nextcloud onlyoffice插件出现异常Client error: 403 Forbidden

1. 问题现象

使用docker-compose配置nextcloud + onlyoffice，nextcloud中onlyoffice插件配置时出现
连接时发生异常 (Client error: GET https://www.drqf.work:9002/cache/files/data/conv_check_1715057937_65/output.docx/check_1715057937.docx?md5=PSOAXxezfSdkNBUPTdhMFA&expires=1755582181&filename=check_1715057937.docx resulted in a 403 Forbidden response:。 docker-compose.yml文件如下：

version: '3.8'

# 参考：https://github.com/nextcloud/docker

volumes:
  nextcloud:
  db:
  redis:
  onlyoffice:

networks:
  nextcloud_default:
    external: false

secrets:
  nextcloud_admin_password:
    file: ./secrets/nextcloud_admin_password.txt # put admin password in this file
  nextcloud_admin_user:
    file: ./secrets/nextcloud_admin_user.txt # put admin username in this file
  mysql_db:
    file: ./secrets/mysql_db.txt # put mysql db name in this file
  mysql_password:
    file: ./secrets/mysql_password.txt # put mysql password in this file
  mysql_user:
    file: ./secrets/mysql_user.txt # put mysql username in this file
  redis_password:
    file: ./secrets/redis_password.txt # put redis password in this file

services:
  nextcloud:
    image: nextcloud
    restart: always
    ports:
      - "8080:80"
      - "8443:443"
    volumes:
      - F:/docker/nextcloud/data/drqf/files:/var/www/html/data/drqf/files         #直接挂载数据目录，不需要迁移数据。 顺序要放在第一个
      - ./nextcloud/var/www/html/data:/var/www/html/data
      - ./nextcloud/var/www/html/config:/var/www/html/config
      - ./nextcloud/var/www/html/custom_apps:/var/www/html/custom_apps
      - ./nextcloud/home:/home
      - ./nextcloud/media:/media
    environment:
      #- NEXTCLOUD_ADMIN_USER=admin
      #- NEXTCLOUD_ADMIN_PASSWORD=admin_password
      - NEXTCLOUD_ADMIN_PASSWORD_FILE=/run/secrets/nextcloud_admin_password
      - NEXTCLOUD_ADMIN_USER_FILE=/run/secrets/nextcloud_admin_user
      - NEXTCLOUD_TRUSTED_DOMAINS=www.drqf.work
      - MYSQL_HOST=db
      #- MYSQL_PASSWORD=db_password
      #- MYSQL_DATABASE=nextcloud
      #- MYSQL_USER=db_user
      - MYSQL_PASSWORD_FILE=/run/secrets/mysql_password
      - MYSQL_DATABASE_FILE=/run/secrets/mysql_db
      - MYSQL_USER_FILE=/run/secrets/mysql_user
      #- OVERWRITEPROTOCOL=https  # 设置使用 HTTPS
      - LANG=zh_CN.UTF-8  # 设置中文语言
      - REDIS_HOST_PASSWORD=OOhYCOxKh64UaA==
      #- REDIS_HOST_PASSWORD_FILE=/run/secrets/redis_password
      - PHP_UPLOAD_LIMIT=32G      # 配置最大上传大小，防止无法上传大文件
      - APACHE_BODY_LIMIT=0   
      - PHP_MEMORY_LIMIT=2G   # 配置最大上传大小，防止无法上传大文件
    depends_on:
      - db
      - redis
      - onlyoffice
    secrets:
      - nextcloud_admin_user
      - nextcloud_admin_password
      - mysql_db
      - mysql_password
      - mysql_user
      - redis_password
    networks:
      - nextcloud_default

  db:
    image: mariadb
    restart: always
    command: --transaction-isolation=READ-COMMITTED
    ports:
      - 3306:3306
    environment:
      - TZ=Asia/Shanghai
      - MYSQL_ROOT_PASSWORD=db_root_password
      #- MYSQL_DATABASE=nextcloud
      #- MYSQL_USER=db_user
      #- MYSQL_PASSWORD=db_password
      - MYSQL_PASSWORD_FILE=/run/secrets/mysql_password
      - MYSQL_DATABASE_FILE=/run/secrets/mysql_db
      - MYSQL_USER_FILE=/run/secrets/mysql_user
    volumes:
      - ./db:/var/lib/mysql
    networks:
      - nextcloud_default
    secrets:
      - mysql_db
      - mysql_password
      - mysql_user

  redis:
    image: redis
    ports:
      - 6379:6379
    container_name: redis
    volumes:
      - ./redis/data:/data:rw
      - ./redis/redis.conf:/etc/redis/redis.conf:rw
    restart: always
    networks:
      - nextcloud_default

  onlyoffice:
    image: onlyoffice/documentserver
    container_name: onlyoffice
    restart: always

    ports:
      - 9001:80
      - 9002:443
    environment:
      - JWT_ENABLED=true
      - JWT_SECRET=LFMN9GfhjwedoiwioerxLFedGRBS7   #有需要可以改
      - SECURE_LINK_SECRET=kZk8sfghJEFGFoumD  # 如果修改这个值，\onlyoffice\nginx\conf.d\onlyoffice.conf也对应修改
      - REDIS_SERVER_HOST=redis
      - REDIS_SERVER_PORT=6379
      - REDIS_HOST_PASSWORD_FILE=/run/secrets/redis_password
    volumes:
      - ./onlyoffice/logs:/var/log/onlyoffice
      - ./onlyoffice/data:/var/www/onlyoffice/Data
      - ./onlyoffice/nginx/conf.d:/etc/nginx/conf.d
      - ./acme.sh:/etc/letsencrypt                   # 证书持久化存储（关键！）
    #  - ./onlyoffice/lib:/var/lib/onlyoffice
    #  - ./onlyoffice/db:/var/lib/postgresql
    #是否使用终端标准输入
    stdin_open: true
    #是否存在终端
    tty: true
    secrets:
      - redis_password
    networks:
      - nextcloud_default

  web:
    image: nginx:alpine-slim
    container_name: nginx
    restart: always
    ports:
      - 80:80
      - 81:81
      - 443:443
    depends_on:
      - nextcloud
    volumes:
      # https://docs.nextcloud.com/server/latest/admin_manual/installation/nginx.html
      #- ./nginx/nginx.conf:/etc/nginx/nginx.conf
      - ./nginx/conf.d:/etc/nginx/conf.d
      - ./acme.sh:/etc/letsencrypt                   # 证书持久化存储（关键！）
      - ./nginx/logs:/var/log/nginx
      - ./nginx/html:/usr/share/nginx/html                # 网站根目录
    networks:
      - nextcloud_default

  acme: # https证书自动续期
    # https://bbs.hassbian.com/thread-3105-1-1.html
    # https://cloud.tencent.com/developer/article/2548435
    image: neilpang/acme.sh
    container_name: acme
    restart: always
    volumes:
      - ./acme.sh:/acme.sh
    command: daemon

  jellyfin:
    image: jellyfin/jellyfin
    container_name: jellyfin
    user: "1000:1000"
    restart: unless-stopped
    environment:
      - TZ=Asia/Shanghai
    volumes:
      - ./jellyfin/config:/config
     # - ./jellyfin/media:/media
      - F:/docker/nextcloud/data/drqf/files:/media/drqf:ro  
      - ./nextcloud/var/www/html/data:/media/other:ro
      - ./jellyfin/fonts:/usr/share/fonts/truetype/dejavu:ro  # 配置字体
    ports:
      - 8096:8096
      - 8920:8920/udp
      - 7359:7359/udp
      - 7359:7359/tcp

  
  Aria2-Pro: # https://wzfou.com/aria2-pro-docker/
    container_name: aria2-pro
    image: p3terx/aria2-pro
    environment:
      - PUID=0
      - PGID=0
      - UMASK_SET=022
      - RPC_SECRET=aria216712343 # 配置Aria2的RPC secret密钥，被用于Alist和AriaNg连接Aria2 如doub.io
      - RPC_PORT=6800
      - LISTEN_PORT=6888
      - DISK_CACHE=64M
      - IPV6_MODE=false
      - UPDATE_TRACKERS=true
      - CUSTOM_TRACKER_URL=
      - TZ=Asia/Shanghai
    volumes:
      - ./aria2/config:/config #  ${PWD}指代当前目录 默认配置会将程序产生的数据保存在当前文件夹下 :号前为主机上的目录，后为容器内的目录
      - ./nextcloud/home/aria2/temp/downloads:/downloads # :前配置要在主机上保存下载文件的路径
      - ./nextcloud/home/aria2/temp/aria2:/opt/alist/data/temp/aria2 # 必须
    ports:
      - "6800:6800"
      - "6888:6888"
      - "6888:6888/udp"
    restart: unless-stopped

  # Aria2 的 Web UI
  AriaNg:
    container_name: ariang
    image: p3terx/ariang
    #network_mode: bridge
    command: --port 6880 --ipv6
    ports:
      - "6880:6880"
    restart: unless-stopped

onlyoffice配置页面报错
在这里插入图片描述

错误信息：

连接时发生异常 (Client error: `GET https://www.drqf.work:9002/cache/files/data/conv_check_1715057937_65/output.docx/check_1715057937.docx?md5=PSOAXxezfSdkNBUPTdhMFA&expires=1755582181&filename=check_1715057937.docx` resulted in a `403 Forbidden` response:

2. 问题原因

这个错误与nginx配置文件中的$secure_link_secret属性有关。
/etc/nginx/conf.d/onlyoffice.conf:

include /etc/nginx/includes/http-common.conf;

server {
  listen 0.0.0.0:80;
  listen [::]:80 default_server;
  server_tokens off;

  set $secure_link_secret kZk8sfghJEFGFoumD;
  include /etc/nginx/includes/ds-*.conf;
}

server {
  listen 443 ssl;
 # listen [::]:80 default_server;
   server_tokens off;
    #server_name drqf.work wwww.drqf.work;

  ssl_certificate /etc/letsencrypt/drqf.work_ecc/fullchain.cer;
  ssl_certificate_key /etc/letsencrypt/drqf.work_ecc/drqf.work.key;

  set $secure_link_secret kZk8sfghJEFGFoumD;
  include /etc/nginx/includes/ds-*.conf;
}

其他博客的修改方法是把/etc/nginx/includes/ds-docservice.conf中的403判断逻辑注释掉，但会提示不安全：

 secure_link $arg_md5,$arg_expires;
  secure_link_md5 "$secure_link_expires$uri$secure_link_secret";
 
  #if ($secure_link = "") {
  #  return 403;
  #}
  #
  #if ($secure_link = "0") {
  #  return 410;
  #}

既然是一个安全属性，那么最好还是不要注释掉。
在onlyoffice社区 我找到了一个解决方式：
在这里插入图片描述

每次onlyoffice启动时会随机生成一个密钥字符串。 官方文档中有说明，可以通过环境变量进行指定。 因此在docker-compose.yml中进行明确指定，并保持onlyoffice.conf和环境变量配置相同就可以解决。

cat /etc/onlyoffice/documentserver/local.json
在这里插入图片描述
在这里插入图片描述

3. 解决办法

  1. onlyoffice.conf中配置
    set $secure_link_secret kZk8sfghJEFGFoumD;
include /etc/nginx/includes/http-common.conf;

server {
  listen 0.0.0.0:80;
  listen [::]:80 default_server;
  server_tokens off;

  set $secure_link_secret kZk8sfghJEFGFoumD;
  include /etc/nginx/includes/ds-*.conf;
}

server {
  listen 443 ssl;
 # listen [::]:80 default_server;
   server_tokens off;
    #server_name drqf.work wwww.drqf.work;

  ssl_certificate /etc/letsencrypt/drqf.work_ecc/fullchain.cer;
  ssl_certificate_key /etc/letsencrypt/drqf.work_ecc/drqf.work.key;

  set $secure_link_secret kZk8sfghJEFGFoumD;
  include /etc/nginx/includes/ds-*.conf;
}
  1. onlyoffice环境变量配置SECURE_LINK_SECRET
  onlyoffice:
    image: onlyoffice/documentserver
    container_name: onlyoffice
    restart: always

    ports:
      - 9001:80
      - 9002:443
    environment:
      - JWT_ENABLED=true
      - JWT_SECRET=LFMN9GgarwerasdggaFedGRBS7   #有需要可以改
      - SECURE_LINK_SECRET=kZk8sfghJEFGFoumD # 如果修改这个值，\onlyoffice\nginx\conf.d\onlyoffice.conf也对应修改
      - REDIS_SERVER_HOST=redis
      - REDIS_SERVER_PORT=6379
      - REDIS_HOST_PASSWORD_FILE=/run/secrets/redis_password
    volumes:
      - ./onlyoffice/logs:/var/log/onlyoffice
      - ./onlyoffice/data:/var/www/onlyoffice/Data
      - ./onlyoffice/nginx/conf.d:/etc/nginx/conf.d
      - ./acme.sh:/etc/letsencrypt                   # 证书持久化存储（关键！）
    #  - ./onlyoffice/lib:/var/lib/onlyoffice
    #  - ./onlyoffice/db:/var/lib/postgresql
    #是否使用终端标准输入
    stdin_open: true
    #是否存在终端
    tty: true
    secrets:
      - redis_password
    networks:
      - nextcloud_default

4. 参考文档

https://helpcenter.onlyoffice.com/docs/installation/docs-community-install-docker-arm64.aspx

https://community.onlyoffice.com/t/nextcloud-onlyoffice-403-forbidden-nginx/2705/6

https://blog.csdn.net/Lordinloft/article/details/134986018

# docker
Logo
AI硬件创业社区

智能硬件社区聚焦AI智能硬件技术生态，汇聚嵌入式AI、物联网硬件开发者，打造交流分享平台，同步全国赛事资讯、开展 OPC 核心人才招募，助力技术落地与开发者成长。

更多推荐

STM32F4xx 中断管理机制（IRQ、NVIC、MSI）

片内外设：TIM 定时器、USART 串口、SPI、ADC、DMA 等；外部引脚：GPIO 引脚电平变化，对应 EXTI 外部中断。每一个支持中断的硬件单元，都引出一根专属IRQ Line（中断请求信号线），这条线路硬件直连内核 NVIC 的输入通道。中断两道闸门：外设本地中断开关（控制 IRQ 输出）+ NVIC 通道开关（控制 IRQ 上报 CPU）；IRQ（Interrupt Request

avatar AI硬件创业社区

第十章、LangChain-人机参与(Human-in-the-loop)

人机在环（HITL）中间件为LangChain代理提供人工监督能力，通过配置interrupt_on策略，在执行高风险操作（如写文件、执行SQL）时暂停并等待人工决策。支持approve、edit、reject、respond四种响应，可结合条件谓词实现精准拦截。需配合持久化检查点（如InMemorySaver或AsyncPostgresSaver）与线程配置，确保状态安全恢复。支持批处理（默认）

avatar AI硬件创业社区
cover

【mcu-1203】硬币自动分拣控制系统【单片机毕业设计项目参考】

avatar AI硬件创业社区