Hey Bill,
Thanks for the question.
The document server is not the system of record. It pulls a copy of the file for editing, then writes the result back to SmarterMail.
There are two connections involved:
Browser → Document Server
When a user opens a document, SmarterMail gives the browser a URL to the document server along with a short-lived access token. The browser loads the editor directly from the document server.
Because of that, the document server must be reachable by your users, either over the internet or through a VPN. I would recommend putting Nginx or Caddy in front of it for TLS and to limit what is publicly exposed.
Document Server → SmarterMail
The document server uses the short-lived token to retrieve and save the user's file. There is no permanent service account or shared credential stored on the document server.
You can also restrict ONLYOFFICE so it will only connect back to your SmarterMail server:
"ipfilter": {
"rules": [
{ "address": "your.smartermail.server", "allowed": true },
{ "address": "*", "allowed": false }
],
"useforrequest": false,
"errorcode": 403
}
Leave useforrequest set to false, otherwise you may also restrict incoming users by IP, which would cause problems for traveling users.
In short: expose the editor to your users, restrict the document server so it can only communicate with SmarterMail, and let the short-lived user tokens handle authorization.
I would also keep the document server patched and, if possible, isolate it from the rest of your internal network.
Hope that helps.
Kind Regards,