Nextcloud Collaboration - Office, Talk, Calendar, and Deck

Status: Active
Last Updated: 2026-08-14
Category: Cloud - Phase 1: File Storage & Sync
Prerequisites: nextcloud-setup, nextcloud-clients
Time: 3-4 hours
Tags: nextcloud, onlyoffice, collaborative-editing, talk, calendar, contacts, deck, groupware

Summary

Turn file storage into a full collaboration suite: real-time co-editing with Nextcloud Office (OnlyOffice), team chat and video calls with Nextcloud Talk, shared Calendars (CalDAV) and Contacts (CardDAV), and lightweight project tracking with Deck. This is the lesson that replaces a Google Workspace subscription entirely.

🎯 What You'll Learn

By the end of this article, you'll be able to:

✅ Deploy the OnlyOffice Document Server beside Nextcloud and wire them together securely
✅ Co-edit documents in real time with multiple users
✅ Install and configure Talk for chat + video, including TURN setup for restrictive networks
✅ Share calendars and address books across devices via CalDAV/CardDAV
✅ Organize team work with Deck boards mapped to your actual workflows
✅ Size the stack correctly (this phase doubles RAM requirements)

Resource Reality Check

Phase 1's file server ran comfortably in 2GB RAM. Collaboration changes that:

Component	RAM	Notes
Existing stack (app+db+redis)	~1.5–2 GB	From nextcloud-setup
OnlyOffice Document Server	+2 GB minimum	Node.js + PostgreSQL inside
Talk (signaling optional)	+0 to +512 MB	Built-in signaling OK ≤4–6 callers
Total comfortable	6–8 GB host	4GB hosts: skip OnlyOffice or add swap

Check before starting:

free -h && df -h /        # want ≥3GB free RAM headroom, ≥10GB free disk

Part 1: Nextcloud Office (OnlyOffice)

Why a separate Document Server?

Nextcloud can't edit rich documents alone; it delegates to an editor service. OnlyOffice Document Server (DS) renders docx/xlsx/pptx in-browser and merges concurrent keystrokes. Architecture:

Browser ──► Nextcloud (file store, permissions)
   │             │ hands off via JWT-signed request
   ▼             ▼
OnlyOffice DS ◄─── downloads file from Nextcloud, serves editor,
                   saves back through Nextcloud's API

All three hops are HTTP; all are authenticated with a JWT secret so DS never serves a document it wasn't asked to.

Deploy Document Server

Add to your existing compose.yaml (from nextcloud-setup):

services:
  onlyoffice:
    image: onlyoffice/documentserver:8
    restart: unless-stopped
    environment:
      - JWT_ENABLED=true
      - JWT_SECRET=REPLACE_WITH_HEX          # openssl rand -hex 24
      - WOPI_ENABLED=false
    volumes:
      - oo_data:/var/www/onlyoffice/Data
      - oo_log:/var/log/onlyoffice
    expose:
      - "80"                                  # proxy-only; never publish directly
volumes:
  oo_data:
  oo_log:

Proxy route docs.example.com → onlyoffice:80 (Traefik labels or Caddy block, same pattern as nextcloud-setup).

Connect Nextcloud ↔ OnlyOffice

occ app:install onlyoffice        # or occ app:enable onlyoffice if downloaded
occ config app:set onlyoffice DocumentServerUrl --value=https://docs.example.com/
occ config app:set onlyoffice jwt_secret --value=<same-hex-as-above>
occ config app:set onlyoffice verify_peer_off --value=false   # keep TLS verification ON

Then Settings → Administration → ONLYOFFICE: the connector runs a health check ("Server is successfully connected").

What Happens on open: user clicks a .docx → Nextcloud generates a signed config (file URL, user id, permissions, callback URL) → browser loads editor from docs. domain → DS fetches the file from Nextcloud using that config → edits stream to DS → on close/save, DS POSTs the new file to Nextcloud's callback URL → new version appears in Versions.

Test collaborative editing

Open the same .docx as two different users. You should see both cursors with name labels, live typing within ~200ms, and zero conflict copies afterward — this is the feature sync clients could never give you.

Format support & gotchas

Format	View	Edit	Co-edit
docx/xlsx/pptx	✅	✅	✅ realtime
odt/ods/odp	✅	✅ (converts)	✅
pdf	✅	annotate only	❌

OOXML preferred: set default formats so new docs are .docx (Settings → ONLYOFFICE → common)
If editing silently fails after upgrades, it's nearly always JWT secret mismatch between connector and DS
Mobile browsers get a read-mostly experience; native apps handle mobile better

Part 2: Nextcloud Talk (Chat + Video)

Install and configure:

occ app:install talk
occ config app:set spreed turn_servers --value='[{"urls":["turn:turn.example.com:3478"],"username":"ncuser","password":"REPLACE"}]'
occ talk:stun:add stun.nextcloud.com:443       # default STUN usually fine

Basic usage needs nothing else — conversations are created per group/user, chat persists, files can be dropped into chats.

Why TURN matters

WebRTC video requires direct UDP paths between participants. Corporate NATs, carrier-grade NAT, and strict firewalls break it. A TURN relay (coTURN) routes media through your server when direct fails:

  coturn:
    image: coturn/coturn:latest
    network_mode: host            # needs real ports
    command: >
      -n --realm=example.com --fingerprint
      --listening-port=3478
      --min-port=49160 --max-port=49200
      --user=ncuser:REPLACE
      --lt-cred-mech
    restart: unless-stopped

Without TURN: 2-person calls on home Wi-Fi work; the team call from the office VPN doesn't. With TURN: everything works, at the cost of relay bandwidth (~1–2 Mbps per participant).

Call etiquette infrastructure

Set conversation types: public (link-joinable), private, group
Lobby mode for webinars: everyone waits until moderator opens
Recording requires the recording_server backend — skip unless you need it (heavy)

Part 3: Calendars & Contacts (CalDAV/CardDAV)

These ship with the core (calendar, contacts apps):

occ app:install calendar
occ app:install contacts

Endpoints your devices will consume:

CalDAV: https://cloud.example.com/remote.php/dav/principals/users/alice/
CardDAV: same path — apps auto-discover from server URL + credentials

Connect devices

iOS/macOS: Settings → Accounts → Add Other → CalDAV account → server cloud.example.com, username/password (use app password!)
Android: install DAVx⁵ (F-Droid/Play) → add account → it discovers calendars + address books in one shot
Thunderbird: built-in "New Calendar → On the network"

Test bidirectionally: create an event on the phone, refresh web UI. Create a contact on desktop, check phone.

Shared resources

# Team calendar everyone writes to:
occ calendars:create team --name "Team Events"
occ calendars:share team family --write
# Booking-style resource (meeting room):
occ resources:create "Room A" --contact-group=family

Birthdays auto-populate from Contacts — one more reason CardDAV beats keeping addresses in your phone vendor's silo.

Part 4: Deck (Kanban Project Tracking)

Deck gives Trello-style boards: Board → Stack → Card, with labels, due dates, assignees, and attachments pulled from your files.

occ app:install deck

Suggested starter structure for a household/small team:

Board: Home Projects
  ├─ Stack: Backlog     (cards: everything idea-stage)
  ├─ Stack: This Week   (≤5 cards — force prioritization)
  └─ Stack: Done (auto-archive after 30d)
Board: Server Maintenance
  ├─ Stack: Scheduled   (cards link to runbooks, due dates = patch windows)
  └─ Stack: Waiting on parts/vendor

Integration wins worth knowing:

Cards can attach files from Nextcloud (the lease PDF lives in Files, referenced by the card)
Talk conversations can be linked to cards (discussion lives with the task)
Calendar shows card due dates automatically
API exists (/api/v1.0/boards) for scripting imports

Common Gotchas & Troubleshooting

Editor loads forever / "Error when trying to connect". DS unreachable from browser, or JWT mismatch. Check in order: curl -I https://docs.example.com/healthcheck (expect 200), then compare secrets both sides, then TLS chain validity (self-signed certs on docs. domain will fail browsers).

Co-editing works but saves create duplicate versions every few minutes. That's autosave doing its job — versions retention keeps it sane (versions_retention_obligation). Not an error.

Talk calls ring but no audio/video flows. Classic NAT/TURN issue. Verify TURN creds with: docker exec coturn turnutils_uclient -u ncuser -w REPLACE turn.example.com. Also confirm proxy allows WebSocket upgrade for Talk's signaling (/apps/spreed/api/).

Calendar events shift by an hour after DST. Timezone mismatch between client OS setting and Nextcloud profile timezone. Fix profile: Settings → Personal info → Time zone.

DAVx⁵ shows 401 after password change. You changed login password; device still uses old app password. Regenerate under Security → Devices, update DAVx⁵.

RAM exhaustion after adding OnlyOffice. DS spawns render workers per open document. Cap concurrency: JWT_... no — use env GENERATE_FONTS=false plus container mem limit mem_limit: 2g, and accept queueing over OOM.

Practical Exercises

Wire OnlyOffice and run a two-user live co-editing session; deliberately disconnect one client mid-edit and confirm no data loss.
Add a coTURN sidecar and make a successful Talk call from a cellular connection (worst-case NAT).
Subscribe a phone to two calendars (personal + team) via DAVx⁵; create events from both ends.
Build the two-board Deck structure above and move a card through its lifecycle end-to-end.
Load test gently: open 3 documents simultaneously and watch docker stats — record your stack's real memory ceiling.

🔗 Related

Previous: nextcloud-clients — getting devices connected first
Next phase: object-storage-concepts — S3-style storage begins
minio-bucket-management — mount object storage into Nextcloud later
restic-setup — now backing up MORE state (DB grows with collaboration)
kb/observability/prometheus-introduction — watch this stack's memory pressure properly
kb/security/two-factor-authentication — enforce 2FA before this suite holds real work

Change Log

2026-08-14 — Initial publication as part of the cloud course build-out.