Install Config Wiki

All about installing, configuring and troubleshooting

User Tools

Site Tools

Trace: • onlyoffice_document_server_configure_reverse_proxy_virtual_hosts_ubuntu_apache_allowed_nginx
onlyoffice_document_server_configure_reverse_proxy_virtual_hosts_ubuntu_apache_allowed_nginx

For OnlyOffice Document Server Configure Reverse Proxy Virtual Hosts from Ubuntu with Apache to Allowed Hosts on Ubuntu with Nginx

Find a suitable fqdn domain to host your onlyoffice document server. Then create an apache2 virtual host file on the separate ubuntu 24.04 server that is located on my Lan at IP 192.168.1.xxx and listening on apache2 tcp ports 80 and 443. Inside that apache2 virtual host file, we will configure forward proxy to onlyoffice document server on the separate new ubuntu server that is located on my Lan at IP 192.168.1.yyy, and this is the server that has onlyoffice documentserver newly installed and hosted through nginx and also listening on ports 80 on localhost and I want to find it through LAN address 192.168.1.yyy. It should also be made accessible through the Apache proxy at the new fqdn domain name. We need to create and configure the apache virtual host file, and modify the hosts file on the nginx ubuntu machine at IP 192.168.1.yyy to allow access from the apache2 proxy?

To achieve this setup, you need to configure Apache on your reverse proxy server (192.168.1.xxx) to forward traffic to your ONLYOFFICE Document Server (192.168.1.yyy), and ensure ONLYOFFICE accepts the proxy headers. Here is the complete configuration guide.

1. Enable Required Apache Modules

On your Apache server (192.168.1.xxx), run the following command to enable the necessary proxy and SSL modules:

bash 

sudo a2enmod proxy proxy_http proxy_wstunnel rewrite ssl headers

Use code with caution.

Restart Apache to apply the modules:

bash 

sudo systemctl restart apache2

Use code with caution.

2. Create the Apache Virtual Host File. Create a new configuration file on your Apache server (192.168.1.xxx). 

Replace ://yourdomain.com with your actual FQDN.

bash 

sudo nano /etc/apache2/sites-available/onlyoffice.conf

Use code with caution.

Paste the following configuration into the file:

apache 

<VirtualHost *:80>
    ServerName ://yourdomain.com
    # Redirect all HTTP traffic to HTTPS
    RewriteEngine on
    RewriteCond %{SERVER_NAME} =://yourdomain.com
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
<VirtualHost *:443>
    ServerName ://yourdomain.com
    SSLEngine on
    # Update these paths to your actual SSL certificate and key
    SSLCertificateFile /etc/ssl/certs/your_cert.crt
    SSLCertificateKeyFile /etc/ssl/private/your_key.key
    # Proxy settings
    ProxyRequests Off
    ProxyPreserveHost On
    # ONLYOFFICE requires WebSocket support for document editing
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule ^/(.*)           ws://192.168.1.yyy/$1 [P,L]
    # Forward all other standard HTTP traffic
    ProxyPass / http://192.168.1
    ProxyPassReverse / http://192.168.1
    # Security and Proxy Headers required by ONLYOFFICE
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Host %{HTTP_HOST}e
    ErrorLog ${APACHE_LOG_DIR}/onlyoffice_error.log
    CustomLog ${APACHE_LOG_DIR}/onlyoffice_access.log combined
</VirtualHost>

Use code with caution.

Enable the new site and reload Apache:

bash 

sudo a2ensite onlyoffice.conf
sudo systemctl reload apache2

Use code with caution.

3. Update Nginx Settings on the ONLYOFFICE Server

Because ONLYOFFICE uses an internal Nginx configuration that checks incoming host headers, you need to ensure it recognizes your new FQDN.

Log into your ONLYOFFICE server (192.168.1.yyy).

Open the /etc/hosts file:

bash 

sudo nano /etc/hosts

Use code with caution.

Add a mapping so the local Nginx instance maps the FQDN to its own local interface.

Add this line to the bottom:

text 

127.0.0.1 ://yourdomain.com

Use code with caution.

4. Adjust ONLYOFFICE Nginx Header Configuration

ONLYOFFICE's default Nginx configuration sometimes blocks or misroutes traffic if it doesn't explicitly trust the upstream proxy headers.

Open the main ONLYOFFICE Nginx configuration file on 192.168.1.yyy:

bash 

sudo nano /etc/onlyoffice/documentserver/nginx/ds.conf

Use code with caution.

Note: Depending on your installation type, this file might also be linked at /etc/nginx/includes/ds-common.conf.

Look for the proxy_set_header lines. Ensure that they match or allow the incoming headers passed by Apache:

nginx 

proxy_set_header X-Forwarded-Host $http_x_forwarded_host;
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;

Use code with caution.

If you make changes to the Nginx files, restart Nginx on the ONLYOFFICE server:

bash 

sudo systemctl restart nginx

Use code with caution.

Question: Should the apache2 virtual host file be one file for both Port 80 and Port 443, or should we have separate virtual host files such onlyoffice.conf for port 80 and onlyoffice-le-ssl.conf for port 443?

Info: Our ssl certificate method is apache certbot for letsencrypt

Using Certbot with Apache is highly optimized for separate virtual host files.When you run Certbot, it automatically looks for your port 80 file (onlyoffice.conf), reads its settings, creates a brand new onlyoffice-le-ssl.conf file for port 443, and automatically handles the SSL paths and redirection rules for you.

Here is exactly how to set this up step-by-step.

Step 1: Create the Port 80 Virtual Host File

On your Apache proxy server (192.168.1.xxx), create a clean base configuration file that only listens on port 80.

bash 

sudo nano /etc/apache2/sites-available/onlyoffice.conf

Use code with caution.

Paste the following minimal configuration. Replace :yourdomain.com with your real FQDN: apache <code> <VirtualHost *:80> ServerName :yourdomain.com 

  ProxyRequests Off
  ProxyPreserveHost On
  # Forward traffic to ONLYOFFICE
  ProxyPass / http://192.168.1
  ProxyPassReverse / http://192.168.1
  ErrorLog ${APACHE_LOG_DIR}/onlyoffice_error.log
  CustomLog ${APACHE_LOG_DIR}/onlyoffice_access.log combined

</VirtualHost> </code>

Use code with caution.

Enable the port 80 site and reload Apache:

bash 

sudo a2ensite onlyoffice.conf
sudo systemctl reload apache2

Use code with caution.

Step 2: Run Certbot to Auto-Generate the Port 443 File

Ensure your domain's public DNS is pointing to your router/firewall and port 80/443 are forwarded to your Apache server (192.168.1.xxx) so Let's Encrypt can verify ownership.

Run the following Certbot command:

bash 

sudo certbot --apache -d ://yourdomain.com

Use code with caution.

During the interactive prompt: Enter your email address. Accept the terms of service. Certbot will ask if you want to redirect HTTP traffic to HTTPS. Choose Redirect (usually option 2). Certbot will now automatically create /etc/apache2/sites-available/onlyoffice-le-ssl.conf and inject the HTTPS redirection rules into your original onlyoffice.conf.

Step 3: Add WebSocket support to the new SSL file

ONLYOFFICE requires WebSockets to track typing and document changes. Certbot clones your port 80 proxy settings but does not know you need WebSockets. You must add them manually to the newly created SSL file. Open the Certbot-generated SSL file:

bash 

sudo nano /etc/apache2/sites-available/onlyoffice-le-ssl.conf

Use code with caution.

Inside the <VirtualHost *:443> block, look for the ProxyPass lines and update them so the complete file structure looks exactly like this:

apache 

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName ://yourdomain.com
    ProxyRequests Off
    ProxyPreserveHost On
    # --- ADD WEBSOCKET REWRITE RULES HERE ---
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule ^/(.*)           ws://192.168.1.yyy/$1 [P,L]
    # ----------------------------------------
    # Standard proxy paths
    ProxyPass / http://192.168.1
    ProxyPassReverse / http://192.168.1
    # Security Headers required by ONLYOFFICE
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Host %{HTTP_HOST}e
    ErrorLog ${APACHE_LOG_DIR}/onlyoffice_error.log
    CustomLog ${APACHE_LOG_DIR}/onlyoffice_access.log combined
    # Certbot automatically manages these paths below
    SSLCertificateFile /etc/letsencrypt/live/://yourdomain.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/://yourdomain.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

Use code with caution.

Save and exit the file (Ctrl+O, Enter, Ctrl+X), then restart Apache to apply the final changes:

bash 

sudo systemctl restart apache2

Use code with caution.

Because you installed ONLYOFFICE natively (via the .deb package repository) on Ubuntu, the Document Server runs directly on the host's system systemd services and integrates closely with Nginx.

Since Apache is handling the SSL decryption upstream at 192.168.1.xxx and forwarding plain HTTP traffic to Nginx at 192.168.1.yyy, you must configure ONLYOFFICE's native Nginx files to recognize that the traffic is securely offloaded.

Follow these exact steps on your ONLYOFFICE Native Server (192.168.1.yyy):

Step 1: Tell ONLYOFFICE to trust the Upstream SSL Proxy

Natively installed ONLYOFFICE uses a local script tool to generate its main Nginx application profiles. You need to adjust its environment settings so it knows it is sitting behind an HTTPS proxy.

Open the primary Document Server local configuration file:

bash 

sudo nano /etc/onlyoffice/documentserver/local.json

Use code with caution.

Look for the “services” block and ensure that the token and header security values match. Specifically, check if there is a section referencing forward proxies. If you do not see proxy configurations here, you will configure it directly in the Nginx include files instead.

Step 2: Update the Native Nginx Proxy Configurations

By default, the ONLYOFFICE native installation creates Nginx configuration fragments under /etc/onlyoffice/documentserver/nginx/.

Open the internal common Nginx settings file:

bash 

sudo nano /etc/onlyoffice/documentserver/nginx/ds-common.conf

Use code with caution.

Look for the lines handling the X-Forwarded- headers. Because Apache is sending X-Forwarded-Proto “https”, Nginx needs to pass this internal protocol mapping down to the Node.js services running locally on the machine. Make sure these two lines are present and look exactly like this:

nginx 

proxy_set_header X-Forwarded-Host $http_x_forwarded_host;
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;

Use code with caution.

Note: If these lines use default hardcoded variables like $scheme, change them to the dynamic $http_… variables shown above so Nginx respects what Apache tells it.

Step 3: Map the FQDN in the local hosts file

As planned, you must ensure the local machine can resolve its own external FQDN name through loopback.

Open the hosts file:

bash 

sudo nano /etc/hosts

Use code with caution.

Add your FQDN to the 127.0.0.1 line. It should look like this:

text 

127.0.0.1   localhost ://yourdomain.com

Use code with caution.

Step 4: Restart the Services

Apply the changes by restarting the native ONLYOFFICE supervisor processes and Nginx:

bash 

sudo systemctl restart ds-docservice
sudo systemctl restart ds-converter
sudo systemctl restart nginx

Use code with caution.

onlyoffice_document_server_configure_reverse_proxy_virtual_hosts_ubuntu_apache_allowed_nginx.txt · Last modified: 2026/08/10 15:16 by wikiadmin