Collabora Online: LibreOffice in the Browser

Introduction

Collabora Online is the enterprise-grade, web-based version of LibreOffice, providing powerful document editing capabilities directly in your browser. Unlike cloud-based office suites that require sending your data to third parties, Collabora runs entirely on your infrastructure, giving you complete control over your documents.

What is Collabora Online?

Collabora Online (CODE - Collabora Online Development Edition) brings the full power of LibreOffice to the web. It’s a complete office suite running in your browser, supporting document editing, spreadsheets, presentations, and more. Built on the battle-tested LibreOffice engine, it offers exceptional format compatibility and advanced features.

Why Choose Collabora Online?

LibreOffice Engine Power

Collabora leverages the same rendering engine as LibreOffice Desktop, which means superior handling of complex documents, advanced formatting, and compatibility with legacy document formats. If LibreOffice can open it, Collabora can edit it.

True Open Source Freedom

Unlike ONLYOFFICE which has proprietary components, Collabora is 100% open source under Mozilla Public License v2.0. This means complete transparency, community-driven development, and no vendor lock-in concerns.

Enterprise-Grade Features

Collabora Online CODE includes enterprise features that typically cost thousands annually in commercial solutions:

Real-time collaborative editing
Tracked changes and comments
Advanced document comparison
Macro support (LibreOffice Basic)
Master documents and templates
Mail merge capabilities

Perfect Nextcloud Integration

Developed in close collaboration with Nextcloud, Collabora offers the tightest integration of any office suite. File locking, version control, and user authentication work seamlessly out of the box.

Collabora vs Alternatives

Feature	Collabora	ONLYOFFICE	LibreOffice Online	Google Docs
Format Support	Excellent	Very Good	Excellent	Good
ODF Native	Yes	No	Yes	No
MS Office Compat	Very Good	Excellent	Very Good	Fair
Macro Support	Yes (LibreOffice)	Limited	Yes	Apps Script
Open Source	100%	Partial	100%	No
Resource Usage	Medium	Low	Medium	N/A
Collaboration	Excellent	Excellent	Good	Excellent

Architecture Overview

Understanding Collabora’s architecture:

┌──────────────────────────────────────────┐
│         Users (Web Browsers)             │
└────────────────┬─────────────────────────┘
                 │
          ┌──────▼──────┐
          │Reverse Proxy│ (Nginx/Traefik/Caddy)
          │  + SSL/TLS  │
          └──────┬──────┘
                 │
    ┌────────────┼────────────┐
    │            │            │
┌───▼────┐  ┌───▼────────┐  ┌▼────────┐
│Nextcloud│  │ Collabora  │  │  Other  │
│   or    │  │   Online   │  │Platform │
│ownCloud │  │   (CODE)   │  │         │
└───┬────┘  └────────────┘  └─────────┘
    │
    │
┌───▼─────────┐
│File Storage │
│ (NFS/Local) │
└─────────────┘

Key Components:

Collabora Online (CODE): Document server with LibreOffice engine
WOPI Protocol: Web Application Open Platform Interface for file access
Integration Platform: Nextcloud, ownCloud, or custom WOPI client
Reverse Proxy: HTTPS termination and routing

Prerequisites

Before deploying Collabora Online:

Docker and Docker Compose installed
4GB RAM minimum (8GB recommended for multiple users)
2-4 CPU cores
10GB storage space
Domain name with DNS configured
Reverse proxy (Nginx, Traefik, or Caddy)
Nextcloud or ownCloud instance (recommended)
SSL certificate (Let’s Encrypt recommended)

Basic Deployment: Standalone Collabora

Let’s deploy Collabora Online CODE for homelab use.

Step 1: Create Project Structure

# Create directory
mkdir -p ~/collabora && cd ~/collabora

# Create environment file
cat > .env <<EOF
# Collabora Configuration
DOMAIN=cloud.yourdomain.com
COLLABORA_DOMAIN=office.yourdomain.com

# Allowed domains (Nextcloud/ownCloud domains)
# Use escaped format: cloud\.yourdomain\.com
ALIASGROUP1=cloud\.yourdomain\.com

# Admin credentials for Collabora Admin Console
ADMIN_USERNAME=admin
ADMIN_PASSWORD=your-secure-admin-password

# Security
DONT_GEN_SSL_CERT=true  # We'll use reverse proxy for SSL
EOF

chmod 600 .env

Step 2: Docker Compose Configuration

Create docker-compose.yml:

version: '3.8'

services:
  collabora:
    image: collabora/code:latest
    container_name: collabora-online
    restart: unless-stopped

    environment:
      # Domain configuration
      - aliasgroup1=https://${ALIASGROUP1}:443

      # Server name
      - server_name=${COLLABORA_DOMAIN}

      # Admin console credentials
      - username=${ADMIN_USERNAME}
      - password=${ADMIN_PASSWORD}

      # SSL handling (reverse proxy terminates SSL)
      - extra_params=--o:ssl.enable=false --o:ssl.termination=true

      # Performance and limits
      - DONT_GEN_SSL_CERT=true

    ports:
      - "9980:9980"

    volumes:
      # Optional: custom fonts
      - ./fonts:/usr/share/fonts/truetype/custom:ro

    networks:
      - collabora-net

    cap_add:
      - MLOCK

volumes:
  collabora_data:

networks:
  collabora-net:
    driver: bridge

Step 3: Launch Collabora

# Start Collabora
docker-compose up -d

# Check logs
docker-compose logs -f collabora

# Wait for "Ready to accept connections" message
# This may take 2-3 minutes on first start

# Verify it's running
curl -k https://localhost:9980/hosting/discovery

You should see an XML response with WOPI discovery information.

Production Deployment with Advanced Configuration

For production use with better performance and features:

version: '3.8'

services:
  collabora:
    image: collabora/code:latest
    container_name: collabora-online
    restart: unless-stopped

    environment:
      # Domain whitelist (multiple domains supported)
      - aliasgroup1=https://${ALIASGROUP1}:443
      - aliasgroup2=https://192\.168\.1\..*:443  # Allow local network

      # Server configuration
      - server_name=${COLLABORA_DOMAIN}
      - username=${ADMIN_USERNAME}
      - password=${ADMIN_PASSWORD}

      # SSL configuration for reverse proxy
      - extra_params=--o:ssl.enable=false --o:ssl.termination=true --o:logging.level=warning --o:welcome.enable=false --o:net.frame_ancestors=${DOMAIN}

      # Performance tuning
      - DONT_GEN_SSL_CERT=true

      # Memory limits per document
      - SAL_LOG=-WARN

    ports:
      - "9980:9980"

    volumes:
      # Custom fonts for better document rendering
      - ./fonts:/usr/share/fonts/truetype/custom:ro
      # Persistent configuration
      - collabora_config:/etc/loolwsd

    networks:
      - collabora-net

    # Security capabilities
    cap_add:
      - MLOCK

    # Resource limits
    deploy:
      resources:
        limits:
          memory: 4G
        reservations:
          memory: 2G

    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9980/hosting/discovery"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

volumes:
  collabora_config:

networks:
  collabora-net:
    driver: bridge

Nextcloud Integration

Collabora shines when integrated with Nextcloud. Here’s the complete setup.

Step 1: Install Nextcloud Office App

# Install the Nextcloud Office app (formerly Collabora Online)
docker exec -u www-data nextcloud php occ app:install richdocuments

# Enable the app
docker exec -u www-data nextcloud php occ app:enable richdocuments

Step 2: Configure Collabora in Nextcloud

Via command line:

# Set Collabora server URL
docker exec -u www-data nextcloud php occ config:app:set richdocuments wopi_url --value="https://office.yourdomain.com"

# Disable certificate verification if using self-signed (not recommended for production)
# docker exec -u www-data nextcloud php occ config:app:set richdocuments disable_certificate_verification --value="yes"

# Set allowed domains
docker exec -u www-data nextcloud php occ config:app:set richdocuments public_wopi_url --value="https://office.yourdomain.com"

Via Web UI:

Log into Nextcloud as administrator
Go to Settings → Administration → Office
Enter Collabora server URL: https://office.yourdomain.com
Click Save
You should see a green checkmark indicating successful connection

Step 3: Network Configuration for Docker

If both services run in Docker, ensure they can communicate:

# In Nextcloud docker-compose.yml
networks:
  nextcloud-net:
    driver: bridge

# In Collabora docker-compose.yml
networks:
  collabora-net:
    driver: bridge
  nextcloud-net:
    external: true

services:
  collabora:
    networks:
      - collabora-net
      - nextcloud-net

Complete Nextcloud + Collabora Stack

Here’s a full stack with both services:

version: '3.8'

services:
  # PostgreSQL for Nextcloud
  nextcloud-db:
    image: postgres:15-alpine
    container_name: nextcloud-db
    restart: unless-stopped
    environment:
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=nextcloud
      - POSTGRES_PASSWORD=secure-password
    volumes:
      - nextcloud_db:/var/lib/postgresql/data
    networks:
      - backend

  # Redis for Nextcloud caching
  nextcloud-redis:
    image: redis:7-alpine
    container_name: nextcloud-redis
    restart: unless-stopped
    command: redis-server --requirepass secure-redis-password
    networks:
      - backend

  # Nextcloud application
  nextcloud:
    image: nextcloud:29-fpm-alpine
    container_name: nextcloud-app
    restart: unless-stopped
    depends_on:
      - nextcloud-db
      - nextcloud-redis
    environment:
      - POSTGRES_HOST=nextcloud-db
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=nextcloud
      - POSTGRES_PASSWORD=secure-password
      - REDIS_HOST=nextcloud-redis
      - REDIS_HOST_PASSWORD=secure-redis-password
      - NEXTCLOUD_TRUSTED_DOMAINS=cloud.yourdomain.com
      - TRUSTED_PROXIES=172.18.0.0/16
    volumes:
      - nextcloud_app:/var/www/html
      - nextcloud_data:/var/www/html/data
    networks:
      - backend

  # Nextcloud web server
  nextcloud-web:
    image: nginx:alpine
    container_name: nextcloud-web
    restart: unless-stopped
    depends_on:
      - nextcloud
    volumes:
      - nextcloud_app:/var/www/html:ro
      - ./nextcloud-nginx.conf:/etc/nginx/nginx.conf:ro
    networks:
      - backend
      - frontend
    ports:
      - "8081:80"

  # Collabora Online
  collabora:
    image: collabora/code:latest
    container_name: collabora-online
    restart: unless-stopped
    environment:
      - aliasgroup1=https://cloud\.yourdomain\.com:443
      - server_name=office.yourdomain.com
      - username=admin
      - password=secure-admin-password
      - extra_params=--o:ssl.enable=false --o:ssl.termination=true --o:welcome.enable=false
      - DONT_GEN_SSL_CERT=true
    ports:
      - "9980:9980"
    networks:
      - backend
      - frontend
    cap_add:
      - MLOCK

volumes:
  nextcloud_db:
  nextcloud_app:
  nextcloud_data:

networks:
  frontend:
    driver: bridge
  backend:
    driver: bridge

Reverse Proxy Configuration

Collabora requires specific reverse proxy configuration for WebSocket support.

Nginx Configuration

# /etc/nginx/sites-available/collabora.conf

server {
    listen 443 ssl http2;
    server_name office.yourdomain.com;

    # SSL Configuration
    ssl_certificate /etc/letsencrypt/live/office.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/office.yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Static files
    location ^~ /browser {
        proxy_pass http://localhost:9980;
        proxy_set_header Host $host;
    }

    # WOPI endpoint
    location ^~ /hosting/discovery {
        proxy_pass http://localhost:9980;
        proxy_set_header Host $host;
    }

    # Capabilities
    location ^~ /hosting/capabilities {
        proxy_pass http://localhost:9980;
        proxy_set_header Host $host;
    }

    # Main websocket
    location ~ ^/cool/(.*)/ws$ {
        proxy_pass http://localhost:9980;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 36000s;
    }

    # Download and thumbnails
    location ~ ^/(c|l)ool {
        proxy_pass http://localhost:9980;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Admin Console websocket
    location ^~ /cool/adminws {
        proxy_pass http://localhost:9980;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_read_timeout 36000s;
    }
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name office.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

Traefik Configuration (Labels)

services:
  collabora:
    labels:
      - "traefik.enable=true"

      # Router configuration
      - "traefik.http.routers.collabora.rule=Host(`office.yourdomain.com`)"
      - "traefik.http.routers.collabora.entrypoints=websecure"
      - "traefik.http.routers.collabora.tls.certresolver=letsencrypt"

      # Service configuration
      - "traefik.http.services.collabora.loadbalancer.server.port=9980"
      - "traefik.http.services.collabora.loadbalancer.server.scheme=http"

      # Middleware for headers
      - "traefik.http.middlewares.collabora-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.collabora-headers.headers.customresponseheaders.X-Frame-Options=SAMEORIGIN"

      # Apply middleware
      - "traefik.http.routers.collabora.middlewares=collabora-headers"

Caddy Configuration

office.yourdomain.com {
    reverse_proxy localhost:9980 {
        transport http {
            # Enable websocket support
            compression off
        }
    }
}

Performance Tuning

Optimize Collabora for your homelab workload.

Memory and Process Configuration

Create a custom configuration:

# Enter the container
docker exec -it collabora-online bash

# Edit configuration
vi /etc/loolwsd/loolwsd.xml

Key settings to adjust:

<loolwsd>
    <!-- Memory per document (in MB) -->
    <per_document>
        <max_concurrency desc="Max concurrent connections per document" type="uint" default="4">8</max_concurrency>
        <idle_timeout_secs desc="Idle timeout in seconds" type="uint" default="3600">7200</idle_timeout_secs>
        <mem_stats_size desc="Memory statistics size" type="uint" default="8192">16384</mem_stats_size>
    </per_document>

    <!-- Overall limits -->
    <per_view>
        <out_of_focus_timeout_secs desc="Timeout for inactive views" type="uint" default="120">300</out_of_focus_timeout_secs>
        <idle_timeout_secs desc="Idle timeout" type="uint" default="900">1800</idle_timeout_secs>
    </per_view>

    <!-- File size limits -->
    <file_size_limit desc="Maximum document size in MB" type="uint" default="100">200</file_size_limit>
</loolwsd>

Or use environment variables in docker-compose.yml:

environment:
  - extra_params=--o:per_document.max_concurrency=8 --o:per_document.idle_timeout_secs=7200 --o:file_size_limit_mb=200

CPU and Concurrent User Optimization

environment:
  # Adjust based on your CPU cores (recommended: cores - 1)
  - extra_params=--o:num_prespawn_children=4 --o:per_document.max_concurrency=8 --o:child_root_path=/opt/cool/child-roots

Font Installation

Add custom fonts for better document compatibility:

# Create fonts directory
mkdir -p ./fonts

# Copy TTF fonts
# Example: Microsoft fonts, Liberation fonts, etc.
cp /path/to/fonts/*.ttf ./fonts/

# Update docker-compose.yml
volumes:
  - ./fonts:/usr/share/fonts/truetype/custom:ro

# Restart and rebuild font cache
docker-compose restart collabora
docker exec collabora-online fc-cache -f -v

Monitoring and Administration

Admin Console

Access the Collabora Admin Console at:

https://office.yourdomain.com/browser/dist/admin/admin.html

Admin Console Features:

Real-time connection monitoring
Document statistics
Memory usage graphs
Active users and documents
Server configuration
Log viewer

Health Monitoring

# Check discovery endpoint
curl -k https://office.yourdomain.com/hosting/discovery

# Check capabilities
curl -k https://office.yourdomain.com/hosting/capabilities

# View logs
docker-compose logs -f collabora

# Monitor resource usage
docker stats collabora-online

Log Management

# View all logs
docker exec collabora-online tail -f /var/log/loolwsd.log

# Filter error logs
docker exec collabora-online grep ERROR /var/log/loolwsd.log

# Log rotation is handled automatically
# To force log rotation:
docker exec collabora-online kill -HUP 1

Security Best Practices

Restrict Access by Domain

environment:
  # Only allow specific domains
  - aliasgroup1=https://cloud\.yourdomain\.com:443
  - aliasgroup2=https://trusted\.example\.com:443

  # Deny all others
  - extra_params=--o:net.frame_ancestors=cloud.yourdomain.com,trusted.example.com

Enable Logging and Auditing

environment:
  - extra_params=--o:logging.level=information --o:logging.file[@enable]=true --o:logging.file.property[@name]=/var/log/loolwsd.log

Regular Updates

# Check current version
docker exec collabora-online coolwsd --version

# Update to latest
docker-compose pull collabora
docker-compose up -d collabora

# Verify new version
docker exec collabora-online coolwsd --version

Firewall Configuration

# Allow only reverse proxy to access Collabora
sudo ufw allow from 172.18.0.0/16 to any port 9980

# Or if behind reverse proxy, deny direct access
sudo ufw deny 9980

Advanced Features

Multi-Tenant Setup

Run multiple Collabora instances for different organizations:

services:
  collabora-tenant1:
    image: collabora/code:latest
    container_name: collabora-tenant1
    environment:
      - aliasgroup1=https://tenant1\.yourdomain\.com:443
    ports:
      - "9981:9980"

  collabora-tenant2:
    image: collabora/code:latest
    container_name: collabora-tenant2
    environment:
      - aliasgroup1=https://tenant2\.yourdomain\.com:443
    ports:
      - "9982:9980"

Custom Branding

# Mount custom images
volumes:
  - ./branding/logo.svg:/usr/share/loolwsd/loleaflet/dist/images/custom-logo.svg
  - ./branding/favicon.ico:/usr/share/loolwsd/favicon.ico

Integration with Other Platforms

Collabora works with any WOPI-compatible platform:

ownCloud: Install “Collabora Online” app
Seafile: Configure via Admin panel
Custom Integration: Use WOPI protocol

Example custom WOPI integration URL:

https://office.yourdomain.com/browser/UNIQUE_ID/cool.html?WOPISrc=https://your-app.com/wopi/files/FILE_ID

Troubleshooting

Issue: “Connection Failed” in Nextcloud

# Check Collabora is accessible from Nextcloud
docker exec nextcloud-app curl -k https://office.yourdomain.com/hosting/discovery

# Verify domain whitelist
docker exec collabora-online grep aliasgroup /etc/loolwsd/loolwsd.xml

# Check logs for errors
docker-compose logs collabora | grep -i error

Issue: Documents Load Slowly

# Increase prespawn children
# Edit docker-compose.yml:
environment:
  - extra_params=--o:num_prespawn_children=6

# Allocate more memory
deploy:
  resources:
    limits:
      memory: 6G

# Restart
docker-compose restart collabora

Issue: WebSocket Connection Failed

This indicates reverse proxy misconfiguration:

# For Nginx, ensure websocket upgrade headers are set
# Check nginx configuration includes:
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";

# Test WebSocket from browser console:
# Open Nextcloud document, check browser developer tools Network tab
# Look for ws:// or wss:// connections with status 101 (Switching Protocols)

Issue: Fonts Missing or Document Looks Wrong

# Install Microsoft fonts (if licensed)
mkdir -p ./fonts
# Copy .ttf files to ./fonts/

# Or install Liberation fonts
docker exec collabora-online apt-get update
docker exec collabora-online apt-get install -y fonts-liberation

# Rebuild font cache
docker exec collabora-online fc-cache -f -v
docker-compose restart collabora

Issue: High Memory Usage

# Set memory limits per document
environment:
  - extra_params=--o:per_document.limit_virt_mem_mb=3072 --o:per_document.limit_stack_mem_kb=8192

# Limit total children
  - extra_params=--o:num_prespawn_children=2 --o:per_document.max_concurrency=4

# Enable automatic cleanup
  - extra_params=--o:per_document.idle_timeout_secs=3600

Backup and Recovery

Backup Strategy

# Backup configuration
docker exec collabora-online tar czf /tmp/collabora-config.tar.gz /etc/loolwsd
docker cp collabora-online:/tmp/collabora-config.tar.gz ./backups/

# Backup custom fonts
tar czf backups/collabora-fonts-$(date +%Y%m%d).tar.gz fonts/

# Automated backup script
cat > ~/collabora-backup.sh <<'EOF'
#!/bin/bash
BACKUP_DIR="/mnt/backups/collabora"
DATE=$(date +%Y%m%d_%H%M%S)

docker exec collabora-online tar czf /tmp/config-$DATE.tar.gz /etc/loolwsd
docker cp collabora-online:/tmp/config-$DATE.tar.gz $BACKUP_DIR/

# Remove backups older than 30 days
find $BACKUP_DIR -name "*.tar.gz" -mtime +30 -delete
EOF

chmod +x ~/collabora-backup.sh

Conclusion

You now have a fully functional Collabora Online deployment providing:

Full LibreOffice compatibility in the browser
Real-time collaborative document editing
Seamless Nextcloud integration
Enterprise-grade security and performance
Complete data sovereignty

Next Steps

Install mobile apps for remote document access
Configure custom fonts for better rendering
Set up monitoring with Prometheus
Implement automated backups
Explore advanced collaboration features

Resources

Your self-hosted LibreOffice suite is ready for production use!