Deploy BoldDocServer

Use this guide to deploy BoldDocServer with direct HTTPS or through NGINX or IIS. Complete Deployment Prerequisites before starting.

1. Prepare the deployment files

Follow Quick Start steps 1–3 to create docker-compose.yaml, enter your settings, and add the certificate and dictionary files.

Use your BoldDocServer hostname in place of bolddocserver.example.com throughout this guide. Keep WOPI_HOST_URL set to the HTTPS address that SharePoint and users’ browsers will access.

2. Configure HTTPS access

Choose one of the following options.

Direct HTTPS

Users connect directly to BoldDocServer. Use the Quick Start configuration:

• Keep the port mapping 443:443.
• Put the certificate chain in certs/certificate.crt and its private key in certs/private-key.key.
• Set WOPI_HOST_URL to https://bolddocserver.example.com.
• Point the hostname to the container host and allow inbound HTTPS on port 443.

Continue to Start the service.

HTTPS through a reverse proxy

Users connect to the proxy over HTTPS. The proxy forwards requests to BoldDocServer on a private connection. Point the public hostname to the proxy, and keep WOPI_HOST_URL set to that public HTTPS address.

NGINX on the same Linux host

This example runs NGINX directly on the Linux host alongside the BoldDocServer container. NGINX uses public port 443 and forwards requests over HTTPS to local port 8443.

Update the application port mapping in docker-compose.yaml:

ports:
  - "127.0.0.1:8443:443"

Replace the existing 443:443 mapping with this entry. Only local processes can connect to port 8443, leaving public port 443 available for NGINX. Keep the application’s certificate mounts and HTTPS settings from Quick Start.

Prepare the NGINX certificate files:

File	Contents
/etc/nginx/certs/certificate.crt	Certificate chain for bolddocserver.example.com.
/etc/nginx/certs/private-key.key	Corresponding private key.
/etc/nginx/certs/upstream-ca.pem	Trusted CA certificates used to verify BoldDocServer’s certificate.

The application certificate must also cover bolddocserver.example.com. NGINX uses this hostname to verify the application’s certificate, even though it connects through 127.0.0.1.

Add the proxy configuration to a file included by NGINX’s http block, such as /etc/nginx/conf.d/bolddocserver.conf:

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 443 ssl;
    server_name bolddocserver.example.com;

    ssl_certificate     /etc/nginx/certs/certificate.crt;
    ssl_certificate_key /etc/nginx/certs/private-key.key;

    location / {
        proxy_pass https://127.0.0.1:8443;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        proxy_read_timeout 300s;
        proxy_send_timeout 300s;

        proxy_ssl_server_name on;
        proxy_ssl_name bolddocserver.example.com;
        proxy_ssl_verify on;
        proxy_ssl_trusted_certificate /etc/nginx/certs/upstream-ca.pem;
    }
}

Replace the hostname and file paths with your values. The configuration preserves the request path and forwards WebSocket connections used by collaboration. See the NGINX references for HTTPS upstream verification and WebSocket forwarding.

This local-port mapping is for NGINX on the same host. If your proxy runs on another server or in another container, use an application address reachable from that proxy and restrict access to it.

IIS on a Windows proxy host

IIS can forward requests to BoldDocServer running on a Linux host or VM.

1. Install the IIS URL Rewrite and Application Request Routing (ARR) modules, and enable ARR proxy functionality.
2. Add an HTTPS binding and certificate for bolddocserver.example.com to the IIS site.
3. Add a reverse-proxy rule that forwards requests to BoldDocServer’s private application address. Preserve the request path and query string, and enable WebSocket forwarding for collaboration.
4. Allow the IIS host to reach the application’s private port. For an HTTPS connection, the IIS host must trust the application certificate and use a hostname covered by it.

Keep the application port accessible only to the proxy and authorized internal systems. See Microsoft’s IIS reverse-proxy setup for the ARR and URL Rewrite configuration steps.

3. Start the service

From the folder containing docker-compose.yaml, run:

docker compose up -d
docker compose ps

Expected result: The app service is running. If it fails to start, see Container fails to start.

If you configured NGINX, check its configuration before starting it:

sudo nginx -t

On a Linux host that manages NGINX with systemd, start the service if it is stopped:

sudo systemctl start nginx

If NGINX is already running, apply the configuration with sudo systemctl reload nginx instead.

4. Check access and connect SharePoint

From the SharePoint server, request the public discovery endpoint:

curl.exe -i https://bolddocserver.example.com/hosting/discovery

Expected result: The request succeeds over trusted HTTPS and returns discovery XML. Its editor URLs use the public BoldDocServer hostname.

For an HTTPS deployment, users’ browsers must also trust the certificate and be able to reach this address. If discovery fails, see Discovery troubleshooting. For proxy errors, see Reverse proxy returns 404 or 500.

Next, follow Connect SharePoint to register the WOPI bindings and open, edit, save, and reopen a document. Discovery checks access to the service; reopening the edited file checks that changes reached SharePoint.

Lifecycle management

Run these commands from the deployment folder when you need the corresponding action.

Action	Command
Check service status	docker compose ps
View recent application logs	docker compose logs --tail 200 app
Stop services	docker compose stop
Start stopped services	docker compose start
Restart the application	docker compose restart app

Update BoldDocServer

1. Save a copy of the current docker-compose.yaml and record the current Docker image name.
2. Review the new version’s release notes and update the image value to the Docker image provided for that version.
3. Download and start the updated image:

docker compose pull
docker compose up -d

4. Repeat the discovery check and open, edit, save, and reopen a test document from SharePoint.

Remove the containers

To stop and remove the deployment’s containers and Compose network, run:

docker compose down

Host-mounted certificate and dictionary files remain in the deployment folder. Documents remain in SharePoint.