View source for NextCloud: Install Collabora

This tutorial is going to show you how to install Collabora Online on Ubuntu and then integrate it with an existing Nextcloud server without using Docker.

'''Collabora Online''' is a self-hostable and LibreOffice-based open-source online office suite. Its features include:

* Basic editing
* High fidelity, WYSIWYG rendering
* Supports DOC, DOCX, PPT, PPTX, XLS, XLSX, ODF document format
* Import and view Visio, Publisher and 100+ more
* Shared Editing

Collabora is a big contributor to the LibreOffice project. All of the Collabora Online codes will be eventually included in LibreOffice.

== Step 1: Install Collabora Online on Ubuntu From the Official Repository ==
Collabora has an official package repository for Ubuntu 22.04, 20.04 and 18.04. Run the following command to add it to your Ubuntu system.

'''Ubuntu 22.04'''

 echo 'deb <nowiki>https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-ubuntu2204</nowiki> ./' | sudo tee /etc/apt/sources.list.d/collabora.list

'''Ubuntu 20.04'''

 echo 'deb <nowiki>https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-ubuntu2004</nowiki> ./' | sudo tee /etc/apt/sources.list.d/collabora.list

'''Ubuntu 18.04'''

 echo 'deb <nowiki>https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-ubuntu1804</nowiki> ./' | sudo tee /etc/apt/sources.list.d/collabora.list

Then run the following command to download and import Collabora public key, which allows APT package manager to verify the integrity of packages downloaded from this repository.

 sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0C54D189F4BA284D

If you can’t import the public key with the above command, you can use the following command to download and import the key.

 wget <nowiki>https://www.collaboraoffice.com/repos/CollaboraOnline/CODE-centos7/repodata/repomd.xml.key</nowiki> && sudo apt-key add repomd.xml.key

Since this repository uses HTTPS connection, we need to install the <code>apt-transport-https</code> and <code>ca-certificates</code> package, so the APT package manager can establish secure connection to the repository.

 sudo apt install apt-transport-https ca-certificates

Now update local package index and install Collabora Online. '''coolwsd''' is the Collabora Online WebSocket Daemon.

 sudo apt update
 sudo apt install coolwsd code-brand

== Step 2: Configure Collabora Online WebSocket Daemon ==
After they are installed, you can check the status of coolwsd.

 systemctl status coolwsd

As you can see, it failed to start. We can check the journal to see why this happened.

 sudo journalctl -eu coolwsd

Sample output:
 Apr 21 16:13:06 ubuntu coolwsd[13842]: **File not found: /etc/coolwsd/ca-chain.cert.pem**
 Apr 21 16:13:06 ubuntu systemd[1]: coolwsd.service: Main process exited, code=exited, status
 Apr 21 16:13:06 ubuntu systemd[1]: coolwsd.service: Failed with result 'exit-code'.
 Apr 21 16:13:07 ubuntu systemd[1]: coolwsd.service: Service hold-off time over, scheduling r
 Apr 21 16:13:07 ubuntu systemd[1]: coolwsd.service: Scheduled restart job, restart counter i
 Apr 21 16:13:07 ubuntu systemd[1]: Stopped LibreOffice Online WebSocket Daemon.
 Apr 21 16:13:07 ubuntu systemd[1]: coolwsd.service: Start request repeated too quickly.
 Apr 21 16:13:07 ubuntu systemd[1]: coolwsd.service: Failed with result 'exit-code'.
 Apr 21 16:13:07 ubuntu systemd[1]: Failed to start LibreOffice Online WebSocket Daemon.

By default, coolwsd enables TLS connection. However, it didn’t find a TLS certificate file, hence the start failure. It’s better to disable TLS in coolwsd and terminate TLS at a reverse proxy. The coolwsd configuration file is located at <code>/etc/coolwsd/coolwsd.xml</code>. However, it’s an XML file, which is not easy to read and edit. We can use the <code>coolconfig</code> tool to change configurations.

Run the following command to disable TLS in coolwsd.

 sudo coolconfig set ssl.enable false

And enable TLS termination at the reverse proxy.

 sudo coolconfig set ssl.termination true

By default, coolwsd only allows known hosts to access its service. To allow Nextcloud to access the service, run the following command to add your Nextcloud hostname to the whitelist.

 sudo coolconfig set storage.wopi.host nextcloud.example.com

You can also enable the admin account for coolwsd with the following command. You will need to set a username and password for the admin account.

 sudo coolconfig set-admin-password

Restart coolwsd for the changes to take effect.

 sudo systemctl restart coolwsd

Now it should be running without errors.

 systemctl status coolwsd

== Step 3: Set up Reverse Proxy ==
Nextcloud server requires a TLS certificate on the Collabora Online, so we will need to create a virtual host, give the virtual host a domain name, set up a reverse proxy and install TLS certificate. We can use either '''Apache''' or '''Nginx''' to achieve this.

=== Apache ===
Install Apache web server with the following command:

 sudo apt install apache2

Run the following command to create an Apache virtual host file for Collabora Online.

 sudo vim /etc/apache2/sites-available/collabora.conf

Put the following text into the file. Replace the domain name with your actual domain name for Collabora Online. Don’t forget to create an A record for this sub-domain.

 <VirtualHost *:80>
   ServerName collabora.example.com
   Options -Indexes
 
   ErrorLog "/var/log/apache2/collabora_error"
   # Encoded slashes need to be allowed
   AllowEncodedSlashes NoDecode
 
   # keep the host
   ProxyPreserveHost On
 
   # static html, js, images, etc. served from coolwsd
   # loleaflet/browser is the client part of Collabora Online
   ProxyPass           /loleaflet <nowiki>http://127.0.0.1:9980/loleaflet</nowiki> retry=0
   ProxyPassReverse    /loleaflet <nowiki>http://127.0.0.1:9980/loleaflet</nowiki>
   ProxyPass           /browser <nowiki>http://127.0.0.1:9980/browser</nowiki> retry=0
   ProxyPassReverse    /browser <nowiki>http://127.0.0.1:9980/browser</nowiki>
 
   # WOPI discovery URL
   ProxyPass           /hosting/discovery <nowiki>http://127.0.0.1:9980/hosting/discovery</nowiki> retry=0
   ProxyPassReverse    /hosting/discovery <nowiki>http://127.0.0.1:9980/hosting/discovery</nowiki>
 
   # Capabilities
   ProxyPass           /hosting/capabilities <nowiki>http://127.0.0.1:9980/hosting/capabilities</nowiki> retry=0
   ProxyPassReverse    /hosting/capabilities <nowiki>http://127.0.0.1:9980/hosting/capabilities</nowiki>
 
   # Main websocket
   ProxyPassMatch "/cool/(.*)/ws$" ws://127.0.0.1:9980/cool/$1/ws nocanon
 
   # Admin Console websocket
   ProxyPass   /cool/adminws ws://127.0.0.1:9980/cool/adminws
 
   # Download as, Fullscreen presentation and Image upload operations
   ProxyPass           /cool <nowiki>http://127.0.0.1:9980/cool</nowiki>
   ProxyPassReverse    /cool <nowiki>http://127.0.0.1:9980/cool</nowiki>
 
 </VirtualHost>

Save and close the file. To be able to proxy traffic using Apache, we need to enable some Apache modules.

 sudo a2enmod proxy proxy_wstunnel proxy_http

Enable this virtual host with the following command:

 sudo a2ensite collabora.conf

Then restart Apache.

 sudo systemctl restart apache2

=== Nginx ===
Install Nginx on Ubuntu with the following command:

 sudo apt install nginx

Create a virtual host file for Collabora Online.

 sudo nano /etc/nginx/conf.d/collabora.conf

Put the following text into the file. Replace the domain name with your actual domain name for Collabora Online. Don’t forget to create an A record for this domain name.
 server {
     listen 80;
     listen [::]:80;
     server_name  collabora.example.com;
 
     error_log /var/log/nginx/collabora.error;
 
    # static files
     location ^~ /browser {
         proxy_pass <nowiki>http://localhost:9980</nowiki>;
         proxy_set_header Host $http_host;
     }
     location ^~ /loleaflet {
         proxy_pass <nowiki>http://localhost:9980</nowiki>;
         proxy_set_header Host $http_host;
     }
 
 
     # WOPI discovery URL
     location ^~ /hosting/discovery {
         proxy_pass <nowiki>http://localhost:9980</nowiki>;
         proxy_set_header Host $http_host;
     }
 
     # Capabilities
     location ^~ /hosting/capabilities {
         proxy_pass <nowiki>http://localhost:9980</nowiki>;
         proxy_set_header Host $http_host;
     }
 
     # main websocket
     location ~ ^/cool/(.*)/ws$ {
         proxy_pass <nowiki>http://localhost:9980</nowiki>;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "Upgrade";
         proxy_set_header Host $http_host;
         proxy_read_timeout 36000s;
     }
 
     # download, presentation and image upload
     location ~ ^/(c|l)ool {
         proxy_pass <nowiki>http://localhost:9980</nowiki>;
         proxy_set_header Host $http_host;
     }
 
     # Admin Console websocket
     location ^~ /cool/adminws {
         proxy_pass <nowiki>http://localhost:9980</nowiki>;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "Upgrade";
         proxy_set_header Host $http_host;
         proxy_read_timeout 36000s;
     }
 }

Save and close the file. Then test Nginx configurations.

 sudo nginx -t
If the test is successful, reload Nginx server.

 sudo systemctl reload nginx

== Step 4: Obtain and Install TLS Certificate ==
Now let’s obtain a free TLS certificate from Let’s encrypt. Run the following commands to install Let’s Encrypt client (certbot) from the default software repository.

 sudo apt install certbot

If you use '''Apache''' web server, then you also need to install the Certbot Apache plugin.

 sudo apt install python3-certbot-apache

Then issue the following command to obtain a free TLS/SSL certificate.

 sudo certbot --apache --agree-tos --redirect --hsts --staple-ocsp --email you@example.com -d collabora.example.com

If you use '''Nginx''' web server, then you need to install the Certbot Nginx plugin.

 sudo apt install python3-certbot-nginx

Then use the Nginx plugin to obtain and install the certificate by running the following command.

 sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email you@example.com -d collabora.example.com

You will see the following text indicating that you have successfully obtained a TLS certificate.

== Final Step: Connect Nextcloud to Collabora Online ==
In your Nextcloud dashboard, go to the <code>Apps</code> page (<code><nowiki>https://nextcloud.example.com/settings/apps</nowiki></code>).

Next, go to <code>Office & Text</code> section, find the <code>Nextcloud Office</code> app, and click <code>Download and Enable</code> button. ('''Note''': The <code>Collabora Online</code> app has been renamed to <code>Nextcloud Office</code>.

The coolwsd admin console is available at <code><nowiki>https://collabora.example.com/browser/dist/admin/admin.html</nowiki></code>. You need to enter the username and password, which were created in step 2.

=== Source ===

* github.com
* linuxbabe.com
* collaboraonline.com