What the Collabora Online and Wire integration covers in Wire Cells
If your teams want to co-edit documents shared in Wire Cells without leaving Wire's MLS-protected workspace, the integration you need is the one Wire has built around Collabora Online as its document editing layer. Wire Cells uses Collabora Online to bring real-time co-editing into Wire's end-to-end encrypted environment, so the editing experience sits inside the workspace rather than in a separate office suite. Collabora Online is integrated into host platforms through the WOPI protocol, which is the mechanism that lets a host such as Wire hand a document to the editor and receive changes back. Before you scope anything, read the Collabora partner page for Wire to confirm what Wire has documented as supported.
The exact connector, the WOPI configuration values, the supported file types and the steps to point a Wire deployment at a Collabora server come from Wire and Collabora's partner documentation, not from this page. Confirm each of these for the specific Wire version you run, because the integration depends on the version pairing between the two products. Ask Wire and Collabora in writing which components run in your environment, which run in Wire's own hosting, and which settings an administrator must change. Those answers decide where the Collabora servers must sit and which network paths, certificates and access rules your team has to provide.
The decision that matters most is hosting. The Collabora server handles document content during editing, so you need to know whether it runs in your own cloud account, your data center or a Wire-managed environment, and who holds the keys, logs and backups for it. Ask for a written statement of where document data is processed and stored during a co-editing session, and check that answer against your data residency and encryption requirements before you commit. A DeployOpen scope for this work would start from that written answer and the Wire version you run, so the design reflects what the vendors actually support.
Prerequisites for the Collabora Online and Wire integration
Four items decide whether the Wire and Collabora Online integration can be scoped at all: which Wire Cells version you run, which Collabora edition and version you will deploy, how traffic moves between the two, and who holds the accounts that change them. Settle these first, because the sizing and configuration guidance that follows depends on each answer.
Wire Cells version and deployment model
Confirm the Wire Cells release you run and whether it is hosted by Wire or operated in your own infrastructure. The Collabora integration page describes Cells as Wire's MLS-protected workspace with Collabora as its document layer, but the exact configuration steps, supported releases and any component names must come from Wire's documentation for your version. Ask Wire which integration options apply to your deployment model before you commit to a design.
Collabora Online version and edition
Confirm the Collabora Online branch you will run, such as 25.04 or 26.04, and whether it is a supported subscription or the free CODE edition. Collabora describes CODE as suited to testing, home use or small teams and not recommended for production, so a production Wire deployment needs a supported edition. Resource limits and sizing guidance in the Collabora documentation apply only to the version you confirm, so record it before taking any figure from the docs.
Network path between Wire and Collabora
Map every route that document traffic takes between Wire components, the Collabora server and the browsers of users who edit. Identify which hosts initiate connections, which ports are open, and whether any proxy or load balancer sits in between. Editing sessions are long and stateful, so the path must keep all users of one document on the same Collabora instance. Confirm this path with your network team before the design is fixed.
TLS certificates and hostnames
List the public hostnames for the Wire side and the Collabora side, the certificate authority that issues each, and the chain your clients and servers trust. WOPI traffic should run over HTTPS, and the Nextcloud documentation recommends matching the protocol of the host and the editor server, which is a useful baseline when reviewing the Wire setup. Check renewal ownership and whether internal names resolve correctly from every network segment.
Wire and Collabora administrative accounts
Name the people who hold administrative access to Wire Cells, to the Collabora Online server and to the hosting platform beneath both. Record who can change WOPI settings, rotate certificates, apply security updates and open support requests with each vendor. Confirm whether Collabora support is covered by a subscription for your organization, since that affects who can escalate. Unclear ownership of these accounts is a common cause of delayed go-live.
Sizing inputs for the document load
Estimate how many people will co-edit at the same time and which document types they will open, including large spreadsheets and presentations. Collabora's Helm chart notes that replicas are set manually and that scaling must keep all users of one document on one pod, so concurrency shapes the design. Use the resource figures from the Collabora documentation only after the Collabora version is confirmed, and ask Wire how many Cells users share a deployment.
Where the Collabora servers can run in this integration
In this model your team deploys Collabora Online in a cloud account or data center you control, and the Wire workspace calls that server over WOPI. Collabora Online can be deployed from Docker images, system packages or Kubernetes, so the operating model follows the way you already run infrastructure.
- Operation: Your platform or infrastructure team runs the servers, certificates, DNS, load balancing and capacity. Neither Wire nor Collabora operates the servers in this model.
- Patching: Your team applies Collabora Online updates and security fixes. Collabora publishes security advisories for the server, so your change process needs a named owner who watches them.
- Data path: Document content moves between the browser, Wire and your Collabora server. Every hop stays in networks you control, but you still need a written map of which components see decrypted document content.
- Confirm with Wire: The WOPI endpoints and discovery URL Wire requires, how Wire restricts which hosts may call your server, and which Collabora versions Wire supports.
- Confirm with Collabora: Which license tier fits your user count. The Business plan is priced per user for up to 99 users, and Enterprise is quoted for 100 or more. Community CODE is described as not recommended for production.
Before you commit to a hostname, confirm that your sizing and routing design meets the concurrency your Wire users will generate.
In this model a hosting provider runs the Collabora servers on your behalf, in its own facilities or in a cloud account it manages. Your organization keeps the contract and the data relationship, while the provider handles the infrastructure work day to day.
- Operation: The provider runs the servers, but you should confirm who responds to incidents, what hours that covers and how capacity changes are requested.
- Patching: Ask the provider in writing how often it applies Collabora Online updates, how quickly it applies security fixes, and whether it notifies you before and after changes.
- Data path: Document content passes through infrastructure you do not operate. Confirm the hosting location, access controls for support staff, logging, backup locations and any subprocessors involved.
- Confirm with Wire: Whether Wire accepts a Collabora server run by a third party for your tenant, and how the connection to that server is authenticated and restricted.
- Confirm with Collabora: Which support and security update commitments apply to the subscription the provider uses, and whether the provider's arrangement with Collabora affects those commitments.
A written data processing and security responsibilities schedule, covering all five points, should be in place before any document is opened through the service.
In this model the integration vendor chooses where the Collabora servers run, and your organization accepts that placement as part of the service. This option can reduce the number of decisions your team makes, but it also removes control over location and operator unless the contract restores it.
- Operation: Until the operator is named in writing, you cannot know who has administrative access to the servers that handle your documents.
- Patching: Ask who applies Collabora Online security updates, within what period, and how you will receive proof that a fix has been deployed.
- Data path: Without a stated region and cloud provider, you cannot assess data residency, government access exposure or retention for documents edited through the service.
- Change control: Require written notice before placement moves to another region, provider or operator, and a right to object or exit if the new location does not meet your requirements.
- Exit terms: Confirm how document data and cached copies are deleted at the end of the service, and whether the vendor can produce logs for your security or compliance reviews.
Do not accept this option until the location, operator, patch commitments and change notice terms appear in the signed agreement.
How to configure the Collabora Online and Wire integration
This sequence takes a team from confirming the supported versions to co-editing documents in Wire Cells, with the Collabora server running on infrastructure the organization controls. Each step ends with a check that tells you whether the next one can start.
Confirm supported Wire and Collabora versions
Before any installation, the platform owner confirms with Wire which Wire Cells release supports the Collabora Online integration, and which Collabora Online build Wire expects. Ask Wire whether the integration is delivered as a configuration of Wire Cells, as a separate component, or both, and which Collabora packaging (Docker image, system package or Kubernetes) it has been validated against. Record the agreed versions in the change ticket. The step is complete when you have written confirmation from Wire of the supported release pairing, and that record is attached to the project.
Size the Collabora server for the pilot
Decide where the Collabora servers will run and how many users will co-edit at the same time during the pilot. Collabora's Helm chart documentation lists production resource values for Kubernetes pods, but Wire's requirements may differ, so confirm the target sizing with Wire and Collabora before ordering hardware or cloud capacity. Plan for the server to run in infrastructure you control, and note which network zone it sits in relative to Wire Cells. The step is complete when you have a written sizing note and a list of the network paths Wire Cells must reach.
Deploy the Collabora server with TLS
The platform team installs the Collabora Online server on a hostname that Wire Cells can reach, using the packaging approved in the first step. Issue a certificate for that hostname from your internal or public CA, and terminate TLS in front of the server if your chosen deployment requires it. Confirm the discovery endpoint responds over HTTPS from a host inside the Wire Cells network path. Exact installation commands and TLS settings must be taken from the current Collabora Online and Wire documentation. The step is complete when the discovery page loads over HTTPS with a valid certificate chain.
Configure the connection from Wire Cells
The Wire administrator enters the Collabora server address into the Wire Cells configuration so that the workspace can request the editor for supported files. Use the same protocol and hostname that the Collabora discovery endpoint advertises, and confirm that Wire Cells can reach the server through any firewall or proxy between them. Keep the connection on HTTPS. Menu paths and configuration keys must be taken from the current Wire documentation, not from this page. The step is complete when Wire Cells reports a successful connection to the Collabora server and a test document opens in the editor.
Set editing permissions for users and groups
Define which Wire users and groups can open documents in the editor and which can edit them, separate from view-only access. Map these rules to the workspace roles your organization already uses, and document the decision for each group. Test one account from each group with a document it should and should not be able to edit. Confirm how Wire handles permissions on shared documents and whether those rules apply to co-editing sessions. The step is complete when a test matrix shows the expected result for every role and no account can edit beyond its granted rights.
Test each file type your organization uses
Build a test set that includes every document type the organization stores in Wire Cells, such as Word, Excel and PowerPoint files, OpenDocument files, and PDFs where viewing is needed. Open each file in the editor, make a change, and confirm the change saves back to the workspace. Repeat with two users co-editing the same file to check that edits appear for both participants. Compare layout and formulas against the original file. The step is complete when every test file opens, saves and co-edits as expected, and any gaps are logged with owners.
Hand over the configuration for operations
The platform team records the final versions, hostnames, certificate expiry dates, permission matrix and test results in the runbook, and assigns owners for patching and certificate renewal. Ask Wire and Collabora how security advisories and package updates reach your team, and who approves each update before it reaches production. Agree the escalation path for connection failures. The step is complete when the runbook is reviewed by the operations owner and a named person can explain how the server is updated and recovered.
How users, documents and permissions map between Wire and Collabora
This table compares each Wire object with its counterpart on the Collabora Online side, who controls it, and what to confirm before go-live. Neither Wire nor Collabora documents the full mapping publicly, so entries marked to be confirmed need answers from the vendors or a proof of concept in your environment. Read it as a checklist for the design workshop rather than as a finished specification.
| Wire object | Collabora Online side | Who controls it | What to confirm |
|---|---|---|---|
| User identity | The WOPI host passes a user identifier and display name in each request; Collabora uses them for editor presence and edit attribution (to be confirmed for the Wire integration) | Wire identity provider and the WOPI host logic supplied with Wire Cells | How Wire user IDs are passed, whether they are stable across devices, and how guests are represented |
| Conversation or workspace membership | No native Collabora concept of a Wire conversation; access is decided by the host at the moment it issues a WOPI session (to be confirmed) | Wire Cells workspace administrators | Whether membership changes revoke open editing sessions, and how quickly |
| Document identifiers | WOPISrc URL identifies each file to Collabora; the same identifier also drives load balancer routing so co-editors reach the same pod | Wire Cells (document store and file IDs), with routing set by your load balancer | Whether the WOPISrc value is stable for a document, and how file versions and renames are handled |
| View and edit rights | Collabora honors the permissions the WOPI host reports in CheckFileInfo, such as read-only or edit rights (to be confirmed for Wire) | Wire Cells sets the rights; Collabora enforces what the host allows | Which Wire roles map to read-only versus edit, and whether rights are re-checked during an open session |
| Document storage location | Files are read and written by Collabora through WOPI calls to the Wire host; Collabora does not store documents as a separate repository | Your infrastructure, where the Wire Cells backend and the Collabora servers run | Which data center or region holds documents, backups, and temporary files created during editing |
| Access controls on the editor endpoint | Collabora accepts WOPI requests only from configured hosts when a WOPI host allow list and proof keys are set | Your administrators configure Collabora; Wire defines the host address | Which Wire component calls Collabora, its IP addresses, and whether proof key validation is supported |
Where end-to-end encryption ends when documents are co-edited
The MLS protection in Wire Cells covers the messages and collaboration traffic inside Wire's workspace, but it does not automatically extend to the document content once someone opens a file in a browser editor. In a co-editing session, the document is loaded by the Collabora Online server, parsed, and kept in memory so that several people can change it at once. That means the decrypted content is processed on the Collabora server that serves the session, not only on the user's device. Treat that processing point as part of your trust boundary, not as a detail of the Wire client.
Before you choose where the Collabora servers run, get a written answer from both Wire and Collabora to three questions: what exactly is encrypted and by which keys, where decrypted document content is handled during an editing session, and where documents and session artifacts are stored at rest, including any temporary files, caches and logs. Ask Wire how the Cells document flow hands a file to the editor and whether any part of that path leaves the tenant. Ask Collabora which of its server components see document content, how long session state persists, and which logs could contain fragments of content. The Collabora partner page for Wire is the starting point for that conversation, but it does not answer these questions on its own.
These answers should drive placement. If decrypted content is acceptable only inside your own infrastructure, host the Collabora servers in the cloud accounts or data centers you control and confirm that the WOPI connection between the Wire integration and those servers stays inside that boundary. If the written answers show that content handling or storage sits elsewhere, record that as a residual risk for your data classification and decide whether those documents belong in Cells at all. The decision is yours to make, and it should be recorded before the pilot starts.
Security controls for the Collabora Online and Wire integration
Wire Cells brings Collabora Online editing into an end-to-end encrypted workspace, so the security questions sit at the boundary between Wire, the Collabora server and the storage behind it. The controls below are the ones to confirm with Wire and Collabora before any document is opened, and each one names the setting that proves it is in place.
Restrict which hosts can send WOPI requests
A WOPI host is the system that stores documents and asks Collabora Online to open them. Where the host type supports it, limit WOPI traffic to the addresses of the Collabora servers so that other hosts cannot request editing sessions. For the Wire integration, confirm with Wire which hosts and addresses it calls, whether that allow list can be set on the Collabora side, and how it is enforced when Collabora servers are added or moved. The Nextcloud guidance on restricting WOPI requests to Collabora server addresses shows the pattern to ask about.
Use TLS and one protocol on every hop
Document contents, access tokens and editing sessions pass between the browser, Wire, the Collabora server and the WOPI host. Use HTTPS on each hop and keep the same protocol across components, as the Nextcloud guidance recommends for the Collabora server URL. Ask Wire how its Cells service reaches the Collabora server, which certificates it trusts, and whether any internal hop falls back to plain HTTP. A mismatch here often shows up only as broken editing, so test each path with a real document.
Limit who can open and edit
Access rights should follow the rights already set in the workspace. Confirm whether Wire passes the user's identity and permission level into each editing session, and whether a read-only role can be enforced server side and not only hidden in the interface. Nextcloud Office allows administrators to restrict which groups can use the editor and which can edit, and the equivalent group or role mapping should be confirmed for the Wire integration before rollout.
Patch from advisories and verify signed packages
Collabora publishes security advisories for Collabora Online, and the 25.04 release notes record a fix released January 29, 2026, for CVE-2026-23623 along with updated package signing keys for RPM and DEB users. Ask who in the Wire integration is responsible for applying Collabora updates, how quickly they are applied, and how package signatures are checked. Confirm whether the free CODE edition is in use, because Collabora does not recommend it for production, and whether a supported subscription with signed security updates is in place.
Log editing sessions
Editing sessions should leave a trail that shows which user opened which document, when, and from which host. Ask Wire what it records for Cells sessions and whether those records can be sent to your own log store. Then confirm what Collabora Online writes to its own logs, how long they are kept, and whether they include document identifiers without document content. Agree the log fields and retention with your compliance team before go-live, since these logs may themselves contain personal data.
Separate the Collabora server from other workloads
Run the Collabora server on its own host or cluster rather than beside the Wire services or other applications. A separate server limits what a compromise of the editor can reach, makes patching and resource limits easier to control, and keeps document processing away from unrelated data. Confirm where Wire expects the Collabora server to run, which network segments it can reach, and whether the server can be placed in a segment that only accepts traffic from the WOPI host and the users' browsers.
Common failures in the Collabora Online and Wire integration
This table lists the failures teams most often hit when wiring Collabora Online into Wire Cells, with the likely cause and a first check for each. Work through the rows in order, since the first check often rules out several causes at once. Vendor-specific fixes belong with the Wire or Collabora documentation or support channel.
| Symptom | Likely cause | First check |
|---|---|---|
| Editor does not load inside Wire | Wire cannot reach the Collabora discovery endpoint, or the editor URL it was given is wrong | Open the Collabora discovery URL in a browser from a machine on the Wire side and confirm it returns a response |
| Browser shows a certificate warning when the editor opens | Certificate does not cover the hostname Wire uses, or the chain is incomplete | Compare the hostname in the editor URL with the certificate's subject and alternative names, and test the chain with an external client |
| Editor frame is blank or blocked | Hostname or protocol mismatch between the Wire origin and the Collabora URL, such as HTTP on one side and HTTPS on the other | Confirm both URLs use HTTPS and the expected hostnames in the Wire configuration and in Collabora's server settings |
| Connections time out from Wire users only | Firewall, proxy or routing rule blocks the path from client networks or Wire backend to the Collabora server | Test TCP reachability to the Collabora port from a sample client network and review firewall and proxy logs for denied flows |
| Documents open but editing is disabled | The user's Wire permission level or the WOPI access setting grants view only | Check the permission assigned to that user for the document, then compare with a known user who can edit |
| Co-editing sessions do not see each other's changes | Users are routed to different Collabora instances for the same document | Confirm the load balancer routes by the document identifier in the WOPISrc parameter, if more than one Collabora server is in use |
| Documents show different fonts, spacing or table layout | Font set on the Collabora server differs from the author's environment, or the file format has known rendering differences | Open the same file in Collabora directly and in a desktop office suite, and compare the fonts installed on the server |
| Saved files lose some formatting after editing | Round-trip differences between Microsoft and OpenDocument formats in the editor | Save a test copy of the affected file, reopen it, and compare the output against the original before rolling out |
Questions buyers ask about Collabora Online and Wire integration
Where do the Collabora servers run when Collabora Online is used with Wire Cells?
The Collabora Online servers are the document editing layer, so they are the part you choose to host, and the integration is designed around running them in infrastructure you control. Wire Cells brings co-editing into Wire's end-to-end encrypted workspace, according to Collabora's Wire partner page. Confirm with Wire and Collabora which components are hosted by whom in your deployment, where the WOPI traffic travels, and how the editor is reached from user devices. Plan the server location, network path and TLS certificates before the build starts.
What drives the cost and effort of a Collabora Online and Wire integration?
Cost follows the scope agreed in writing, and the main drivers are the number of Collabora servers, the network and TLS design, how Wire Cells is configured for your tenants, and how much testing your document set needs. Collabora's pricing page lists a Business plan at 3 euros per user per month for up to 99 users, which includes long term support, a service level agreement, signed security updates and customer portal access. Enterprise pricing for 100 or more users is quoted with volume discounts. Ask any quote to separate one-time build work from recurring subscription and support fees.
How long does the integration take, and what does the timeline depend on?
The duration depends on the number of environments, the Wire deployment model, the number of document types you must test, and how quickly your network and certificate approvals move. No duration is set until the scope is written down. Ask for milestones covering the infrastructure build, the Wire configuration, the document fidelity tests and the pilot group. Dependencies usually include access to the Wire environment, firewall changes between Wire, Collabora and users, and sign-off from the security team on the hosting design.
Can our internal team deliver the Wire and Collabora integration alone?
An internal team can do it if it has people who run Linux servers, reverse proxies and TLS, understand WOPI, and can work with Wire's administration model. Collabora Online can be deployed from Docker images, system packages or Kubernetes, so the skills needed depend on the deployment method you choose. Many teams split the work: internal staff own the network, identity and sign-off, while a partner handles the build, testing and runbooks. Compare the skills you have against the list of components in the written scope before deciding.
What must our team provide before the integration starts?
Your team should provide a named owner, access to the Wire environment and its administration accounts, the hosts or cloud accounts where Collabora will run, DNS names and TLS certificates, and firewall rules between Wire, the Collabora servers and users. You should also supply a sample set of Office and OpenDocument files that reflect real work, and the approval path for security and change control. Missing items are the most common cause of delay, so list them in the written scope with owners and dates.
What changes after go-live, and who keeps Collabora Online updated?
After go-live, the Collabora servers need patching, monitoring, certificate renewal and version planning. Collabora publishes security advisories for Collabora Online, and its 25.04 release notes record that 25.04.7.5, released January 29, 2026, fixed CVE-2026-23623 and updated package signing keys for RPM and DEB users. Decide who applies these updates, how quickly, and how you test them against Wire before rollout. Ongoing support and upgrades can be covered by a DeployOpen retainer if you want it written into the engagement.
Does the Collabora Online server need to be sized for many concurrent editors?
Yes, sizing depends on how many people co-edit at the same time, not only how many users you have. The Collabora Online Helm chart README recommends production limits of 8 CPU cores and 8000 MiB of memory per pod, with requests of 4 cores and 6000 MiB, and it notes that horizontal pod autoscaling is disabled because scaling breaks collaborative editing. Replicas are set manually, and load balancers must route by the WOPISrc parameter so all editors of one document reach the same pod. Confirm these figures against your own load test before you commit to a size.
How DeployOpen scopes and delivers the Collabora Online and Wire integration
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, including Collabora Online servers that sit alongside a Wire deployment. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
How we scope
- Confirm with Wire and Collabora which Wire Cells features and document types the integration must support.
- Map where the Collabora servers will run, including network paths, DNS, TLS and any restricted or air-gapped zones.
- Record the written scope, deliverables and timeline, and list what the client must provide before work starts.
How we build
- Install and configure Collabora Online from the packaging method chosen in scope, with routing set so all users editing one document reach the same server.
- Connect the editing layer to Wire Cells and restrict WOPI traffic to the expected hosts, using TLS for every connection.
- Test co-editing, document format fidelity and access behavior with representative files and test users before sign-off.
How we hand over
- Deliver configuration records, network diagrams, the test results and a runbook for the Collabora servers and the Wire connection.
- Walk the client's operations team through upgrades, patch handling and how to check the health of the editing service.
- Document open items and the decisions made, so your team can run the integration without DeployOpen involved day to day.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, scoped separately from the original build.
- Retainer scope can cover Collabora version upgrades, advisory-driven patching and changes to the Wire or network setup.
- Ask for the support and response terms in writing as part of the quote, since these depend on the agreed scope.
