Step 12 - Verify authentication over the API

Nextcloud's OCS user endpoint rejects unauthenticated requests and accepts your per-VM admin password. An unauthenticated request returns HTTP 401:

curl -sk -o /dev/null -w '%{http_code}\n' -H 'OCS-APIRequest: true' https://localhost/ocs/v2.php/cloud/user

To prove end-to-end authentication, read your admin password from /root/nextcloud-onlyoffice-credentials.txt (Step 7) and run curl -k -u admin:<password> -H 'OCS-APIRequest: true' https://<vm-public-ip>/ocs/v2.php/cloud/user from a shell - it returns HTTP 200 with your user record as XML. A wrong password returns 401.

Step 13 - Confirm where your data and database live

Both the Nextcloud data directory and the PostgreSQL datadir sit on the dedicated Azure data disk, so you can grow or snapshot them independently of the OS disk:

df -h /var/lib/nextcloud | tail -1

The mount /var/lib/nextcloud holds data/ (user files) and pgsql/main (the PostgreSQL cluster).

Step 14 - The security model

Only three TCP ports are reachable from outside the VM. The document server, the database and the cache never leave loopback:

sudo ufw status verbose | head -3

ufw reports Status: active and Default: deny (incoming), allow (outgoing), with 22/tcp, 80/tcp and 443/tcp as the only allowed services. The host firewall is load-bearing here: ONLYOFFICE's docservice process binds :8000 on every interface and upstream provides no setting to change that, so ufw is what keeps it off-box. Everything else is pinned to loopback directly:

sudo ss -lntH | grep -E ':(8083|5432|6379) ' | awk '{print $4}'

It prints 127.0.0.1:8083 (ONLYOFFICE Docs), 127.0.0.1:5432 (PostgreSQL) and 127.0.0.1:6379 (Redis, with a per-VM requirepass).

Nothing in the image carries a known credential: the build-time throwaway passwords are rotated by nextcloud-onlyoffice-firstboot.service before nginx is allowed to start, the TLS key and the document server's signing secrets are generated on your VM, and the Nextcloud instance secret is re-minted so no two VMs from this image share it. There is no swap on the OS disk.

Step 15 - Maintenance

• Your own domain and certificate: point a DNS name at the VM, add it to trusted_domains (Step 8), then replace /etc/nginx/ssl/nextcloud.crt and /etc/nginx/ssl/nextcloud.key with your certificate (for example from certbot - :80 already serves /.well-known/acme-challenge/ from /var/www/acme) and reload nginx. Update the canonical URL with occ config:system:set overwrite.cli.url --value https://your.domain.com/. Nothing about the editor needs changing: DocumentServerUrl is a relative path, so it follows your new address automatically.
• Admin CLI: run any management command with sudo -u www-data php /var/www/nextcloud/occ <command> (for example occ user:list or occ app:list).
• Background jobs: a systemd timer runs cron.php every 5 minutes (Nextcloud's recommended mode) - no action needed.
• Backups: back up /var/lib/nextcloud/data, the PostgreSQL database, /var/www/nextcloud/config/config.php and /etc/onlyoffice/documentserver/local.json.
• Updates: OS security updates are applied automatically by unattended-upgrades. Upgrade Nextcloud with its built-in updater or occ upgrade; upgrade the document server with apt-get install onlyoffice-documentserver from the ONLYOFFICE repository already configured in /etc/apt/sources.list.d/onlyoffice.list.
• Using a different ONLYOFFICE Docs server: enter its address and secret under Administration settings -> ONLYOFFICE and save. The local document server can then be stopped with systemctl disable --now ds-docservice ds-converter.

Support

This image is maintained by cloudimg with 24/7 support. Contact support@cloudimg.co.uk for assistance.