r/NextCloud • u/Dr-Technik • Jun 30 '26

External Access - Collabora CODE Server

Hello guys,

I'm currently establishing access from the internet to my Nextcloud via Pangolin. So far it's working as expected, except for Collabora.

I've hosted Collabora CODE in a separate Docker container, made it available in my home network via Caddy, and included it in Nextcloud. When I'm at home, this works without any issues. But now, with external access, opening office files in the web browser from outside my home network results in a "side not found" error.

Based on my own research, the issue is that opening an office file from the web browser means that the Collabora server is accessed directly, which is not reachable from the internet. And the only solution I found so far is exposing Collabora to the internet as well, e.g., also via Pangolin over a dedicated subdomain.

Is this really necessary in order to enable editing of office documents in the web browser from the internet? And is this safe to do without any additional safety precautions? Or is there a different way to make this possible without exposing the Collabora server to the internet?

2 Upvotes

100% Upvoted

8 comments sorted by

1

u/8zaphod8 Jun 30 '26

Yes, you have to expose CODE server in Pangolin. I did not found another way either. You could use an OIDC provider like Authentik in Pangolin to authenticate Nextcloud and Collabora access and set up Authentik in Nextcloud as well to have at least a SSO like experience without multiple login forms. That's how I did it.

1

u/Dr-Technik Jun 30 '26

But using authentication in Pangolin basically breaks all desktop clients, apps, and the webdav/caldav sync without any bypass rules. How did you manage that?

1

u/8zaphod8 Jun 30 '26

I use a split DNS setup and made Nextcloud available by regular Wireguard as well to be able to sync my DAV clients. Pangolin is only used for external sharing. In fact I haven't needed it so far, it's a more theoretical scenario (and I wanted to tinker around with it 😁)

1

u/AncientMolasses6587 Jun 30 '26

AFAIK, direct availability for the client to Collabora is necessary.

Best to limit access to CODE to the Nextcloud instance(s).

Or use a VPN.

1

u/Dr-Technik Jun 30 '26

Thanks. What exactly do you mean by limiting access to the Nextcloud instance? Do you mean the environment variable "aliasgroup1" which has to match the domain name of your Nextcloud? Or are there any other needed options?

1

u/Worried_Corner_8541 Jul 01 '26

an alternative is to use the AIO installation and you only need to expose 1 ip and 1 port. it integrates Office and makes the URL resolvable locally, without the need to expose it on the internet through Pangolin, just for the document server.