Euro Office

September 24, 2026

About Euro-Office

Euro-Office is a fork of the ONLYOFFICE Document Server and is the component that provides browser-based editing of office documents stored in Nextcloud. It provides the document editing interface and handles formats such as word-processing documents, spreadsheets, and presentations.

Euro-Office does not have separate file-storage. Nextcloud remains responsible for file storage, sharing, permissions, and user authentication. When a supported document is opened in Nextcloud, the Nextcloud ONLYOFFICE integration app communicates with Euro-Office to establish an editing session. Euro-Office retrieves the document through Nextcloud, provides the browser-based editor, and sends changes back to Nextcloud for storage.

Deployment

Euro-Office runs on a dedicated server euroffice001 as a rootless Podman container under a dedicated euro-office system user. The container is managed by systemd using Podman Quadlet.

The Quadlet definition is installed at:

/home/euro-office/.config/containers/systemd/euro-office.container

Normal systemd tools can be used to manage and troubleshoot Euro-Office

euro-office@eurooffice001:~$ systemctl --user status euro-office.service

euro-office@eurooffice001:~$ systemctl --user stop euro-office.service

euro-office@eurooffice001:~$ systemctl --user start euro-office.service

euro-office@eurooffice001:~$ journalctl --user -u euro-office.service

Persistent files and custom fonts

Host-side files needed by the container are kept beneath:

/home/euro-office/files/

The role currently creates a dedicated fonts directory and installs two additional font families there:

/home/euro-office/files/fonts/
├── OpenDyslexic-*.otf
└── Calibri-*.ttf

These are unpacked from files distributed with the Ansible role. The Quadlet configuration can then make these fonts available to Document Server independently of the container image.

Network architecture

An nginx instance runs directly on the host vps and acts as the reverse proxy in front of the Euro-Office service.

Nextcloud / user's browser
          │
        HTTPS
          │
          ▼
   Host nginx
          │
     reverse proxy
          │
          ▼
  Euro-Office Podman
      container
          │
          ▼
Euro-Office Document Server

The Ansible role builds the nginx configuration from several templates:

/etc/nginx/sites-enabled/http-proxy.conf
/etc/nginx/sites-enabled/https-proxy.conf
/etc/nginx/snippets/tls-settings.conf
/etc/nginx/conf.d/euro-office-headers.conf

The euro-office-headers.conf file is particularly relevant to Document Server because the application needs the reverse proxy to preserve the appropriate request information. When troubleshooting proxy, WebSocket, forwarding-header, or client-address problems, that template and the HTTPS proxy template are good places to inspect.

TLS certificates

Public TLS termination is also handled by the host nginx instance rather than inside the container. Certificates are obtained from Let’s Encrypt using Certbot and the HTTP webroot challenge, Subsequent certificate renewal is left to the normal Certbot renewal mechanism and a custom LE deployment hook reestarts nginx.

Operational model

Nextcloud integration — Nextcloud’s ONLYOFFICE app tells Nextcloud how to use the Euro-Office service.
nginx and TLS — the eurooffice001.mayfirst.org host provides the public HTTPS endpoint, proxy configuration, headers, and Let’s Encrypt certificate management.
rootless Podman + systemd — the Document Server container runs as the unprivileged euro-office user and is managed through that user’s systemd instance using Quadlet.
Euro-Office Document Server — the application inside the container performs the actual rendering and collaborative editing of documents.

Ansible prepares the deployment by installing the host dependencies, dedicated service account, persistent/custom files, Quadlet configuration, nginx reverse proxy, and TLS setup. The intention is that the application remains containerized and relatively disposable, while host-specific configuration and customizations live outside the container and the complete deployment can be reproduced from the Ansible role.

Status

We can run a status check with https://eurooffice001.mayfirst.org/healthcheck which should return a single string ’true'

Upgrading Euro-Office

Preparing for update

It is unclear from the documentation if this step is still necessary or if a normal container shutdown does the same but the prepare4shutdown.sh helper script is intended to prepare the service for a graceful shutdown and avoid killing Document Server while it still has active document-editing work.

euro-office@eurooffice001:~$ podman exec -it euro-office /bin/documentserver-prepare4shutdown.sh

Manual update

You can update Euro-Office manually by pulling in a new version of the container image and restarting the systemd service.

euro-office@eurooffice001:~$ podman pull ghcr.io/euro-office/documentserver:latest

euro-office@eurooffice001:~$ systemctl --user restart euro-office.service

Notes

We should consider replacing ONLYOFFICE integration app with dedicated Euro-Office inegration app

We can enable automatic or semi-automatic Euro-Office container updates with podman quadlet auto-update mechanism.

We could disable direct public access to https://eurooffice001.mayfirst.org info page since our members don’t need to see that an we don’t need to expose it publicly.