OnlyOffice Integration changes between V12 and V13

Seafile Server
1

Hi again,

sorry for bothering again.
I have been running onlyoffice in a subfolder of my seafile domain /onlyofficeds for several years, it was also working in V12, but now with V13, the nginx file is not mounted anymore to the host by default, so I cannot adjust it anymore. I saw that you changed the integration to using a port instead and opening that port on caddy as well. Does that mean I have to make this port available from the web as well? including port forwarding? This might be difficult, as I can only use port 80 and 443 :frowning:

Or am I mistaken and this port is only used internally?

If not, could I mount the nginx conf file to the host and keep the old version running with onlyoffice in a subfolder? Or will this not work anymore?
Kind regards,

Ruediger

2

The internal bundled Nginx is not recommend to be modified. You can work on the Caddy layer (Or use another reverse proxy).

Here are some recommendations suggested by our AI (manually checked):

In Seafile version 13.0, the Docker deployment model has shifted to using Caddy as the primary entry point and reverse proxy. The reason the Nginx configuration is no longer mounted is that customization is now intended to be handled through Caddy labels or an external reverse proxy.

Regarding your port concerns, you do not necessarily have to open port 6233 to the internet. Since you are limited to ports 80 and 443, you have two primary ways to integrate OnlyOffice using the new V13 architecture:

Option 1: Use a dedicated subdomain (Recommended)

You can assign a separate domain (e.g., office.yourdomain.com) to OnlyOffice. Caddy will automatically handle the SSL certificate and route traffic over port 443.

In your onlyoffice.yml, you can update the labels for the OnlyOffice service:

services:
  onlyoffice:
    ...
    labels:
      caddy: office.yourdomain.com
      caddy.reverse_proxy: "{{upstreams}}"

Then, update your seahub_settings.py to point to this new URL:

ONLYOFFICE_APIJS_URL = 'https://office.yourdomain.com/web-apps/apps/api/documents/api.js'

Option 2: Use a sub-path on your main domain

If you prefer to keep using yourdomain.com/onlyofficeds/, you can configure Caddy to route that specific path to the OnlyOffice container. This allows you to keep only port 443 open.

Update your onlyoffice.yml labels as follows:

services:
  onlyoffice:
    ...
    labels:
      caddy: yourdomain.com
      caddy.handle: /onlyofficeds/*
      caddy.handle.0_uri: strip_prefix /onlyofficeds
      caddy.handle.1_reverse_proxy: "{{upstreams}}"

Note: The strip_prefix is necessary because OnlyOffice expects to serve content from the root internally.

Important Reminders for V13:

  1. JWT Secret: V13 enforces JWT. Ensure the ONLYOFFICE_JWT_SECRET in your .env file matches the one in seahub_settings.py.
  2. Internal Ports: The port 6233 mentioned in the documentation is the default internal port. If you use the Caddy routing above, Caddy handles the communication internally, so you do not need to forward port 6233 on your router.
  3. Config Clean-up: Note that FILE_SERVER_ROOT and SERVICE_URL are no longer used in Seafile V13, so you do not need to worry about those settings for this integration.
3

Thanks for your help!
I managed to get it to work with a separate sub-domain, but with a subfolder of my seafile sub-domain, onyloffice does actually open when clicking an office file inside seafile, but it complains “download failed”. In the FAQ, incorrect onlyoffice jwt is suggested, but it is correct (and the same for using a sub-domain).

What am I missing? I would really prefer the subfolder solution as I had before, running onlyoffice on a subdomain makes it more visible to the outside. And the port solution in the manual does only work inside my LAN, but not over the internet unless I open that port on my router (which I don’t want to do).

Thanks,

Ruediger

4

The “download failed” error in OnlyOffice when using a subfolder is usually caused by the Document Server not correctly understanding its public URL path, which prevents it from communicating back to Seafile.

I suggest you check onlyoffice’s log to see which URL it use to download a file from Seafile.

In the Seafile V13 Caddy-based setup, you need to ensure that Caddy sends a specific header telling OnlyOffice it is being served from /onlyofficeds.

Please try updating your onlyoffice.yml (or your main docker-compose.yml if integrated) with these specific labels for the OnlyOffice service:

services:
  onlyoffice:
    # ... other config ...
    labels:
      caddy: yourdomain.com
      caddy.handle_path: /onlyofficeds/*
      caddy.handle_path.reverse_proxy: "{{upstreams}}"
      caddy.handle_path.reverse_proxy.header_up: X-Forwarded-Host {host}/onlyofficeds

Why this is needed:

  1. handle_path: This automatically strips the /onlyofficeds prefix before sending the request to the OnlyOffice container (which expects to be at the root internally).
  2. X-Forwarded-Host: This is the critical part. By setting it to {host}/onlyofficeds, you tell OnlyOffice that its external base URL includes the subfolder. Without this, OnlyOffice might try to request files from yourdomain.com/ instead of yourdomain.com/onlyofficeds/, leading to the “download failed” error.

Checklist:

  • Trailing Slashes: In your seahub_settings.py, ensure ONLYOFFICE_APIJS_URL points to the full path: https://yourdomain.com/onlyofficeds/web-apps/apps/api/documents/api.js.
  • JWT Secret: Since you mention it works on a subdomain, your JWT secret is likely correct.
  • Internal Resolution: Ensure the OnlyOffice container can resolve yourdomain.com. If they are on the same machine, you might need to add an extra_hosts entry to the onlyoffice service in your docker-compose file pointing your domain to the host’s IP.

For further reference, a similar configuration was discussed in the community here: OnlyOffice not working behind caddy.

2 Likes
6

Thank you so much, the X-Forwarded-Host line fixed this for me!
Dear Aisyun, do I need the additional lines you provided? What would they do?
Thanks!