Office 2021 EOL: Collabora Online or OnlyOffice on VPS

Office 2021: what end of support actually means

Concrete risks of running an unpatched office suite

• Unblocked malicious macros: security updates regularly fixed execution vectors via Word and Excel macros — those vectors remain open.
• Weaponised .docx and .xlsx files: Office formats are documented attack surfaces (OLE, DDE, merge fields); without patches, parsers remain vulnerable to published exploits.
• Compliance exposure: NIS2 and the Cyber Resilience Act (CRA) require software maintenance at a documented level. A vendor who no longer provides patches transfers liability to the deployer.
• Lateral movement vector: a document opened from a low-privilege account can, via an unpatched CVE, escalate privileges or pivot to other network resources.
• Cyber insurance exclusion: several policies explicitly exclude end-of-life software from coverage.

Collabora Online vs OnlyOffice: which one for your Nextcloud

Collabora Online vs OnlyOffice Docs — technical comparison

Scroll the table

VPS prerequisites before installation

Installing Nextcloud + Collabora Online via Docker Compose

1. 01

   Create the file structure

   On the VPS, create a dedicated directory and place the docker-compose.yml file there:

   mkdir -p /opt/nextcloud && cd /opt/nextcloud

2. 02

   Write the docker-compose.yml for Nextcloud + Collabora

   version: '3.8'
   services:
     db:
       image: mariadb:10.11
       restart: always
       environment:
         MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
         MYSQL_DATABASE: nextcloud
         MYSQL_USER: nextcloud
         MYSQL_PASSWORD: ${DB_PASSWORD}
       volumes:
         - db_data:/var/lib/mysql
   
     nextcloud:
       image: nextcloud:29
       restart: always
       ports:
         - "8080:80"
       environment:
         MYSQL_HOST: db
         MYSQL_DATABASE: nextcloud
         MYSQL_USER: nextcloud
         MYSQL_PASSWORD: ${DB_PASSWORD}
         NEXTCLOUD_TRUSTED_DOMAINS: your-domain.com
         NEXTCLOUD_ADMIN_USER: admin
         NEXTCLOUD_ADMIN_PASSWORD: ${NEXTCLOUD_ADMIN_PASSWORD}
       volumes:
         - nextcloud_data:/var/www/html
       depends_on:
         - db
   
     collabora:
       image: collabora/code:latest
       restart: always
       environment:
         aliasgroup1: https://your-domain.com:443
         DONT_GEN_SSL_CERT: "YES"
         extra_params: --o:ssl.enable=false --o:ssl.termination=true
       ports:
         - "9980:9980"
       cap_add:
         - MKNOD
   
   volumes:
     db_data:
     nextcloud_data:

   Also create a .env file containing DB_ROOT_PASSWORD, DB_PASSWORD and NEXTCLOUD_ADMIN_PASSWORD with long random values.

3. 03

   Configure the nginx reverse proxy

   Nextcloud and Collabora each expose on a separate port. Create two nginx server blocks — one for your-domain.com (port 443, proxy to 8080) and one for collabora.your-domain.com (port 443, proxy to 9980).

   For Collabora, add the directive proxy_set_header X-Forwarded-Proto https; and WebSocket headers (Upgrade, Connection). The Collabora sidecar uses WebSocket for real-time co-editing.

4. 04

   Obtain TLS certificates

   certbot --nginx -d your-domain.com -d collabora.your-domain.com

   Let's Encrypt generates certificates for both domains in one pass. Automatic renewal is configured by certbot's systemd timer.

5. 05

   Start the stack and verify

   cd /opt/nextcloud
   docker compose up -d
   docker compose logs -f nextcloud

   Wait for Nextcloud to initialise (around 90 seconds on first start). Access https://your-domain.com and log in with the admin credentials.

6. 06

   Enable Nextcloud Office and connect Collabora

   In the Nextcloud admin panel: Apps → Office & text → Nextcloud Office → enable.

   Then: Settings → Administration → Office → select 'Use your own server' → enter https://collabora.your-domain.com → click 'Save'.

   Open a .docx file from Nextcloud: the Collabora editor should appear inline. Invite a second user to the same file to validate simultaneous co-editing.

7. 07

   Check memory consumption

   docker stats --no-stream

   The Collabora process consumes around 300 MB at rest and increases with the number of open documents. Watch the MEM USAGE column — if it exceeds 80% of available RAM, consider vertical scaling of the VPS.

Variant: Nextcloud + OnlyOffice Docs

1. 08

   Replace the collabora block with onlyoffice in the Compose file

   In your docker-compose.yml, substitute the collabora service with:

     onlyoffice:
       image: onlyoffice/documentserver:latest
       restart: always
       ports:
         - "8088:80"
       environment:
         JWT_ENABLED: "true"
         JWT_SECRET: ${ONLYOFFICE_JWT_SECRET}
       volumes:
         - onlyoffice_data:/var/www/onlyoffice/Data
         - onlyoffice_logs:/var/log/onlyoffice

   Add ONLYOFFICE_JWT_SECRET to your .env file. The JWT secret is mandatory since OnlyOffice 7.2 to prevent unauthorised access to the document server.

2. 09

   Configure the reverse proxy for OnlyOffice

   OnlyOffice listens on HTTP port 8088. Create an nginx vhost for onlyoffice.your-domain.com → proxy to 127.0.0.1:8088. Add WebSocket directives and the X-Forwarded-Proto https header.

3. 10

   Enable the ONLYOFFICE integration in Nextcloud

   In Nextcloud: Apps → Office & text → ONLYOFFICE → enable.

   Then: Settings → Administration → ONLYOFFICE → enter the URL https://onlyoffice.your-domain.com and the JWT key defined in .env → save.

   Test with a .xlsx file: OnlyOffice should open it in-browser, with co-editing available as soon as a second user joins the document.

4. 11

   Community edition limits

   The free onlyoffice/documentserver image is limited to 20 concurrent connections. For an SMB fleet of fewer than 15 active users, the limit is rarely reached. Beyond that, the Enterprise edition removes this cap.

Advanced configuration: formats, languages and file size limits

docker exec -it nextcloud_nextcloud_1 bash -c \
  'echo "upload_max_filesize = 2G" >> /usr/local/etc/php/conf.d/nextcloud.ini'

Troubleshooting: connection refused, certificates and memory

docker exec nextcloud_nextcloud_1 curl -I https://collabora.your-domain.com

Further reading