Reverse Proxy Configuration

This section describes how to integrate Sync-in with an existing reverse proxy.

info

With the recommended Docker installation, the server is already configured with the Nginx reverse proxy.
Therefore, this documentation does not apply to that use case.

Sync-in Server Configuration

In the environment.yaml configuration file, you can optionally define publicUrl with the exact URL exposed by the reverse proxy, including the scheme and any non-standard port. When configured, Sync-in uses it to generate notification links and editor URLs.

server:
  # Optional for now; required in the next major release
  publicUrl: 'https://sync-in.domain.com'
  trustProxy: true # default value if not specified

When publicUrl is configured, the URL must be reachable from users' browsers and, for office editors that communicate with Sync-in, from their services or containers. Do not use localhost or 127.0.0.1 in that case.

publicUrl remains optional until the next major release. When omitted, notification emails have no action links and editor URLs use the request origin forwarded by the proxy as a compatibility fallback. For security, publicUrl will become required in the next major release so editor endpoints are built from a trusted origin controlled by the administrator rather than from request headers.

The trustProxy option tells the server to what extent it should trust proxies (e.g., Nginx, Traefik) to determine the client's real IP address. The default true is kept for compatibility with existing installations.

Possible values

Value	Behavior
`false`	Ignores proxy headers, uses only the direct connection IP
`true`	Trusts forwarded headers from any connecting address
`IP, CIDR`	Trusts only the specified proxies
Number (deprecated)	`>= 1` becomes `true`; `< 1` becomes `false`

warning

Since version 2.6.0, numeric values no longer select the n-th hop and will be removed in the next major release. An existing trustProxy: 1 is treated as true. The true default is temporary and is planned to become false in a future major release. Until then, client IPs can be spoofed if the backend is directly reachable or a proxy retains client-supplied forwarding headers, as $proxy_add_x_forwarded_for does. Restrict direct access to Sync-in and prefer a trusted proxy IP/CIDR when possible.

Nginx Configuration

Several reverse proxies can be used. In this documentation, the configuration is described with Nginx, as it is the most common and best supported solution.

This configuration file is the recommended reference to ensure optimal operation of Sync-in server features.

⚠️ The directives server_name, ssl_certificate, ssl_certificate_key as well as the server address sync_in:8080 must be adapted to your environment.

The $http_host variable is intentional: unlike $host, it preserves a non-standard port from the client request when forwarding the host headers.

# SYNC-IN NGINX VHOST

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

upstream sync_in_server {
    server sync_in:8080;
    keepalive 32;
}

server {
    listen 80;
    # listen 443 ssl;
    # http2 on;
    # server_name  domain.com www.domain.com;
    # ssl_certificate      /etc/ssl/certs/fullchain.pem;
    # ssl_certificate_key  /etc/ssl/certs/privkey.pem;
    # ssl_protocols TLSv1.2 TLSv1.3;
    # ssl_session_cache shared:SSL:10m;
    # ssl_session_timeout 1h;
    # ssl_prefer_server_ciphers on;
    # ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
    # ssl_ecdh_curve X25519:prime256v1;

    # General settings
    charset UTF-8;
    server_tokens off;
    access_log off;
    include mime.types;

    # Optimized file sending
    sendfile on;
    tcp_nodelay on;
    tcp_nopush on;

    # Buffering for requests proxied to Node
    proxy_http_version 1.1;
    chunked_transfer_encoding on;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP  $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $http_host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_cache_bypass $http_upgrade;
    proxy_redirect off;

    # Proxy buffering settings
    proxy_buffering off; # nginx -> node
    proxy_buffers 8 512k;
    proxy_buffer_size 512k; # node highWaterMark

    # Generous timeouts for long transfers or ws
    proxy_read_timeout 3600s;
    proxy_send_timeout 3600s;
    keepalive_timeout  180  90s;

    # Clients settings
    proxy_request_buffering off; # client -> nginx
    large_client_header_buffers 4 16k;
    client_max_body_size 0;
    client_body_buffer_size 25M;

    location / {
        proxy_pass http://sync_in_server;
    }

    location ~* .(ico|jpg|png|gif|jpeg|swf|woff|svg)$ {
        # nginx always use the most accurate rule in its internal routing policies
        proxy_pass http://sync_in_server;
        gzip_static on;
        gzip_comp_level 5;
        expires 1d;
        add_header Cache-Control public;
    }

    # NOTE: This is only needed when the Collabora Online Docker container is running locally
    #       and you are not using an external URL.
    # Uncomment the line below to enable it:
    # include collabora.conf;

    # NOTE: This is only needed when the OnlyOffice Docker container is running locally
    #       and you are not using an external URL.
    # Uncomment the line below to enable it:
    # include onlyoffice.conf;

    # NOTE: This is only needed when the Euro-Office Docker container is running locally
    #       and you are not using an external URL.
    # Uncomment the line below to enable it:
    # include eurooffice.conf;

    # NOTE: This is only needed when the draw.io Docker container is running locally
    #       and you are not using an external URL.
    # Uncomment the line below to enable it:
    # include drawio.conf;
}

Collabora Online Configuration

In both modes, the Collabora feature must be enabled in the environment.yaml configuration file:

applications:
  files:
    editors:
      collabora:
        enabled: true

⚠️ If you deployed Collabora using Docker and are running Nginx with HTTPS, make sure to enable SSL termination.

Proxied mode

In the Nginx configuration, uncomment the directive include collabora.conf; to load the Collabora configuration.
In this mode, it is not necessary to expose the Collabora server directly to the Internet, but it must still be accessible from the Sync-in server.

Then, create the file /etc/nginx/collabora.conf and insert the content below.

⚠️ The value of proxy_pass must be adjusted according to the address of your Collabora server.

# Static Files
location ^~ /browser/ {
  proxy_pass http://collabora:9980;
  proxy_set_header Host $http_host;
}

# WOPI Discovery URL and Capabilities
location ^~ /hosting/ {
  proxy_pass http://collabora:9980;
  proxy_set_header Host $http_host;
}

# Main WebSocket + Docs Management
location ^~ /cool/ {
  proxy_pass http://collabora:9980;
  proxy_set_header Host $http_host;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;
}

External mode

The Collabora server must be accessible from both the Sync-in server and the browser (domain name or IP address).
Configure the externalServer directive in environment.yaml:

applications:
  files:
    editors:
      collabora:
        enabled: true
        externalServer: 'https://collabora.my-domain.com'

OnlyOffice Configuration

In both modes, the OnlyOffice feature must be enabled in the environment.yaml configuration file:

applications:
  files:
    editors:
      onlyoffice:
        enabled: true
        secret: 'REPLACE_WITH_LONG_RANDOM_ONLYOFFICE_SECRET'

info

Advanced OnlyOffice parameters are detailed in the Server Parameters section.

Generate a secure value and use the same secret on the OnlyOffice server.

Proxied mode

In the Nginx configuration, uncomment the directive include onlyoffice.conf; to load the OnlyOffice configuration.
In this mode, it is not necessary to expose the OnlyOffice server directly to the Internet, but it must still be accessible from the Sync-in server.

Then, create the file /etc/nginx/onlyoffice.conf and insert the content below.

⚠️ The value of proxy_pass must be adjusted according to the address of your OnlyOffice server.

location ^~ /onlyoffice/ {
    proxy_pass http://onlyoffice:80/;
    proxy_set_header X-Real-IP  $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $http_host/onlyoffice;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $http_host;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_no_cache 1;
    proxy_cache_bypass 1;
}

External mode

The OnlyOffice server must be accessible from both the Sync-in server and the browser (domain name or IP address).
Configure the externalServer directive in environment.yaml:

applications:
  files:
    editors:
      onlyoffice:
        enabled: true
        secret: 'REPLACE_WITH_LONG_RANDOM_ONLYOFFICE_SECRET'
        externalServer: 'https://onlyoffice.my-domain.com'

Euro-Office Configuration

Euro-Office is handled as an OnlyOffice-compatible editor by Sync-in.

In both modes, the Euro-Office feature must be enabled in the environment.yaml configuration file:

applications:
  files:
    editors:
      eurooffice:
        enabled: true
        secret: 'REPLACE_WITH_LONG_RANDOM_EUROOFFICE_SECRET'

Generate a secure value and use the same secret on the Euro-Office server.

warning

Do not enable onlyoffice and eurooffice at the same time unless this is intentional.

If both are enabled, Sync-in gives priority to onlyoffice.

Proxied mode

In the Nginx configuration, uncomment the directive include eurooffice.conf; to load the Euro-Office configuration.
In this mode, it is not necessary to expose the Euro-Office server directly to the Internet, but it must still be accessible from the Sync-in server.

Then, create the file /etc/nginx/eurooffice.conf and insert the content below.

⚠️ The value of proxy_pass must be adjusted according to the address of your Euro-Office server.

location ^~ /onlyoffice/ {
    proxy_pass http://eurooffice:80/;
    proxy_set_header X-Real-IP  $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $http_host/onlyoffice;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $http_host;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_no_cache 1;
    proxy_cache_bypass 1;
}

location ^~ /sdkjs/ {
    proxy_pass http://eurooffice:80/sdkjs/;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $http_host/onlyoffice;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $http_host;
}

External mode

The Euro-Office server must be accessible from both the Sync-in server and the browser (domain name or IP address).
Configure the externalServer directive in environment.yaml:

applications:
  files:
    editors:
      eurooffice:
        enabled: true
        secret: 'REPLACE_WITH_LONG_RANDOM_EUROOFFICE_SECRET'
        externalServer: 'https://eurooffice.my-domain.com'

draw.io Configuration

In both modes, the draw.io feature must be enabled in the environment.yaml configuration file:

applications:
  files:
    editors:
      drawio:
        enabled: true

Unlike the office editors, draw.io does not require a shared secret or server-side callback.

Proxied mode

In the Nginx configuration, uncomment the directive include drawio.conf; to load the draw.io configuration. In this mode, the draw.io container remains private on the Docker or internal network and is exposed under /drawio/ on the Sync-in origin.

Then, create the file /etc/nginx/drawio.conf and insert the content below.

⚠️ Adjust proxy_pass to the address of your draw.io server. The CORS header is required because Sync-in loads the local editor in a sandboxed iframe with an opaque origin.

location ^~ /drawio/ {
    add_header Access-Control-Allow-Origin "*" always;
    proxy_pass http://drawio:8080/;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $http_host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $http_host;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
}

External mode

The draw.io server must be accessible from users' browsers. Configure its URL with the externalServer directive and use a dedicated origin to isolate the editor from Sync-in:

applications:
  files:
    editors:
      drawio:
        enabled: true
        externalServer: 'https://drawio.my-domain.com'

Sync-in Server Configuration​

Possible values​

Nginx Configuration​

Collabora Online Configuration​

Proxied mode​

External mode​

OnlyOffice Configuration​

Proxied mode​

External mode​

Euro-Office Configuration​

Proxied mode​

External mode​

draw.io Configuration​

Proxied mode​

External mode​

Sync-in Server Configuration

Possible values

Nginx Configuration

Collabora Online Configuration

Proxied mode

External mode

OnlyOffice Configuration

Proxied mode

External mode

Euro-Office Configuration

Proxied mode

External mode

draw.io Configuration

Proxied mode

External mode