Docker部署onlyoffice，解决https访问

首先，启动onlyoffice的Docker镜像，本文章采用的2023年11月初的官方镜像，具体版本号未查到。当时国内的镜像源只能下载到旧版本的，需要将/etc/docker/daemon.json设置"dns" : [ "8.8.8.8" ]方能下载。

先用docker exec进入启动的onlyoffice镜像，仿照如下帖子创建签名

CentOS7自签名SSL证书并给nginx配置https_ssl写在nginx vhost中-CSDN博客

返回宿主机，使用docker cp将签名拷出，另外需从宿主机中找到ds-docservice.conf一同拷出。

需要配置nginx的配置文件ds.conf，代码如下

server {
  
        listen 443 ssl;
        listen [::]:443;
        server_name localhost;

       
        ssl_certificate /etc/onlyoffice/documentserver/nginx/onlyoffice.crt;
       
        ssl_certificate_key /etc/onlyoffice/documentserver/nginx/onlyoffice.key;

        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;

  server_tokens off;

  
  set $secure_link_secret xtj7tj7DSqWKqqHM3e2P;
  include /etc/nginx/includes/ds-*.conf;
}

为解决410和403的问题，需找到镜像中的ds-docservice.conf，注释掉部分代码，代码如下

 secure_link $arg_md5,$arg_expires;
  secure_link_md5 "$secure_link_expires$uri$secure_link_secret";

  #if ($secure_link = "") {
  #  return 403;
  #}
  #
  #if ($secure_link = "0") {
  #  return 410;
  #}

 docker启动的映射路径，配置如下

  onlyoffice-documentserver: 
    image: onlyoffice/documentserver:latest
    container_name: onlyoffice-documentserver
    restart: always
    environment:
      JWT_SECRET: my_little_secret
    #dns_search:  
    volumes:
      - ./data/onlyoffice-documentserver/onlyoffice.key:/etc/onlyoffice/documentserver/nginx/onlyoffice.key
      - ./data/onlyoffice-documentserver/onlyoffice.csr:/etc/onlyoffice/documentserver/nginx/onlyoffice.csr
      - ./data/onlyoffice-documentserver/onlyoffice.crt:/etc/onlyoffice/documentserver/nginx/onlyoffice.crt
      - ./data/onlyoffice-documentserver/ds.conf:/etc/onlyoffice/documentserver/nginx/ds.conf
      - ./data/onlyoffice-documentserver/ds-docservice.conf:/etc/onlyoffice/documentserver/nginx/includes/ds-docservice.conf 
    ports:
      - "443:443"
    networks:
      - mynetwork

亲测可用！

如此操作，浏览器会显示“不安全”，如果有真实域名和CA证书，也可直接进行配置，nginx.conf配置如下：

server {
        listen 443 ssl;
        listen [::]:443;
        server_name chat.victorysoft.online;

        ssl_certificate /etc/onlyoffice/documentserver/nginx/xxx.xxx.xxx.pem;

        ssl_certificate_key /etc/onlyoffice/documentserver/nginx/xxx.xxx.xxx.key;

        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout 5m;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;

  server_tokens off;

  
  set $secure_link_secret xtj7tj7DSqWKqqHM3e2P;
  include /etc/nginx/includes/ds-*.conf;
}