Deploy and Host ONLYOFFICE Docs on Railway

Built for an LLM agent to deploy and use. There is nothing to fill in: the JWT secret is generated at deploy time, JWT is on, all state sits on one volume, and the contract below lists every URL and variable name with one script that checks health, auth and a signed API call.

ONLYOFFICE Docs is a document editing server: it opens, edits and converts word processor, spreadsheet and presentation files in the browser, and it is the editor behind the ONLYOFFICE connectors for Nextcloud, Seafile, ownCloud and others. This template runs ONLYOFFICE Docs Community Edition 10.0 as one service, with the converter embedded, so it needs no database, Redis or RabbitMQ.

About Hosting ONLYOFFICE Docs

This template runs one service, built from the official onlyoffice/documentserver 10.0.0.1 image (pinned by digest) in the public wrapper bon5co/onlyoffice-railway, with the volume at /data. The wrapper makes nginx listen on the port Railway injects, moves the image's state directories (/var/lib/onlyoffice, /var/www/onlyoffice/Data, custom fonts) onto the volume so they survive redeploys, and fixes the ownership of the root-owned mount for the service user.

JWT is on and the secret is the generated variable JWT_SECRET, so a stranger who finds the URL cannot call the command or conversion API: an unsigned request gets {"error":6}. A connector such as Nextcloud or Seafile is configured with the public URL and the same secret. ALLOW_PRIVATE_IP_ADDRESS is on, so the server can fetch files from storage on the Railway private network, for example http://nextcloud.railway.internal. The welcome page is off. The Community Edition accepts about 20 simultaneous editing connections and is licensed AGPL.

Agent contract

Public URL: https://, on the onlyoffice service (set OO_URL to it, no trailing slash)
Private URL: http://onlyoffice.railway.internal:8080
Credentials: the secret is in JWT_SECRET (on the onlyoffice service)
Auth: API calls carry Authorization: Bearer plus an HS256 JWT signed with JWT_SECRET, whose payload is the JSON request body; connectors take the same value as their JWT secret and Authorization as the JWT header
Health: GET /healthcheck returns 200 with the body true, no credentials (about 1 to 2 minutes after start)

# run with OO_URL and JWT_SECRET (onlyoffice service); needs curl and openssl
b64() { openssl base64 -A | tr '+/' '-_' | tr -d '='; }
jwt() {
  H=$(printf '{"alg":"HS256","typ":"JWT"}' | b64)
  P=$(printf '%s' "$1" | b64)
  S=$(printf '%s.%s' "$H" "$P" | openssl dgst -sha256 -hmac "$JWT_SECRET" -binary | b64)
  echo "$H.$P.$S"
}
BODY='{"c":"version"}'
echo "health: $(curl -s "$OO_URL/healthcheck")"
echo "unsigned: $(curl -s -X POST "$OO_URL/command" -H 'Content-Type: application/json' -d "$BODY")"
echo "signed: $(curl -s -X POST "$OO_URL/command" -H 'Content-Type: application/json' -H "Authorization: Bearer $(jwt "$BODY")" -d "$BODY")"

A fresh deploy prints health: true, unsigned: {"error":6} and signed: {"error":0,"version":"10.0.0.169"}. Convert a file with POST /converter (a signed JSON body with async, filetype, key, outputtype and a url the server can reach), open the editors from your app with the document API script at /web-apps/apps/api/documents/api.js, and check the version at /hosting/discovery.

Why Deploy ONLYOFFICE Docs on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying ONLYOFFICE Docs on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Agent-ready - generated JWT secret, a contract block and one working script; no setup step.
Closed by default - JWT is on, so unsigned calls are refused instead of served.
One service - the Community Edition runs without a database, Redis or RabbitMQ.
State survives redeploys - the editor data, fonts and cache live on the volume, and the secret stays the same after every redeploy.

Common Use Cases

Office editor for Nextcloud or Seafile - point the ONLYOFFICE connector at the public URL with the same JWT secret.
Document conversion API - turn docx, xlsx, pptx and txt into PDF or other formats from an agent or a backend.
Embedded editor in your own app - load the document editor in an iframe from your own storage.

Dependencies for ONLYOFFICE Docs Hosting

A volume at /data (included in this template).

Deployment Dependencies

ONLYOFFICE DocumentServer - upstream project
bon5co/onlyoffice-railway - the wrapper image this template deploys, built from onlyoffice/documentserver 10.0.0.1