Goal of this guide

This guide shows how to install, configure and validate grommunio Files and grommunio Office on an existing grommunio 2026.06.1 appliance. At the end, users should be able to upload files, share them and open DOCX, XLSX and PPTX directly in the browser.

  • You install grommunio Files 32.0.12 and grommunio Office 9.4.0 from the grommunio repository.

  • You configure databases, storage, Redis/file locking, cron and reverse proxy.

  • You connect Files with Office and validate the real editor workflow.

  • You enable the Files/Office integration in grommunio Web.

  • You test upload, download, sharing, a second user, saving and reopening.

  • You document operations, backup and troubleshooting points for production.

The series is intended to be chronological: install grommunio 2026, antispam with Rspamd, SSO with Keycloak, Meet, Chat and now Files with Office. Product context is available on the grommunio product page.

Architecture: Files, Office, Web and Auth

grommunio Files provides file storage, WebDAV, shares and the user interface. The package metadata on the validated appliance identifies Nextcloud as the technical basis. grommunio Office adds browser-based editing and is connected through the OnlyOffice app in Files. grommunio Web can expose Files as an integrated entry point; in this series, identity comes from grommunio-auth and Keycloak.

grommunio-auth / Keycloak
  -> grommunio Web
  -> entry point to grommunio Files
  -> WebDAV, shares, user files
  -> OnlyOffice app
  -> grommunio Office Document Service
  -> save back to Files

Prerequisites

  • A working grommunio 2026.06.1 appliance with Web, Admin, mail and a valid FQDN.

  • HTTPS must be reachable through the production FQDN. Self-signed certificates are only appropriate for isolated labs.

  • Enough storage for user data, versions, trash, database and backups.

  • MariaDB, nginx, PHP-FPM, Redis and systemd must be healthy.

  • Users need WebDAV/Files privileges. In validation, `privWeb`, `privDav` and `privFiles` were relevant.

  • Create a snapshot or appliance backup before making changes.

Step 1: Check the baseline

Do not start with installation. Start with a short baseline check so you can later tell whether Files/Office introduced a new issue or whether it was present before.

bash
cat /etc/os-release
hostname -f
ip addr
df -h
free -h
systemctl --failed
rpm -qa | grep -i grommunio | sort
ss -lntup

Step 2: Identify packages and roles

On the validated grommunio 2026.06.1 appliance, Files and Office came as native packages from the grommunio repository. Files provided Nextcloud-based file storage; Office provided the document service and RabbitMQ as a service dependency.

bash
zypper search -s grommunio-files grommunio-office
zypper info grommunio-files grommunio-office grommunio-office-fonts
rpm -ql grommunio-setup | grep -E 'files|office'
Validated versions:
- grommunio-files: 32.0.12-lp160.5.1
- grommunio-office: 9.4.0-lp160.6.1
- rabbitmq-server: 4.1.5
- grommunio-web: 3.19.371.ge256c4858

Step 3: Install Files and Office

Install Files, Office and RabbitMQ together. This keeps PHP dependencies, Office services, fonts and the Files application at a consistent package level.

bash
zypper --non-interactive install --auto-agree-with-licenses \
  grommunio-files \
  grommunio-office \
  rabbitmq-server

Afterwards verify that the packages are really installed. If `zypper info` showed “not installed” before, `rpm -q` must now return concrete versions.

bash
rpm -q grommunio-files grommunio-office rabbitmq-server

Step 4: Create databases and Files configuration

Files needs its own database and a configuration readable by the service context. Secrets do not belong in screenshots, tickets or blog posts. Use secret management or at least root-readable files.

bash
install -d -m 0750 /root/grommunio-secrets
openssl rand -base64 32 >/root/grommunio-secrets/files-db-password
chmod 0600 /root/grommunio-secrets/files-db-password


FILES_DB_PASSWORD="$(cat /root/grommunio-secrets/files-db-password)"
mariadb <<SQL
CREATE DATABASE IF NOT EXISTS grofiles CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER IF NOT EXISTS 'grofiles'@'localhost' IDENTIFIED BY '${FILES_DB_PASSWORD}';
GRANT ALL PRIVILEGES ON grofiles.* TO 'grofiles'@'localhost';
FLUSH PRIVILEGES;
SQL

The appliance provides the relevant paths. In the validated installation, application, configuration, external apps, data and logs were placed in these locations.

/usr/share/grommunio-files
/usr/share/grommunio-files/config/config.php
/var/lib/grommunio-files/data
/var/lib/grommunio-files/apps-external
/var/log/grommunio-files/files.log

Step 5: Install Files and set trusted domains

Run the Files initialization with the real FQDN. In production this is your mail/groupware FQDN without a lab port. `overwritewebroot` remains `/files` because Files is published behind nginx under that path.

bash
cd /usr/share/grommunio-files


sudo -u grofiles ./occ maintenance:install \
  --database mysql \
  --database-name grofiles \
  --database-user grofiles \
  --database-pass "$FILES_DB_PASSWORD" \
  --admin-user grofiles-admin \
  --admin-pass '<secure-admin-password>' \
  --data-dir /var/lib/grommunio-files/data


sudo -u grofiles ./occ config:system:set trusted_domains 0 --value="$(hostname -f)"
sudo -u grofiles ./occ config:system:set overwrite.cli.url --value="https://$(hostname -f)/files"
sudo -u grofiles ./occ config:system:set overwritewebroot --value="/files"
sudo -u grofiles ./occ config:system:set overwriteprotocol --value="https"
sudo -u grofiles ./occ config:system:set default_phone_region --value="AT"

Step 6: Enable Redis, file locking and cron

File locking and background jobs are not optional decoration. Without healthy jobs, previews, cleanup, versions and some app actions will eventually lag behind.

bash
sudo -u grofiles ./occ config:system:set memcache.local --value="\\OC\\Memcache\\APCu"
sudo -u grofiles ./occ config:system:set memcache.locking --value="\\OC\\Memcache\\Redis"
sudo -u grofiles ./occ config:system:set redis host --value="127.0.0.1"
sudo -u grofiles ./occ config:system:set redis port --value="6379" --type=integer
sudo -u grofiles ./occ background:cron
systemctl enable --now grommunio-files-cron.timer

Step 7: Connect the user source

The validated appliance used `user_external` so grommunio users can authenticate against the existing DAV/groupware access. This avoids inventing a second standalone user store in Files.

bash
cd /usr/share/grommunio-files
sudo -u grofiles ./occ app:enable user_external
sudo -u grofiles ./occ config:system:set user_backends 0 class --value="\\OCA\\UserExternal\\BasicAuth"
sudo -u grofiles ./occ config:system:set user_backends 0 arguments 0 --value="https://$(hostname -f)/dav"

Then verify in grommunio Admin that users have the required privileges. In validation, two normal users with Web, DAV and Files privileges were sufficient.

bash
grommunio-admin user query username privWeb privDav privFiles --format json-flat

Step 8: Prepare Office database and services

grommunio Office needs its own database and several services. RabbitMQ, `ds-docservice` and `ds-converter` must be running; otherwise Files may load while the editor stays empty or reports download/callback errors.

bash
openssl rand -base64 32 >/root/grommunio-secrets/office-db-password
chmod 0600 /root/grommunio-secrets/office-db-password
OFFICE_DB_PASSWORD="$(cat /root/grommunio-secrets/office-db-password)"


mariadb <<SQL
CREATE DATABASE IF NOT EXISTS groffice CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER IF NOT EXISTS 'groffice'@'localhost' IDENTIFIED BY '${OFFICE_DB_PASSWORD}';
GRANT ALL PRIVILEGES ON groffice.* TO 'groffice'@'localhost';
FLUSH PRIVILEGES;
SQL


mysql groffice < /usr/libexec/grommunio-office/server/schema/mysql/createdb.sql
systemctl enable --now rabbitmq-server ds-docservice ds-converter
systemctl start ds-themegen ds-fontgen || true

Step 9: Connect Files with Office

Enable the OnlyOffice app in Files and set the URLs to match the nginx publishing paths. In the validated environment, Files was reachable under `/files/` and Office under `/office/`.

bash
cd /usr/share/grommunio-files
sudo -u grofiles ./occ app:enable onlyoffice
sudo -u grofiles ./occ config:app:set onlyoffice DocumentServerUrl --value="https://$(hostname -f)/office/"
sudo -u grofiles ./occ config:app:set onlyoffice DocumentServerInternalUrl --value="https://$(hostname -f)/office/"
sudo -u grofiles ./occ config:app:set onlyoffice StorageUrl --value="https://$(hostname -f)/files/"
sudo -u grofiles ./occ config:app:set onlyoffice customizationForcesave --value=true
sudo -u grofiles ./occ config:app:set onlyoffice sameTab --value=true

In production, TLS must validate cleanly. In an isolated self-signed lab, disabling peer verification may be required for the test. This is a lab workaround, not a production standard.

bash
# Nur für isolierte Self-Signed-Labs:
sudo -u grofiles ./occ config:app:set onlyoffice verify_peer_off --value=true


# Für produktive Systeme:
sudo -u grofiles ./occ config:app:delete onlyoffice verify_peer_off || true

Step 10: Integrate grommunio Web

Enable the Files and Office functions in the grommunio Web plugin. Users should be able to move from Web into Files and edit Office file types directly.

bash
grep -E 'PLUGIN_FILES_USER_DEFAULT_ENABLE|PLUGIN_FILES_ONLYOFFICE_ENABLE|PLUGIN_FILES_ONLYOFFICE_FILETYPES' \
  /etc/grommunio-web/config-files.php


# Erwartung:
# define('PLUGIN_FILES_USER_DEFAULT_ENABLE', true);
# define('PLUGIN_FILES_ONLYOFFICE_ENABLE', true);
# define('PLUGIN_FILES_ONLYOFFICE_FILETYPES', ".doc,.docx,.docxf,.oform,.odp,.ods,.odt,.ppt,.pptx,.xls,.xlsx");

If you need to change these values, edit `/etc/grommunio-web/config-files.php` and restart the affected services. Use the real FQDN of the environment, not arbitrary example URLs.

bash
systemctl restart nginx php-fpm grommunio-web || true

Step 11: Run health checks

First check services and HTTP routes. `Office /healthcheck` must return `true`. Files redirects to login without a session, which is expected.

bash
systemctl --no-pager --plain is-active nginx mariadb rabbitmq-server ds-docservice ds-converter grommunio-files-cron.timer php-fpm
systemctl --failed --no-pager --plain
ss -lntup | grep -E ':(80|443|8000|3306|6379)'
curl -kIs https://$(hostname -f)/files/ | head -5
curl -ks https://$(hostname -f)/office/healthcheck
Validated result:
- Files returns HTTP 302 to login without a session.
- Office /healthcheck returns true.
- ds-docservice listens locally on port 8000.
- nginx, MariaDB, RabbitMQ, ds-docservice, ds-converter, php-fpm and Files cron are active.
- systemctl --failed reports 0 failed units.

Step 12: Validate login and files

Open Files with a normal grommunio user. If you sign in directly to Files, the validated path uses BasicAuth against the existing grommunio user source. In a fully seamless SSO architecture, also validate the entry point from grommunio Web.

https://mail.example.test/files/

Screenshot: Login to grommunio Files with a normal user.

Then upload one DOCX, one XLSX and one PPTX file. This validates not only the Files UI, but also the Office mapping for each file type.

bash
curl -k -u 'alice@example.test:<password>' -T ForgeOne-Files-Office-Test.docx \
  https://mail.example.test/files/remote.php/dav/files/alice@example.test/ForgeOne-Files-Office-Test.docx


curl -k -u 'alice@example.test:<password>' -T ForgeOne-Files-Office-Test.xlsx \
  https://mail.example.test/files/remote.php/dav/files/alice@example.test/ForgeOne-Files-Office-Test.xlsx


curl -k -u 'alice@example.test:<password>' -T ForgeOne-Files-Office-Test.pptx \
  https://mail.example.test/files/remote.php/dav/files/alice@example.test/ForgeOne-Files-Office-Test.pptx
https://mail.example.test/files/

Screenshot: Files shows DOCX, XLSX and PPTX after upload and scan.

Step 13: Edit, save and read back DOCX

The real acceptance test is not merely opening the editor. Type text into the document, save it, close it, download the file again and verify that the change really landed inside the DOCX file.

https://mail.example.test/files/index.php/apps/onlyoffice/29

Screenshot: DOCX in the Office editor with a visible validation change.

https://mail.example.test/files/index.php/apps/onlyoffice/29

Screenshot: After saving, the editor reports that all changes are saved.

bash
curl -k -u 'alice@example.test:<password>' \
  -o /tmp/ForgeOne-Files-Office-Test.docx \
  https://mail.example.test/files/remote.php/dav/files/alice@example.test/ForgeOne-Files-Office-Test.docx


unzip -p /tmp/ForgeOne-Files-Office-Test.docx word/document.xml | grep 'ForgeOne Files Office validation'
Validated result:
- DOCX opened in the browser.
- Text was inserted in the editor.
- Saving reported "All changes saved".
- WebDAV download returned a valid Microsoft Word file.
- The marker was present in word/document.xml.

Step 14: Validate XLSX and PPTX

Then validate at least one spreadsheet and one presentation. In the tested environment, both file types opened in the appropriate Office editor.

https://mail.example.test/files/index.php/apps/onlyoffice/30

Screenshot: XLSX opens in the grommunio Office spreadsheet editor.

https://mail.example.test/files/index.php/apps/onlyoffice/31

Screenshot: PPTX opens in the grommunio Office presentation editor.

Step 15: Test sharing with a second user

Files is only practical when sharing works. Share a file from user A to user B and then validate access with a separate session.

bash
curl -k -u 'alice@example.test:<password>' \
  -H 'OCS-APIRequest: true' \
  --data-urlencode 'path=/ForgeOne-Files-Office-Test.docx' \
  -d 'shareType=0' \
  --data-urlencode 'shareWith=bob@example.test' \
  -d 'permissions=15' \
  'https://mail.example.test/files/ocs/v2.php/apps/files_sharing/api/v1/shares?format=json'


curl -k -u 'bob@example.test:<password>' -X PROPFIND -H 'Depth: 1' \
  https://mail.example.test/files/remote.php/dav/files/bob@example.test/
https://mail.example.test/files/

Screenshot: The second user sees the shared DOCX file in their Files account.

Step 16: Classify SSO, MFA and sessions

In this article series, central platform sign-in runs through grommunio-auth and Keycloak. For grommunio Web this is the normal SSO path. In the validated installation, Files was connected to the existing grommunio DAV user source; this avoids a second administrative user store, even if direct Files login creates its own session.

If you want to enforce a fully seamless browser SSO path from Keycloak into Files, plan it as a dedicated identity topic: redirect URIs, logout behaviour, claims, groups, session lifetime and MFA must be tested end to end.

Step 17: Backup and operations

  • Back up `/usr/share/grommunio-files/config/config.php`, `/var/lib/grommunio-files`, `/var/log/grommunio-files`, `/etc/grommunio-office/default.json` and the `grofiles` and `groffice` databases.

  • Treat user files, versions and trash as a separate storage topic. This data grows differently from mailbox data.

  • Validate cron, PHP memory limit, upload limits, antivirus concept, retention, restore test and monitoring.

  • In production setups, TLS certificates, internal Office callbacks and external browser URLs must be clearly separated and documented.

  • After updates, validate `occ status`, Office healthcheck, DOCX saving, share access and the grommunio Web entry point again.

Troubleshooting from validation

  • Editor reports download or callback errors: check `DocumentServerUrl`, `DocumentServerInternalUrl`, `StorageUrl`, nginx paths and TLS trust.

  • Office healthcheck is green but the real editor does not save: test with a real DOCX file and WebDAV download. A synthetic healthcheck does not replace storage/callback validation.

  • Self-signed lab fails internally: in a lab, `verify_peer_off=true` and `rejectUnauthorized=false` in the Office request path may be required. This is not acceptable in production.

  • Files do not appear after CLI/WebDAV upload: run `sudo -u grofiles ./occ files:scan <user>`.

  • User cannot log in: check grommunio privileges, DAV access and the `user_external` backend entry.

  • Web does not show Files: check `/etc/grommunio-web/config-files.php` and restart Web/PHP/nginx services.

grommunio 2026 step by step

The platform grows step by step. Read the series in this order if you want to build a complete collaboration environment.

  1. Install grommunio 2026
  2. Set up grommunio-antispam with Rspamd
  3. Integrate grommunio-auth with Keycloak and MFA
  4. Set up and test grommunio Meet
  5. Set up grommunio Chat
  6. Set up grommunio Files and Office (you are here)

Validated basis

  • grommunio 2026.06.1 on an openSUSE Leap 16.0 appliance base.

  • grommunio Files 32.0.12, package metadata identifies Nextcloud as its basis.

  • grommunio Office 9.4.0 with OnlyOffice app 9.14.2 in Files.

  • DOCX, XLSX and PPTX opened in the browser.

  • DOCX was edited, saved, downloaded through WebDAV and the saved marker was found in `word/document.xml`.

  • Alice shared the DOCX file with Bob; Bob saw the file in Files and through WebDAV.

  • Office healthcheck returned `true`; `systemctl --failed` reported 0 failed units.

Introduce grommunio Files and Office properly

ForgeOne plans, licenses and operates grommunio as a sovereign collaboration platform with mail, calendars, contacts, antispam, SSO, Meet, Chat, Files, Office, monitoring, backup and support. If you want to integrate Files and online office editing in production, we can review storage, permissions, TLS, SSO, backup and operations together.

Discuss grommunio Files and Office