An editing service that sits behind a file host
Collabora Online opens text documents, spreadsheets and presentations in the browser and lets several people edit them at once. It does not keep files itself. A host application such as Nextcloud, ownCloud, Moodle or a document management system stores the file, checks permission and hands Collabora a short-lived access token through the WOPI protocol. Collabora loads the document, runs the editing session and saves changes back to the host.
That split shapes the deployment. Storage, sharing, retention and backup belong to the host. Collabora needs compute for open documents, network paths in both directions and an allow list of the hosts it serves. When an editor fails to open, check those three first. Collabora Online is also the web office component of openDesk, the workplace suite run by ZenDiS for the German public sector.
Choose the build before sizing
The server code is open source. The build you run decides how updates and support work.
| Build | Intended use | Deployment note |
|---|---|---|
| CODE (Collabora Online Development Edition) | Testing, home use and small teams. Collabora states it is not recommended for production. | Released about once a month as the collabora/code container image. Useful for a pilot or lab. |
| Collabora Online (supported build) | Production use under a Collabora subscription, with tested updates and security fixes. | Plan access to the supported images or packages, including for isolated networks. |
| Builds supplied through a host vendor | Some file platform vendors include a supported Collabora build in their own subscription. | Confirm who answers a support case: the host vendor, Collabora or both. |
| Source code | The server is licensed under the Mozilla Public License 2.0. | Self-building is allowed. A self-built server carries its own patching and testing burden. |
Trace one document open from end to end
The host reads Collabora's discovery document to learn which file types it can open and which URL to call. If the host cannot reach Collabora, users see no edit option at all, so test discovery from the host's network first.
When a user opens a file, the host issues an access token and passes Collabora the WOPISrc, the URL that identifies the file. The token carries the user's permission. Collabora never sees the user's password.
Collabora calls back to the host with the token to fetch the file. Each document is loaded in its own isolated process, and every participant's browser holds a WebSocket connection to it. Three paths must work: browser to Collabora, Collabora to host, and host to Collabora.
Collabora writes changes back to the host, which records a new version. If saves fail, compare the host's WOPI allow list with Collabora's alias groups and check proxy timeouts first.
Pick a topology that matches the host estate
Collabora is quick to install and sensitive to routing.
Single server
One Collabora server behind the organization's reverse proxy suits a pilot or a modest user base. TLS can end at the proxy with Collabora's SSL termination setting on. Keep it off the file server so a heavy spreadsheet does not slow file sync.
Kubernetes with the official chart
Collabora publishes a Helm chart. Its README calls for ingress rules that hash on the WOPISrc parameter, so everyone editing one document reaches the same pod, and long timeouts for WebSocket connections.
One service, several hosts
One Collabora deployment can serve several WOPI hosts. List each host and its aliases in the alias groups setting. For large estates the chart supports remote configuration, so host lists change without restarting every pod.
Isolated networks
Mirror the images or packages into an internal registry or repository. Install the fonts, dictionaries and templates your documents need, because an air-gapped server cannot fetch them later.
Size for open documents and busy hours
Load follows the number of documents open at once, the people in each and the complexity of the files. A large spreadsheet with many formulas costs far more than a short memo. Conversion work counts too, since hosts that generate previews or PDF exports send those jobs to the same servers.
The Helm chart README gives a production example with considerably more CPU and memory per pod than its defaults, and suggests prespawning child processes (num_prespawn_children) so new documents open quickly. Treat those values as a starting point, measure with a pilot group at a busy hour, then set the replica count.
The README also notes that horizontal pod autoscaling is disabled for now, because scaling can break collaborative editing and copy and paste. Change replica counts on a schedule and let sessions finish before a pod is removed.
Harden the editing path
Each side of the WOPI connection should refuse callers it does not know.
| Control | What to set | How to check |
|---|---|---|
| Allowed hosts | List every WOPI host and alias in Collabora's alias groups, with no patterns that match hosts you do not run. | A request from an unlisted host is refused and logged. |
| Host-side allow list | Restrict WOPI requests on the host to the Collabora server addresses. Nextcloud documents this as the allow list for WOPI requests. | A WOPI call from another address fails while editing still works. |
| TLS and proxy | End TLS at the proxy or on Collabora, set server_name when the public name differs, and match the host's protocol. | Browser, host and Collabora agree on one public URL. |
| Admin console | Limit the admin console to a management network and keep its credentials in the secret store. | The console cannot be reached from the public endpoint. |
Move from another online editor
Teams usually arrive from Microsoft 365 web editing, an earlier office integration in their file platform or desktop-only editing. Files stay in the host, so the move is mostly about rendering and habits. Collect the documents people depend on: complex templates, spreadsheets with macros or external links, and presentations with embedded media. Open each in Collabora and record what changes.
Fonts cause many visible differences, so install the fonts your templates use, or agreed metric-compatible replacements, before the pilot. Decide how to handle files with macros, since macro behavior can differ between office suites. Keep the previous editor available for a set period while owners confirm their key files.
Collabora Online operating ownership
The host team owns files and sharing. The Collabora owner runs the editing service, its routing and its updates.
Service health
- Monitor open documents, memory per process and failed saves.
- Use the chart's optional Prometheus monitors, alert rules and Grafana dashboards.
- Watch the proxy for dropped WebSocket connections.
Change
- Test each release with the host app version you run.
- Keep the CODE pilot and production on separate update schedules.
- Record the previous image tag or package version for rollback.
Security
- Review alias groups when a host is added or retired.
- Rotate admin console credentials.
- Apply security releases within the window your policy sets.
Users
- Publish which file types open in the browser.
- Give people a route to report rendering problems with a sample file.
Collabora Online questions
Do we need to back up Collabora?
Files and versions live in the host, so the host backup covers documents. Back up Collabora's settings, alias groups, TLS material, custom fonts and Helm values, then test that a rebuilt server opens a document.
Can we run CODE in production?
Collabora describes CODE as suited to testing, home use and small teams and does not recommend it for production. Production deployments use the supported build under a subscription.
Why do two editors of one document see different content?
Their sessions probably reached different servers. Route by WOPISrc so everyone editing one file lands on the same server or pod.
Can one Collabora service serve Nextcloud and another host?
Yes, when both hosts are in the alias groups and each host allows the Collabora addresses. Size for the combined busy hour.
Scope and handover
DeployOpen plans the topology, deploys Collabora with your chosen hosts, sets routing and allow lists in both directions, connects monitoring and documents updates. The work changes with the number of hosts, Kubernetes or virtual machine deployment, isolated network needs, document compatibility testing and expected concurrency.
Handover records the public URL, build and version, alias groups, host-side allow lists, proxy and timeout settings, installed fonts, monitoring, the upgrade procedure and the support route. It includes the result of a two-person co-editing test and a test with an unlisted host, so the next operator can see routing and refusal work as intended.
