Deployment Overview of Onlyoffice Workspace on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the following requirements must be met:

Operating System: Debian (specifically Bookworm is supported).
Privileges: Root or sudo access is required for package installation and Docker configuration.
System Configuration: The system must have vsyscall=emulate set in the GRUB command line (GRUB_CMDLINE_LINUX_DEFAULT) to ensure compatibility with certain containerized services.
Network/Ports:
Port 80: HTTP (used for redirection and Let's Encrypt challenges).
Port 443: HTTPS (main application access).
Port 25, 143, 587: Mail server communication.

The application uses a dynamic Fully Qualified Domain Name (FQDN) based on the server ID and a specific prefix.

Parameter	Value
Prefix	`only-docwork`
Domain	`hostkey.in`
Full template	`only-docwork{Server_ID}.hostkey.in`

The deployment utilizes several specific directories for configuration, data persistence, and SSL management:

/opt/Docker-CommunityServer: Contains the application source files, Docker Compose configurations, and database initialization scripts.
/root/nginx: Stores the Nginx reverse proxy configuration and compose files.
/data/nginx/user_conf.d: Location for custom Nginx virtual host configurations.
/etc/letsencrypt: Managed directory for SSL certificates (via a Docker volume).

The installation is performed using a multi-step process involving package management, repository configuration, and container orchestration:

System Preparation: The system updates the package cache and installs essential utilities including git, curl, and ca-certificates.
Docker Engine Installation: If Docker is not present, the installer adds the official Docker GPG key and repository, then installs docker-ce, docker-ce-cli, containerd.io, docker-buildx-plugin, and docker-compose-plugin.
Source Retrieval: The application source code is cloned from the official GitHub repository into /opt/Docker-CommunityServer at a specific version tag.
Configuration Setup:
A docker-compose.yml file is generated in the application directory.
A MySQL initialization script (onlyoffice-initdb.sql) is placed in the container's entrypoint directory to pre-configure databases and users.
Container Orchestration: The deployment uses Docker Compose to pull images and start the service stack.

Security is enforced through several mechanisms:

Database Security: Custom SQL scripts are used to create specific users (onlyoffice_user, mail_admin) with restricted privileges, moving away from default root access where possible.
JWT Authentication: JSON Web Tokens (JWT) are enabled for the Document Server to secure communication between components using a unique secret key.
SSL/TLS: An Nginx reverse proxy handles SSL termination using certificates obtained via Certbot.
Network Isolation: All application containers are placed within a dedicated Docker network named onlyoffice.

The deployment includes an integrated MySQL database service to manage all workspace data.

Database Name	Purpose
`onlyoffice`	Core application and Document Server data
`onlyoffice_mailserver`	Mail server specific data

Connection Method: Containers communicate via the internal Docker network using the hostname onlyoffice-mysql-server.
Storage Location: Data is persisted in a Docker volume named mysql_data.

The application is composed of several interconnected containers:

Container Name	Image	Purpose	Restart Policy
`onlyoffice-mysql-server`	`mysql:<version>`	Database management	always
`onlyoffice-community-server`	`onlyoffice/communityserver:<tag>`	Main workspace application	always
`onlyoffice-elasticsearch`	`onlyoffice/elasticsearch:<tag>`	Search and indexing	always
`onlyoffice-document-server`	`onlyoffice/documentserver:<tag>`	Document editing engine	always
`onlyoffice-mail-server`	`onlyoffice/mailserver:<tag>`	Email services	always
`onlyoffice-control-panel`	`onlyoffice/controlpanel:<tag>`	Administrative interface	always

The deployment includes specific initialization actions:

Database Initialization: A custom SQL script (onlyoffice-initdb.sql) is injected into the MySQL container to automate the creation of databases, users, and permission grants during the first boot.
Nginx Configuration Generation: A template-based configuration is generated for Nginx to handle proxying requests from the public FQDN to the internal onlyoffice-community-server on port 80.

To update the main application, follow these steps:

Pull the latest images and restart the services:

docker compose pull && docker compose up -d

Component	Path / Volume Name
Docker Compose File	`/opt/Docker-CommunityServer/docker-compose.yml`
Nginx Configs	`/data/nginx/user_conf.d/`
MySQL Data	`mysql_data` (Docker Volume)
Community Server Data	`community_data` (Docker Volume)
Document Server Data	`document_data` (Docker Volume)

The application is managed via Docker Compose from the /opt/Docker-CommunityServer directory: