ONLYOFFICE Docs Community

This template creates an ONLYOFFICE document editing service. You connect it to an application that stores your documents. Users then open and edit those documents from that application. The template works with any compatible connector; it does not install or configure a particular application.

The template is ready for a connected application on the same Docker network. Docker runs each application in a separate container. A shared Docker network lets those containers contact each other without sending their traffic through a public website address. Your administrator can confirm which network each app uses.

1. What you need before starting

Ask your administrator to confirm these items:

• Your Tower server has Docker and the existing Traefik template installed. Traefik provides the HTTPS website address and its certificate.
• You have a hostname for ONLYOFFICE, such as office.example.com, with a DNS record pointing to your server. DNS is the service that connects a website name to a server.
• The application you want to connect has a compatible ONLYOFFICE connector installed.
• For private connections, ONLYOFFICE and the application are on the same Docker network. Both also need to be able to contact the appropriate addresses described in section 4.
• You have a strong shared secret ready. This is a password used by the two services to recognize each other; users do not enter it when opening documents.

This package uses the official Community image, pinned to version 10.0.0. It does not publish an extra server port: users reach it through the existing HTTPS proxy. It keeps its local data, working files, logs and custom fonts in four separate persistent storage areas. Custom fonts must be placed in the designated folder listed in the administrator reference.

2. Import the template and enter the secret

For a new installation:

1. In Tower, open Tools > Import YAML, upload cx_jet_template_onlyoffice_docs.yaml, and choose Process.
2. Choose Skip record, then Import. This preserves existing shared records and adds the records that are missing.
3. Open Settings > Keys and Secrets, find ONLYOFFICE JWT Secret (onlyoffice_jwt_secret), and enter the secret. Use at least 32 random characters consisting of letters, numbers, underscores or hyphens. Do not put it in a regular configuration variable. Store it securely so you can enter the same value in the connected application.
4. Install ONLYOFFICE Docs Community (Docker) on your chosen server.

If ONLYOFFICE is already installed, Skip record will not update it. Ask your administrator to apply the update to the existing records, preserving their references and your chosen settings. Do not use Create a new record to update an existing template. General YAML Update also affects shared records and only adds or updates child rows; it does not remove old ones. Review the affected records first.

A secret can have a value specific to a server. If a server-specific value already exists, changing only the general value will not change the secret used on that server. Ask your administrator to change the value for the intended server.

3. Launch ONLYOFFICE

1. Create a Jet using ONLYOFFICE Docs Community (Docker) on the chosen server.
2. Set its website URL to your HTTPS address, for example https://office.example.com. Your administrator can instead configure the existing web_domain setting so Tower generates the hostname. Either way, a matching DNS record must exist.
3. In the Jet's Configuration tab, review the settings in the table below.
4. Choose Running as the requested state. Tower prepares storage, creates the container, starts it and waits for the service to be ready. Initial startup can take several minutes.
5. Open the Jet's HTTPS address. A welcome page confirms the site is available; it is not a document library and does not replace your connected application.
6. Open Jet Logs > Connection details, then use Open to view the connection card. If the card is empty or out of date, use its log update action. Copy its addresses and network name for the next section. No secret is displayed there.

| Setting | Default | What it means | | --- | --- | --- | | Tower Docker Network (tower_docker_network) | tower | Must match the network used by Traefik. For direct private communication, the connected application must also join this network. Changing this setting does not move the other app. | | Allow connections to apps on private networks (onlyoffice_allow_private_ip) | Enabled (true) | Allows ONLYOFFICE to download documents from private addresses, including apps on the shared Docker network. Keep Enabled for this setup. Choose Disabled (false) if all connected apps use public addresses. | | ONLYOFFICE JWT Header (onlyoffice_jwt_header) | Authorization | Use this same header setting in the application's connector. | | Jet Image Name (jet_image_name) | onlyoffice/documentserver:10.0.0 | The ONLYOFFICE version. Ask your administrator to review upgrades before changing it. |

Private-network access allows private destinations generally; it is not a permission list limited to one application or one Docker network. Use it with trusted connected applications. Access to cloud metadata addresses remains disabled. JWT authentication and certificate verification remain enabled, and the demonstration application is off.

The connection card shows saved Tower settings. For an existing container, changed settings take effect only after the recreation steps in section 6.

4. Connect your application: understand the three addresses

There are three separate connections. Their addresses can be different:

| Connection | Address to enter | Where to get it | | --- | --- | --- | | A user's browser opens ONLYOFFICE | The Browser address, using HTTPS | Copy it from Connection details. Enter it in the connector's main ONLYOFFICE/document server address field. | | Your application contacts ONLYOFFICE | The Internal address, if both containers share the network | Copy it from Connection details. Enter it in the connector's internal ONLYOFFICE address field. | | ONLYOFFICE downloads documents and sends save notifications to your application | Your application's internal address, including its port when required | Ask that application's administrator. Enter it in the connector's return address/callback base address setting. |

For example, a connection card might show:

• Browser address: https://office.example.com
• Internal address: http://example_onlyoffice/
• Shared Docker network: tower

These are examples, not values to copy. Use your own card. The internal address uses port 80, so you do not need to add a port number. A connected application may use a different port. For example, its administrator might provide http://example_app:8080/. Do not assume that example is your application's address.

The internal addresses work inside Docker, not from a user's computer. The browser still needs the HTTPS address because it loads the editor directly from ONLYOFFICE. That address can be reachable through the internet, an office network or a VPN, provided every intended user's browser can reach it and trusts its certificate. Sharing a Docker network does not remove this browser connection.

In the connected application, also enter the same shared JWT secret configured in Tower, and the matching JWT header. This template uses header-based service requests (JWT_IN_BODY=false). Connector field labels vary; identify each setting by which service is contacting which service. If the connector has no separate internal address settings, use addresses reachable by all the required participants and ask its administrator for the supported configuration.

Do not use localhost for another container. Inside a container, localhost means that container itself. The connected application must accept its internal hostname, select the intended database where relevant, and expose its document-download and save-notification routes. Those are application settings, outside this template.

If your application is on another server or network, use reachable addresses for those connections. This template does not automatically join remote Docker networks, move another app, set up VPNs, or install connectors.

5. Check the connection before inviting users

1. Confirm ONLYOFFICE is Running and its browser address opens from a user's computer.
2. Save the connector settings in your application and run its connection test, if offered.
3. Open a disposable document from that application and make a small change.
4. Close the editor, allow the application to finish saving, then reopen the document. Confirm the change is present.

A welcome page or successful healthcheck does not prove that document downloads and saving work. The document test checks the complete connection. Your application owns the original document; ONLYOFFICE's local storage alone is not a backup of that app.

6. Change settings on an existing Jet

Changes to the Docker network, private-network access, JWT secret/header or image version require the container to be recreated. Restart alone does not apply them.

1. Tell users to finish editing and close their documents. Take appropriate backups before changing versions or doing other maintenance.
2. If you are upgrading from an earlier version of this template and have installed custom fonts, ask your administrator to save a copy of those fonts before the first Remove. Older containers kept custom fonts in unnamed storage that Remove deletes. Adding the new font storage does not copy files out of that older storage. Restore your saved fonts into the new font storage before returning the service to users.
3. Change the intended setting in the Jet's Configuration tab, or change the appropriate secret in Settings > Keys and Secrets. A value on the Jet overrides the template default; changing the default will not replace a Jet-specific value.
4. Run Stop and wait for Stopped. This asks ONLYOFFICE to finish saving first.
5. Run Remove and wait for Removed. This removes the container but keeps its persistent storage. It is different from Destroy.
6. Run Build, wait for Stopped, then run Start and wait for Running.
7. Check Connection details and repeat the disposable-document test.

You can also request state Running from Removed to let Tower run Build and Start in sequence. Changing ONLYOFFICE's settings does not change the connected application's settings; update both sides when changing the shared secret or network addresses.

7. Everyday actions and logs

| Action | What happens | | --- | --- | | Prepare | Locks deletion, checks settings and creates persistent storage. | | Build | Downloads the selected image and creates a container, leaving it stopped. | | Start | Starts the existing container and checks that the service is ready. | | Stop | Asks ONLYOFFICE to finish saving, then stops the container. | | Restart | Performs a graceful Stop and starts the same container with its existing settings. | | Remove | Removes the stopped container and keeps data, working files, logs and custom fonts. The Jet remains protected from deletion. | | Build from Removed | Creates a replacement container using the retained data and current settings. | | Discard incomplete build | Available from Draft; removes an incomplete stopped container before rebuilding or final cleanup. | | Destroy | Available from Removed to Root users. Permanently deletes the Jet's persistent data, then unlocks deletion. |

Destroy permanently deletes local data. Do not use it to apply configuration changes. The template leaves shared images, shared networks, Traefik and DNS records in place. Your administrator must manage DNS separately, including removing an unused record.

Open Jet Logs for these views:

• Connection details: addresses, network and non-secret settings; available even when the container is stopped. It describes saved settings, not a live network test.
• Container output: startup and process messages.
• Document service: editor service messages.
• Converter: document conversion messages.
• Nginx errors: web-service errors.
• Service health: true means the internal document service is ready.

The document service, converter, Nginx and health views need a running container. Saving before shutdown can take five minutes. A failed save, stop or cleanup step stops the plan; investigate it before retrying instead of forcing deletion.

8. Troubleshooting

| What you see | What to check | | --- | --- | | The HTTPS page does not open | Correct hostname, DNS, certificate and running Traefik Jet. Check from the user's computer as well as the server. | | The editor cannot load | The main connector address must be browser-accessible HTTPS. A Docker-only address cannot be used by the browser. | | The app cannot reach ONLYOFFICE internally | Both containers must actually be on the same named network. Copy the internal address from Connection details, including http://. | | A document cannot be downloaded | Enable private-network access, recreate the container, and check the application's internal address, port, database routing and permissions. | | Editing works but changes do not save | Check the application's return/callback address and its save-notification route. Run the document test again. | | A token/JWT error appears | Both sides need the same secret and header. Check whether a server-specific secret takes priority, then recreate the ONLYOFFICE container after changing it. | | A new setting seems ignored | Check for a Jet-specific override and run Stop > Remove > Build > Start. Restart is insufficient. | | Start reports a readiness failure | Read the startup logs. The container may already be running; fix the underlying issue and retry Start. | | Prepare failed before reaching Draft | Correct the configuration and ask your administrator to retry the requested state on the existing Jet. Do not create duplicate Jets. |

Administrator reference

This application package requires the existing traefik_docker template and its Docker dependencies. It reuses set_jet_as_not_deletable, set_jet_as_deletable, start_jet_container, show_jet_logs, jet_image_name and tower_docker_network. The exported set_jet_url helper, web_domain variable and DNS tag are included for missing records; preserve existing definitions when importing. Tower's standard Jet states must exist. The host needs Linux, Docker, Bash and GNU xargs. Traefik must use entrypoint websecure and certificate resolver le.

Private-network support maps to ALLOW_PRIVATE_IP_ADDRESS=true at container creation. ALLOW_META_IP_ADDRESS=false, USE_UNAUTHORIZED_STORAGE=false, JWT_ENABLED=true and EXAMPLE_ENABLED=false remain fixed. The template does not add application-specific dependencies, credentials, routes, databases, connector settings or software.

Custom fonts are stored in the labelled named volume onlyoffice_<Jet reference>_fonts, mounted at /usr/share/fonts/truetype/custom. Place added fonts in this designated folder. Fonts installed elsewhere in the container are not covered by this storage and can be lost when the container is recreated. Prepare and Build create it; Remove preserves it; Destroy removes it through the existing Jet/app label filter. An older container's anonymous font volume is not migrated automatically. Back up its contents before removal and restore them into the new named storage using Tower commands. Refresh ONLYOFFICE's font list after installing or restoring fonts according to the vendor's instructions. The font volume preserves font files; it does not install fonts or refresh that list for you.

Allow sufficient Tower command/worker timeouts for image downloads, startup and the shutdown save step. JWT values are masked in Tower, but Docker administrators can read container environment values. For existing installations, add the new Connection details log to existing Jets as well as the template; new Jets receive it automatically.

Verification status

The previous package was tested on Tower 18 on 2026-11-07: import/re-import, rendering, Python validation, Prepare, Build, Start, graceful Restart, Stop, Remove, rebuild with retained data, HTTPS, JWT authentication and application logs passed. Separate empty-Jet tests covered draft cleanup, Destroy and deletion protection.

The shared-network update was also validated on 2026-11-07:

• The updated YAML passed Tower's processing step and source-derived field, reference, lifecycle and command checks.
• The existing test Jet completed Stop > Remove > Build > Start with all four plans returning exit code 0, and was left Running.
• The recreated container explicitly has private-network access enabled, metadata access disabled, untrusted certificates disabled and JWT enabled.
• A neighboring application container reached ONLYOFFICE at its internal Docker address and received a successful health response.
• ONLYOFFICE downloaded a harmless static text file directly from that application over Docker, converted it, and returned a valid PDF. No application configuration was changed for this test.
• Public HTTPS health remained successful after recreation.
• Connection details showed the correct addresses, network and saved access setting on the live Jet. A separate record-only test confirmed that new Jets inherit the enabled default and all six log views. That temporary record was deleted without creating host resources.

The two review corrections were validated on 2026-11-07:

• Docker CLI 29.9.2 accepts the updated docker stop --timeout 300 command; the live Stop completed with exit code 0 and no deprecation warning.
• The pinned image's custom-font directory now has its own labelled named volume. A harmless file survived an isolated container removal with --volumes and was present in the rebuilt live service; it was removed after verification.
• The previous custom-font directory was copied into the new named storage before the old live container was removed. This was a one-time migration for the test Jet; administrators upgrading other existing Jets must follow the backup guidance above.
• The live Stop > Remove > Build > Start sequence passed, and public HTTPS health returned true. The service was left Running.
• A separate empty Jet verified that Prepare creates all four labelled volumes and Destroy removes all four before unlocking deletion. Those test resources were cleaned up. This checks storage retention, not rendering of a newly installed font.

An actual connected-application document open/edit/save round trip still requires verification in the intended application's connector. The file-conversion test checks private-network download and conversion, not interactive editing or save notifications. The template does not configure any application's connector.

Official references: Docker image settings, JWT configuration, conversion API, adding fonts.