Collaboration Wopi with OnlyOffice not working (NixOS)

[pythonpoet]

OpenCloud is not able to establish connection with OnlyOffice through wopi server

OpenCloud should be able to interface with Only office through a series of microservices.
A description of this can be found here and documentation of environment variables can be found here

Steps to reproduce

1. As outlined in the first link, OC_ADD_RUN_SERVICES must contain "gateway,app-registry,collaboration"
2. JWT secret is set with: OC_JWT_SECRET = "whatever";
3. Configuring end point with:
   COLLABORATION_SERVICE_NAME = "collaboration"; COLLABORATION_APP_NAME = "OnlyOffice"; COLLABORATION_APP_PRODUCT = "OnlyOffice"; COLLABORATION_APP_DESCRIPTION = "Open office documents with OnlyOffice"; COLLABORATION_APP_ICON = "image-edit"; COLLABORATION_APP_ADDR = "http://127.0.0.1:9982"; COLLABORATION_WOPI_SRC = "https://office.youserver.net"; COLLABORATION_WOPI_SECRET = "whatever"; COLLABORATION_APP_INSECURE ="false"; COLLABORATION_APP_PROOF_DISABLE = "true"; COLLABORATION_OO_SECRET = "whatever";

Expected behavior

The service should be able to interface with the Onlyoffice server that runs correctly under
http://127.0.0.1:9982/healthcheck and http://127.0.0.1:9982/hosting/discovery

Actual behavior

Im getting the error {"level":"error","service":"collaboration","error":"rpc error: code = Canceled desc = context canceled","time":"2026-01-19T15:45:25+01:00","message":"AddAppProvider failed"}
Jan 19 15:45:25 bernina opencloud[236697]: {"level":"error","service":"collaboration","error":"rpc error: code = Canceled desc = context canceled","time":"2026-01-19T15:45:25+01:00","message":"AddAppProvider failed"}

I tried the setting using variables that have default values:
MICRO_REGISTRY = "nats-js-kv";
MICRO_REGISTRY_ADDRESS = "127.0.0.1:9233";
OC_REVA_GATEWAY = "127.0.0.1:9142";
COLLABORATION_CS3_GATEWAY = "127.0.0.1:9142";
GATEWAY_GRPC_ADDR = "127.0.0.1:9142";

but only with the same results

Setup

FInd my nix config here

Thank you for your help

Add any other context about the problem here.

[micbar]

Context cancelled means some component in the middle terminates the connection.

Could be that some max request body size or max header length situations are triggered inside your infrastructure.

Without further details, that looks to me like infrastructure interfering between the opencloud and the collaboration service. This specific failing request uses grpc not http.

[sdamm4z]

In my case, it works without any problems...

services:
	opencloud: <- Internal hostname for Docker-Compose-Stack --> COLLABORATION_WOPI_SRC = ...
		...

		## Config for OpenCloud-Weboffice OnlyOffice
		COLLABORA_DOMAIN = "MyOnlyOfficeDom.eu"; <- External Link to OnlyOffice - for iframe
		FRONTEND_APP_HANDLER_VIEW_APP_ADDR: eu.opencloud.api.collaboration

		## Config for OnlyOffice
		COLLABORATION_APP_NAME = "OnlyOffice";
		COLLABORATION_APP_PRODUCT = "OnlyOffice";
		COLLABORATION_WOPI_SRC =  "http://opencloud:9300"; <- Internal Link to the OpenCloud-Service and add 1/2*
		COLLABORATION_APP_ADDR =  "https://MyOnlyOfficeDom.eu"; <- External Link to OnlyOffice for iframe
		COLLABORATION_APP_INSECURE ="false";

		*1/2:
		COLLABORATION_HTTP_ADDR: 0.0.0.0:9300 <- listen to all interfaces or
		COLLABORATION_HTTP_ADDR: 127.0.0.1:9300 <- only localhost

		...

[pythonpoet]

Thanks for the suggestions!
based on the config of @sdamm4z I saw that i indeed had misconfigurations they are now:

OC_ADD_RUN_SERVICES = "collaboration";

COLLABORA_DOMAIN = "https://office.example.net";
FRONTEND_APP_HANDLER_VIEW_APP_ADDR = "eu.opencloud.api.collaboration";
COLLABORATION_APP_NAME = "OnlyOffice";
COLLABORATION_APP_PRODUCT = "OnlyOffice";
COLLABORATION_WOPI_SRC = "https://wopi.example.net"; #<- Internal Link to the OpenCloud-Service and add 1/2*
COLLABORATION_APP_ADDR = "https://office.example.net"; #<- External Link to OnlyOffice for iframe
COLLABORATION_APP_INSECURE ="true";
COLLABORATION_ENABLED = "true";
OCM_GATEWAY_ENABLED = "true";
COLLABORATION_LOG_LEVEL = "info";
COLLABORATION_HTTP_ADDR = "127.0.0.1:9300";

• i do a reverse proxy that does https://wopi.example.net -> 127.0.0.1:9300

Now the error i'm getting is it says the address 127.0.0.1:9300 is already in use and then the collaboration server crashes.
Do I understand correctly, that i need to specify the collaboration server to start? If i don't specify it i dont see the server with opencloud list - yes i tried using a different port but this had the same effect

here are the logs:
Jan 20 21:50:18 bernina opencloud[539240]: {"level":"info","service":"opencloud","event":"opencloud: Failed service 'service.SutureService{exec:(func(context.Context) error)(0x27f5fa0)}' (5.999415 failures of 5.000000), restarting: false, error: listen tcp 127.0.0.1:9300: bind: address already in use","time":"2026-01-20T21:50:18+01:00","line":"github.com/opencloud-eu/opencloud/opencloud/pkg/runtime/service/service.go:385","message":"supervisor: opencloud"}
Jan 20 21:50:18 bernina opencloud[539240]: {"level":"error","service":"collaboration","error":"rpc error: code = Canceled desc = context canceled","time":"2026-01-20T21:50:18+01:00","line":"github.com/opencloud-eu/opencloud/services/collaboration/pkg/helpers/registration.go:65","message":"AddAppProvider failed"}
Jan

Find full source code here

• the header im using is

  # Standard Headers
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Forwarded-Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  
  # WebSocket Support (Required for OnlyOffice)
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
  
  # Security: Allow iFraming
  proxy_hide_header X-Frame-Options;
  
  proxy_buffering off;
  proxy_cache off;
  proxy_read_timeout 24h;
  

[micbar]

seems that you have two collaboration services started.

OC_ADD_RUN_SERVICES = "collaboration" starts the collaboration service in the full stack. If you do that, you do not need an extra container with just the collaboration service.

[sdamm4z]

seems that you have two collaboration services started.

OC_ADD_RUN_SERVICES = "collaboration" starts the collaboration service in the full stack. If you do that, you do not need an extra container with just the collaboration service.

… In this case, a reverse proxy for WOPI is not required. WOPI is used for document processing, and a direct reference to the host (if the services are in the same network) is sufficient, more secure, and faster. Only OnlyOffice requires a publicly reachable domain for iframe access.

services:
	opencloud: <- Internal hostname for Docker-Compose-Stack --> COLLABORATION_WOPI_SRC = ...
		...
		COLLABORATION_WOPI_SRC =  "http://opencloud:9300"; <- Internal Link to the OpenCloud-Service and add 1/2*
		...

[pythonpoet]

Im not running a container. I'm running the barebone binary (3.7.0) with NixOS and so does the OnlyOffice instance.
When I run the opencloud server without OC_ADD_RUN_SERVICES = "collaboration", opencloud list will confirm that the service collaboration was not started.

with ss -tulpn I can also see that the port 9300 that claims to be taken belongs to the systemd job that runs the opencloud instance.

It appears that the collaboration server has some troubles starting up (app-registry, and gateway are running).
Also when i try to call my opencloud wopi server with http(s) at / or /discovery or /hosting/discovery i get a 404 from the wopi server - is that expected behaviour? And yes i will do the wopi forwarding internaly later, I found its easier for testing this way

[micbar]

the wopiserver/ route does not work it expects /wopi

curl -i https://wopiserver.demo.opencloud.eu/wopi
HTTP/2 418
content-type: text/plain; charset=utf-8
date: Wed, 21 Jan 2026 10:56:34 GMT
x-collaboration-version: 4.1.0
x-content-type-options: nosniff
x-request-id: d44359866f28/VLTBzc6eHV-000029
content-length: 13

I'm a teapot

[sdamm4z]

Currently, I can only access your code via mobile, but I noticed the following:

COLLABORATION_ENABLED = "true";
OCM_GATEWAY_ENABLED = "true";

As far as I know, COLLABORATION_ENABLED is not an official environment variable.
OCM_GATEWAY_ENABLED might cause the gateway service to start on port 9300, which could result in the service already running.

Please comment out both variables for now. You should also review my configuration and use only the environment variables required for collaboration with the Collaboration service.

To avoid issues with the reverse proxy, I suggest accessing the WOPI service locally first. Additionally, the 9300 port should initially be open on all interfaces. Once everything works, we can restrict the settings to the necessary interfaces.

[pythonpoet]

That's strange, i nod get
curl -i https://wopi.davidwild.ch/wopi
HTTP/2 404
server: nginx
date: Wed, 21 Jan 2026 11:21:33 GMT
content-type: text/plain; charset=utf-8
content-length: 19
x-content-type-options: nosniff

404 page not found

Im using opencloud 3.7.0 -> its not a version error?

[pythonpoet]

I disabled the following:

COLLABORATION_ENABLED = "true";
OCM_GATEWAY_ENABLED = "true";

Still get the same result:
Jan 21 12:26:20 bernina opencloud[620983]: {"level":"info","service":"opencloud","event":"opencloud: Failed service 'service.SutureService{exec:(func(context.Context) error)(0x27f5fa0)}' (5.999518 failures of 5.000000), restarting: false, error: listen tcp 127.0.0.1:9300: bind: address already in use","time":"2026-01-21T12:26:20+01:00","line":"github.com/opencloud-eu/opencloud/opencloud/pkg/runtime/service/service.go:385","message":"supervisor: opencloud"}
Jan 21 12:26:20 bernina opencloud[620983]: {"level":"error","service":"collaboration","error":"rpc error: code = Canceled desc = context canceled","time":"2026-01-21T12:26:20+01:00","line":"github.com/opencloud-eu/opencloud/services/collaboration/pkg/helpers/registration.go:65","message":"AddAppProvider failed"}

[sdamm4z]

Change the OpenCloud service to listen on port 9200 by setting:
PROXY_HTTP_ADDR = "0.0.0.0:9200";
Also update the reverse proxy configuration to match this port so that all traffic is correctly routed to OpenCloud.

If this doesn’t work, I’ll follow up again either tonight or tomorrow.

[pythonpoet]

Yeah i changed this:

PROXY_HTTP_ADDR = "0.0.0.0:9200";

It still doesn't work, but beside the collaboration service opencloud works on my system

[micbar]

https is only available via reverse proxy

[pythonpoet]

im using nginx as a reverse proxy, the proxy is correctly configured there is the same behaviour on the local machine: curl -i http://127.0.0.1:9300/wopi/
HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Wed, 21 Jan 2026 15:56:15 GMT
Content-Length: 19

Als im using a rasperrypi 5 with arch64, that is fully supported right?

[sdamm4z]

That already looks good. So it only comes down to the configuration now.
Have all ports been checked?

WOPI = http://HOST:9300
OpenCloud = https://HOST:9200

My recommendation for the test environment:
No interface should listen only on localhost, but on all interfaces → 0.0.0.0:xxxx.
Access the WOPI service directly via http://HOSTNAME:9300, without using the /wopi path.
Only after that should additional services such as a reverse proxy be used in order to rule out a proxy misconfiguration.

[pythonpoet]

Yeah i did those changes but still to the same result. my wopi server still gives a 404
also, in your configuration above, it says COLLABORA_DOMAIN isn't that specific to collabora online?

COLLABORA_DOMAIN = "https://MyOnlyOfficeDom.eu"; <- External Link to OnlyOffice - for iframe

I went through the logs and found some more info:
when it boots up:

collaboration server successfully binds to the registry:
Jan 21 23:36:36 bernina opencloud[999809]: {"level":"info","service":"collaboration","time":"2026-01-21T23:36:36+01:00","line":"github.com/opencloud-eu/opencloud/pkg/registry/register.go:19","message":"registering external service eu.opencloud.api.collaboration-2abe3822-d436-4bd1-aea4-c4c9d497483d@127.0.0.1:9301"}

but then get a netlinkrib error:
Jan 21 23:36:36 bernina opencloud[999809]: {"level":"error","service":"collaboration","error":"'web reachability': route ip+net: netlinkrib: address family not supported by protocol","time":"2026-01-21T23:36:36+01:00","line":"github.com/opencloud-eu/opencloud/pkg/handlers/checker.go:107","message":"check failed"}

And after that the reboots occure:
21 23:36:36 bernina opencloud[999809]: {"level":"error","service":"opencloud","event":"opencloud: Failed service 'service.SutureService{exec:(func(context.Context) error)(0x275d320)}' (1.000000 failures of 5.000000), restarting: true, error: listen tcp 0.0.0.0:9300: bind: address already in use","service":"service.SutureService{exec:(func(context.Context) error)(0x275d320)}","supervisor":"opencloud","restarting":true,"failures":1,"threshold":5,"error":{"Op":"listen","Net":"tcp","Source":null,"Addr":{"IP":"0.0.0.0","Port":9300,"Zone":""},"Err":{"Syscall":"bind","Err":98}},"time":"2026-01-21T23:36:36+01:00","line":"github.com/opencloud-eu/opencloud/opencloud/pkg/runtime/service/service.go:400","message":"service terminated"}

full logshere

Is the netlinkrib error related to the usage of ipv6?
-> i checked my system, ipv6 is enabled
-> i tried to use GODEBUG="netdns=go"; to prevent ipv6 routing (no effect)
-> i baned ipv6 in the systemd job also no effect

Any ideas what causes the issue?

[sdamm4z]

I see..:
COLLABORA_DOMAIN = "https://myonlyofficedom.eu/"; change to COLLABORA_DOMAIN = "myonlyofficedom.eu";

---

Here is my complete configuration relating to the Collaboration service.

docker-compose:

services:
  opencloud:
    image: opencloudeu/opencloud:latest
    restart: unless-stopped
    entrypoint: /bin/sh
    command: ["-c", "opencloud init || true; opencloud server"]
    environment:
      ### Container ###
      OC_URL: https://opencloud.domain.de
      OC_INSECURE: false
      OC_ADD_RUN_SERVICES: collaboration

      PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml
      PROXY_HTTP_ADDR: 0.0.0.0:9200

      ## Weboffice
      COLLABORA_DOMAIN: onlyoffice.domain.de
      FRONTEND_APP_HANDLER_SECURE_VIEW_APP_ADDR: eu.opencloud.api.collaboration

      ## Weboffice - Collaboration
      COLLABORATION_HTTP_ADDR: 0.0.0.0:9300
      COLLABORATION_WOPI_SRC: http://opencloud:9300
      COLLABORATION_APP_NAME: OnlyOffice
      COLLABORATION_APP_PRODUCT: OnlyOffice
      COLLABORATION_APP_ADDR: https://onlyoffice.domain.de
      COLLABORATION_APP_ICON: https://onlyoffice.domain.de/web-apps/apps/documenteditor/main/resources/img/favicon.ico
      COLLABORATION_APP_INSECURE: false
      COLLABORATION_CS3API_DATAGATEWAY_INSECURE: false
    depends_on:
      onlyoffice:
        condition: service_healthy

  ## Weboffice - OnlyOffice
  onlyoffice:
    image: onlyoffice/documentserver:latest
    restart: unless-stopped
    environment:
      WOPI_ENABLED: true
      USE_UNAUTHORIZED_STORAGE: false
      JWT_ENABLED: true
      REDIS_SERVER_HOST: localhost
      REDIS_SERVER_PORT: 6379
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/hosting/discovery"]

OpenCloud-CSP:

directives:
  child-src:
    - '''self'''
  connect-src:
    - '''self'''
    - 'blob:'
    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
    - 'https://${IDP_DOMAIN}/'
    - 'https://update.opencloud.eu/'
  default-src:
    - '''none'''
  font-src:
    - '''self'''
  frame-ancestors:
    - '''self'''
  frame-src:
    - '''self'''
    - 'blob:'
    - 'https://embed.diagrams.net/'
    - 'https://onlyoffice.domain.de/'
    - 'https://docs.opencloud.eu'
  img-src:
    - '''self'''
    - 'data:'
    - 'blob:'
    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
    - 'https://tile.openstreetmap.org/'
    - 'https://onlyoffice.domain.de/'
  manifest-src:
    - '''self'''
  media-src:
    - '''self'''
  object-src:
    - '''self'''
    - 'blob:'
  script-src:
    - '''self'''
    - '''unsafe-inline'''
    - 'https://${IDP_DOMAIN}/'
  style-src:
    - '''self'''
    - '''unsafe-inline'''

NGINX-OnlyOffice:

server {
	listen 443 ssl;
	listen [::]:443 ssl;

	server_name onlyoffice.*;

	client_max_body_size 500M;
	proxy_set_header Accept-Encoding "";
	proxy_buffering off;

    location / {
		proxy_pass http://MyOnlyOfficeContainer:80;

		proxy_read_timeout 3600s;
		proxy_send_timeout 3600s;

		# iframe-Einbettung (CSP)
		proxy_hide_header X-Frame-Options;
		#add_header X-Frame-Options "ALLOWALL";                                     <- only for tests (ALLOW-ALL)
		add_header Content-Security-Policy "frame-ancestors 'self' https://*.domain.de";
    }
}

OnlyOffice-Config:

{
  "services": {
    "CoAuthoring": {
      "sql": {
        "type": "postgres",
        "dbHost": "localhost",
        "dbPort": "5432",
        "dbName": "DBNAME",
        "dbUser": "DBUSER",
        "dbPass": "MYPASSWORD"
      },
      "ipfilter": {
        "rules": [
          {
            "address": "opencloud",              <- Only allow my container
            "allowed": true
          },
          {
            "address": "*",
            "allowed": false
          }
        ],
        "useforrequest": false,
        "errorcode": 403
      },

      "token": {
        "enable": {
          "request": {
            "inbox": true,
            "outbox": true
          },
          "browser": true
        },
        "inbox": {
          "header": "Authorization"
        },
        "outbox": {
          "header": "Authorization"
        }
      },
      "secret": {
        "inbox": {
          "string": "MYTOKEN"
        },
        "outbox": {
          "string": "MYTOKEN"
        },
        "session": {
          "string": "MYTOKEN"
        }
      }
    }
  },
  "rabbitmq": {
    "url": "amqp://guest:guest@localhost"
  },
  "FileConverter": {
    "converter": {
      "inputLimits": [
        {
          "type": "docx;dotx;docm;dotm;pages;odt;txt;rtf",
          "zip": { "uncompressed": "500MB", "template": "*.xml" }
        },
        {
          "type": "xlsx;xltx;xlsm;xltm;numbers;ods;csv",
          "zip": { "uncompressed": "500MB", "template": "*.xml" }
        },
        {
          "type": "pptx;ppsx;potx;pptm;ppsm;potm;key;odp",
          "zip": { "uncompressed": "500MB", "template": "*.xml" }
        },
        {
          "type": "pdf",
          "zip": { "uncompressed": "500MB", "template": "*.xml" }
        }
      ]
    }
  }
}

This configuration works flawlessly.
All containers that require external connectivity (OpenCloud and OnlyOffice) are located behind the reverse proxy in the DMZ.
All other containers, such as Tika, run in an internal network and communicate exclusively within that network.

If this configuration does not work, the issue is, in my opinion, related to something other than OpenCloud or OnlyOffice.
For this reason, I unfortunately do not know how else to help and can only reiterate the advice to initially keep the configuration as open as possible and to use as few services as necessary.
Additional services often cause problems because they can be misconfigured. There is nothing simpler than direct communication between services.
Once everything is working properly, the system can be hardened step by step.

--

I hope I was able to help you a little.

[micbar]

@sdamm4z thank you for sharing.

I see that you are starting the collaboration service inside the main process. That is a good idea and we made that possible recently.

This is importantly for everybody else. It is different to our compose project where we start it separately.

[dragonchaser]

Moving this to Gerneral discussions, we do not support OnlyOffice => not a bug