OnlyOffice configuration for outside localhost network

[baboon]

Hello everyone,
First i want to say amazing work on the OnlyOffice. Keep it up!
Also excuse me if i ask or say something stupid, i might not be as advanced as some of you

and now my issue, that i have tried to solve for days, i have read countless articles from this forum and others and i cant solve it, regardless of what i try.

Current state (everything is running on the same pc):
domain.tk - runing on ubuntu server
cloud.domain.tk - is nextcloud 12.0.3
localhost:1443 - onlyoffice docker image server, (localhsot = 192.168......)

i have put self-signed certificates for all 3 of them. (domain.tk and localhost:1443 have the same one, cloud has different. everything runs on https)

For the setups i have used the guides given in this forum for the installation and integration of onlyoffice.

i mount the image of docker with:

Code: Select all

sudo docker run -i -t -d -p 1443:443 --restart=always --name office \
 -v /app/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data \ onlyoffice/documentserver

accessing https:// localhost:1443 opens the welcome page of the onlyoffice server sayign everything is ok.
using https:// localhost:1443 for the Document Editing Service address in onlyoffice admin page in nextcloud works.

=> everything works fine while im in my home network (except saving the opened docs back to the cloud)

Now comes my issue and probably incompetence:

In order to access the onlyoffice server from outside my home network (example: opening and editing word file while at work) i read i have to do a reverse proxy - no matter what i do or VH i create - office.domain.tk always returns domain.tk and not the onlyoffice server page (maybe i need help here).
So i thought of smth else - I did a portforward in my router of port 1443 to my server (localhost), thus localhost:1443 = domain.tk:1443 and became accessible from outside the home network loading the onlyoffice server page "Document Server is running", just as it is supposed to.

Now when i put https:// domain.tk:1443 instead of https:// localhost:1443 in the admin page of onlyoffice in nextcloud it gives me the usual "ONLYOFFICE cannot be reached. Please contact admin" when i open a document - why is that? what is the difference?

Anyone who has any suggestion would be greatly appreciated and if I am doing it the wrong way, please help me out.

Please let me know what other info you need about my set up, i can provide anything.

Thank you in advance

EDIT:

Thanks to http://dev.onlyoffice.org/viewtopic.php?f=53&t=10449 and the VH configuration posted there yesterday i managed to finally make subdomain of https://localhost:1443 (onlyoffice document server), making it office.domain.tk. Also i created separate self signed certificate for the domain and each sumdomain.

Unfortunetly, when i use that in the admin panel in of onlyoffice in nextcloud the server still gives error "ONLYOFFICE cannot be reached. Please contact admin".
What am I missing?

[Maxim]

Hello baboon!
You need to configure proxing. See here

[baboon]

Thank Maxim for your answer.
I had come across this page but didn't know i need to use it.

From what i understand from it i need to use the second option proxying HTTPS-HTTP. Could you please advise me where am i supposed to put and enable this conf file - mods-available? should i stop the current VH for the document server (office.domain.tk)? or merge the files?

I apologize as i have not used such files and need little advice. Anything i tried gave me errors that i see for the first time.

Thank you

[baboon]

Hi,
I managed to make it work and will post it here for others that might have similar issues.

Basically, i did not need to use that proxy file mentioned by Maxim. It turned out that a simple VH was enough:

Code: Select all

<VirtualHost *:80>
    ServerName office.domain.tk
    Redirect permanent "/" "https://office.domain.tk/"
</VirtualHost>

<VirtualHost *:443>
  ServerName office.domain.tk

  # SSL configuration
  SSLEngine on
  SSLCertificateFile   /etc/letsencrypt/live/domain.tk/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/domain.tk/privkey.pem               
  SSLCertificateChainFile /etc/letsencrypt/live/domain.tk/fullchain.pem 
  SSLProtocol all -SSLv2 -SSLv3
  SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4
  SSLHonorCipherOrder on
  SSLCompression off

  #  Container SSL
  SSLProxyEngine On
  SSLProxyVerify None
  SSLProxyCheckPeerCN Off
  SSLProxyCheckPeerName Off
  SSLInsecureRenegotiation on
  SSLVerifyClient none
 
  ProxyPreserveHost On
  ProxyRequests Off
  RequestHeader unset Accept-Encoding
 
  ProxyPass / "https://127.0.0.1:1443/"
  ProxyPassReverse / "https://127.0.0.1:1443/"
 
</VirtualHost>


I load the documentserver docker container with

Code: Select all

sudo docker run -i -t -d -p 1443:443 --restart=always --name office -v /app/onlyoffice/DocumentServer/logs:/var/log/onlyoffice -v /app/onlyoffice/DocumentServer/data:/var/www/onlyoffice/Data onlyoffice/documentserver


as well as, in nextcloud i used only the "Document Editing Service address" field with office.domain.tk and the others i left blank.
Also i had to turn off "Header set X-Frame-Options" (put # in from of it) from any VH conf for that domain.
Also (if that makes a difference) i used letsencrypt to make a trusted key and chain cert for the domain with every subdomain included. (the same set of cert and key for every VH). For the documentserver i used self-signed cert and key with openssl (as i did not find a way to use *.pem files for key and cert inside /app/onlyoffice/DocumentServer/data/certs")
This way everything works from the local network, as well as, outside of it. Documents load from any device. When i click save, it takes about 20-40sec for the file to appear edited in nextcloud online page with "Versions" and "Activity" updated.

The only thing i still cannot figure out is howcome i dint need the apache proxy settings from Maxim to make the system work.
Also when trying to make it work with that file, upon loading the modules - the one called

Code: Select all

LoadModule unixd_module modules/mod_unixd.so

always game errors together with the apache config file.

Also,

Code: Select all

<IfModule unixd_module>
  User daemon
  Group daemon
</IfModule>


made my whole cloud page break even tho he lines weer included only in the office VH. The rest of the file made no difference to how nextcloud and he documentserver worked together (as least not any that i saw).

Regardless of if working as its supposed to, i get 2 errors in the console window both in chrome and mozilla (NOTE: i dont know since when i have them but i had before i managed to fix the issue in this topic. as well as, after)



Seeing the wss fail made me think of failing websockets and i spend a howle day trying to fix that (before i fixed the issue in this post) but again...the documentserver is working and i idk what the error tells me, nor if its important, nor wether i can just ignore it or how to fix it.

For anyone that might have a clue, through forums, pages and similar issues ive tried the following lines in order to fix that WebSocket handshake error, but with no avail (Note: i did not use all of the at once; i dont kno what half of them do; im them for anyone that might get a hint from them how to fix it or you never know)

Code: Select all


  # ProxyPassMatch (.*)(\/websocket)$ "wss://127.0.0.1:1443/$1$2"
  # ProxyPass /wss/ wss://127.0.0.1:1443/
  # ProxyPassReverse /wss/ wss://127.0.0.1:1443/

   
  # SetEnvIf Host "^(.*)$" THE_HOST=$1
  # RequestHeader setifempty X-Forwarded-Proto https
  # RequestHeader setifempty X-Forwarded-Host %{THE_HOST}e
  # ProxyAddHeaders Off
 
  # ProxyPass / "https://127.0.0.1:1443/"
  # ProxyPassReverse / "https://127.0.0.1:1443/"
  # ProxyPass "/websocket" "wss://127.0.0.1:1443/websocket"
  # ProxyPassReverse "/websocket" "wss://127.0.0.1:1443/websocket"
  #  <proxy *>
  #     AddDefaultCharset off
  #     Order Allow,Deny
  #     Allow from all
  #  </proxy>
 
  # RewriteEngine On
  # RewriteCond %{REQUEST_URI}  ^/socket.io            [NC]
  # RewriteCond %{QUERY_STRING} transport=websocket    [NC]
  # RewriteRule /(.*)           wss://127.0.0.1:1443/$1 [P,L]

  # RewriteEngine on
  # RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]
  # RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
  # RewriteRule .* ws://127.0.0.1:1443%{REQUEST_URI} [P]



If anyone has a suggestion what and why i have them or how to fix it, id be glad to hear it.
Thank you.

[baboon]

For anyone interested i managed to make the sockets work with:

Code: Select all

 
  RewriteEngine On
  RewriteCond %{HTTP:Connection} Upgrade [NC]
  RewriteCond %{HTTP:Upgrade} websocket [NC]
  RewriteRule /(.*) wss://127.0.0.1:1443/$1 [P,L]


i added this at the end of the VH file before </VirtualHost>
Now there are no websocket handshake errors.

Just realized this topic is more relevant for here viewforum.php?f=23
maybe it should be moved there.

Cheers