Deploy the redis container

To deploy the onlyoffice container for nextcloud, you first need to deploy the redis container:

docker run --name redis -d --restart=always --net=public-net -p 6379:6379 redis

Create bridge

It is recommended to develop a good habit: when deploying containers, whether useful or not, it is best to add the --net parameter and use the same pre-defined non-default bridge, so that you can call them by container name when needed. Since a bridge named public-net will be used below, it needs to be created in advance:

docker network create public-net

Deploy the onlyoffice container

The command is as follows

docker run --name onlyoffice -d --restart=always --net=public-net \
    -p 9020:80 \
    -p 9023:443 \
    -e JWT_SECRET=xxxxxxxxxxxxxxx \  
    -e REDIS_SERVER_HOST=redis \
    -e REDIS_SERVER_PORT=6379 \
    -v /docker/onlyoffice/logs:/var/log/onlyoffice \
    -v /docker/onlyoffice/data:/var/www/onlyoffice/Data \
    -v /docker/onlyoffice/lib:/var/lib/onlyoffice \
    -v /docker/onlyoffice/db:/var/lib/postgresql \
    -v /docker/onlyoffice/redis:/var/lib/redis \
    onlyoffice/documentserver

Parameter explanation:
-p 9020:80 -p 9023:443
Ports 9020 and 9023 correspond to ports 80 and 443 inside the container respectively. Please adjust them according to your actual deployment environment.
-e JWT_SECRET
is used to specify a fixed secret. If this environment variable is not specified, the secret will be regenerated every time Docker restarts, which will cause an error:

Then you will need to go to the following location inside the onlyoffice container to check:

cat etc/onlyoffice/documentserver/local.json

secret": {
        "inbox": {
          "string": "YOURTOKEN"
        },
        "outbox": {
          "string": "YOURTOKEN"
        },
        "session": {
          "string": "YOURTOKEN"
        }

This is very inconvenient, so it is highly recommended to specify a fixed value yourself.
-e REDIS_SERVER_HOST=redis
-e REDIS_SERVER_PORT=6379
Specifies the address and port of the Redis server. Since Redis and OnlyOffice belong to the same non-default bridge "public-net", they can communicate directly using container names; otherwise, the --link parameter would be required.

Note: When building a container environment, it is recommended to plan the locations of all container mount folders in advance. In my case, the mount folders for all containers are under the /docker folder, with one folder per container, such as /docker/onlyoffice/, followed by the corresponding mount folders for that container. Developing this good habit makes later maintenance much easier, and when migrating to a new container environment to recreate the corresponding containers, you don't even need to change the mount paths, which is incredibly convenient.

After deploying the onlyoffice container, the example is not enabled by default. You need to execute:

docker exec onlyoffice sudo supervisorctl start ds:example

Then you can access:http://x.x.x.x:9020:example
Assuming x.x.x.x is the intranet IP address of your container host, the page is as follows:

If you want this page to start automatically every time the container restarts, you need to execute:

docker exec onlyoffice sudo sed 's,autostart=false,autostart=true,' -i /etc/supervisor/conf.d/ds-example.conf

Configure Nextcloud

Next is the configuration in Nextcloud (the OnlyOffice plugin needs to be installed in advance):

The situation here is relatively complex, and depending on whether the client accesses purely via the intranet or needs to access from the extranet, and whether it is via HTTP or HTTPS, it is divided into 2 main scenarios:

Both Nextcloud and OnlyOffice are only on the intranet, and the client browser accesses via HTTP

If it is pure intranet access via HTTP, it is the simplest. Directly fill in the "ONLYOFFICE Docs address for internal requests from the server" option under "Advanced settings" in the bottom right of the image above:http://x.x.x.x:9020 to specify the intranet IP or intranet domain name of OnlyOffice, and then fill in the "Server address for internal requests from ONLYOFFICE Docs" option:http://x.x.x.x:9010to specify the intranet IP or intranet domain name of Nextcloud (assuming 9010 is the mapped port of the Nextcloud host).

Both Nextcloud and OnlyOffice are deployed on the public network, and the client browser accesses via HTTPS

In this case, while ensuring that OnlyOffice can normally open the example page through the public domain name, you only need to fill in the corresponding OnlyOffice address in the first red box "ONLYOFFICE Docs" in the upper right of the image above,https://公网域名 and then fill in the custom secret you created earlier when setting up the container in the "Secret key" field below.

Note: If Nextcloud is accessed using HTTPS, OnlyOffice must also be configured with HTTPS, which is why port 9023 is mapped when creating the OnlyOffice container. If OnlyOffice is used in conjunction with a reverse proxy, the reverse proxy for the public domain name corresponding to OnlyOffice must use HTTPS and point to the HTTPS port when specifying the upstream server's target URL. In this example, it points tohttps://x.x.x.x:9023。

When creating the OnlyOffice container, we made the following directory -v mounts:
-v /docker/onlyoffice/data:/var/www/onlyoffice/Data

This data directory is used to store the SSL certificates corresponding to the OnlyOffice public domain name. Create a certs directory inside data, then rename the SSL certificates (crt, key) corresponding to the OnlyOffice domain name to onlyoffice.crt and onlyoffice.key, place them in this directory, and restart the OnlyOffice container.

After saving, if the following content appears on the OnlyOffice page in Nextcloud, it is successful:

This method completes the deployment of Nextcloud and OnlyOffice in the same container environment. There is no need to set up a separate server with a public IP address to build the OnlyOffice container like some users do. Simply put, you just build both the OnlyOffice and Nextcloud containers in an intranet environment, and then configure the egress accordingly.

In addition, there may be many other different deployment scenarios, such as Nextcloud and OnlyOffice being in the intranet, public network, or behind a reverse proxy respectively. You can analyze and handle them according to your actual situation.