Onlyoffice Nextcloud connector cant get files: HTTP 403 Access denied

Question

Environment:

we run Onlyoffice with Docker, my docker-compose.yml file is:

version: "2.0"
services:
  Onlyoffice5.2.3.64:
    image: 'onlyoffice/documentserver:5.2.3.64'
    restart: always
    volumes:
      - '/etc/selfmade/docker/onlyoffice/5.2.3.64_default.json:/etc/onlyoffice/documentserver/default.json'
    ports: 
      - '80:80'

Any requests are forwarded by our nginx proxy, the proxy delivers https.

The Nextcloud runs on a stand-alone system with an apache2 web server, there are no special deny rules configured. Only .htaccess files are included, they are not modified.

Nextcloud version: 14.0.3 App version: 2.0.4 (installed by Store in Nextcloud)

Action:

Pressing save

Problem:

Onlyoffice5.2.3.64_1  | ==> /var/log/onlyoffice/documentserver/converter/out.log <==
Onlyoffice5.2.3.64_1  | [2018-11-14 10:49:46.970] [ERROR] nodeJS - error downloadFile:url=https://onlyoffice.domain.tld/index.php/apps/onlyoffice/empty?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhY3Rpb24iOiJlbXB0eSJ9.V1-30DUaR5kUHFN3zxuU-oHGmtO9DQE0BtTYAcxVVco;attempt=1;code:undefined;connect:undefined;(id=conv_check_1738130868_docx)
Onlyoffice5.2.3.64_1  | Error: Error response: statusCode:403 ;body:
Onlyoffice5.2.3.64_1  | {"message":"Access denied"}
Onlyoffice5.2.3.64_1  |     at Request._callback (/var/www/onlyoffice/documentserver/server/Common/sources/utils.js:250:18)
Onlyoffice5.2.3.64_1  |     at Request.self.callback (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:185:22)
Onlyoffice5.2.3.64_1  |     at emitTwo (events.js:126:13)
Onlyoffice5.2.3.64_1  |     at Request.emit (events.js:214:7)
Onlyoffice5.2.3.64_1  |     at Request.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1161:10)
Onlyoffice5.2.3.64_1  |     at emitOne (events.js:116:13)
Onlyoffice5.2.3.64_1  |     at Request.emit (events.js:211:7)
Onlyoffice5.2.3.64_1  |     at IncomingMessage.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1083:12)
Onlyoffice5.2.3.64_1  |     at Object.onceWrapper (events.js:313:30)
Onlyoffice5.2.3.64_1  |     at emitNone (events.js:111:20)
Onlyoffice5.2.3.64_1  | [2018-11-14 10:49:48.021] [ERROR] nodeJS - error downloadFile:url=https://onlyoffice.domain.tld/index.php/apps/onlyoffice/empty?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhY3Rpb24iOiJlbXB0eSJ9.V1-30DUaR5kUHFN3zxuU-oHGmtO9DQE0BtTYAcxVVco;attempt=2;code:undefined;connect:undefined;(id=conv_check_1738130868_docx)
Onlyoffice5.2.3.64_1  | Error: Error response: statusCode:403 ;body:
Onlyoffice5.2.3.64_1  | {"message":"Access denied"}
Onlyoffice5.2.3.64_1  |     at Request._callback (/var/www/onlyoffice/documentserver/server/Common/sources/utils.js:250:18)
Onlyoffice5.2.3.64_1  |     at Request.self.callback (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:185:22)
Onlyoffice5.2.3.64_1  |     at emitTwo (events.js:126:13)
Onlyoffice5.2.3.64_1  |     at Request.emit (events.js:214:7)
Onlyoffice5.2.3.64_1  |     at Request.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1161:10)
Onlyoffice5.2.3.64_1  |     at emitOne (events.js:116:13)
Onlyoffice5.2.3.64_1  |     at Request.emit (events.js:211:7)
Onlyoffice5.2.3.64_1  |     at IncomingMessage.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1083:12)
Onlyoffice5.2.3.64_1  |     at Object.onceWrapper (events.js:313:30)
Onlyoffice5.2.3.64_1  |     at emitNone (events.js:111:20)
Onlyoffice5.2.3.64_1  | [2018-11-14 10:49:49.077] [ERROR] nodeJS - error downloadFile:url=https://onlyoffice.domain.tld/index.php/apps/onlyoffice/empty?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhY3Rpb24iOiJlbXB0eSJ9.V1-30DUaR5kUHFN3zxuU-oHGmtO9DQE0BtTYAcxVVco;attempt=3;code:undefined;connect:undefined;(id=conv_check_1738130868_docx)
Onlyoffice5.2.3.64_1  | Error: Error response: statusCode:403 ;body:
Onlyoffice5.2.3.64_1  | {"message":"Access denied"}
Onlyoffice5.2.3.64_1  |     at Request._callback (/var/www/onlyoffice/documentserver/server/Common/sources/utils.js:250:18)
Onlyoffice5.2.3.64_1  |     at Request.self.callback (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:185:22)
Onlyoffice5.2.3.64_1  |     at emitTwo (events.js:126:13)
Onlyoffice5.2.3.64_1  |     at Request.emit (events.js:214:7)
Onlyoffice5.2.3.64_1  |     at Request.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1161:10)
Onlyoffice5.2.3.64_1  |     at emitOne (events.js:116:13)
Onlyoffice5.2.3.64_1  |     at Request.emit (events.js:211:7)
Onlyoffice5.2.3.64_1  |     at IncomingMessage.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1083:12)
Onlyoffice5.2.3.64_1  |     at Object.onceWrapper (events.js:313:30)
Onlyoffice5.2.3.64_1  |     at emitNone (events.js:111:20)

And an ngrep tell me:

T <ip onlyoffice>:80 -> <load balancer>:52070 [AP]
  HTTP/1.1 200 OK..Server: nginx..Date: Wed, 14 Nov 2018 10:49:50 GMT..Content-Type: text/xml; charset=UTF-8..Content-Length: 80..Connection: close..Vary: Accept-Encoding..X-Powered-By: Express..ETag: W/"50-z
  nhOfxspmYa/tCyRfpwopdInS1U"....<?xml version="1.0" encoding="utf-8"?><FileResult><Error>-4</Error></FileResult>

Answer 1

'/etc/selfmade/docker/onlyoffice/5.2.3.64_default.json:/etc/onlyoffice/documentserver/default.json'

Please also map /etc/onlyoffice/documentserver/local.json It should contain your secret key, as the value from local.json will overwrite the value from default.json