Privacy and data locality in a Nextcloud + draw.io live collaboration setup

[Quefelsees]

Hi,

I personally have been using draw.io (Desktop) for quite a while now and have been absolutely loving it!

And so of course when at work we started searching for a collaborative whiteboard I was quick to point out the live collaboration mode of draw.io. It also meets most of our expectations which is great.

So currently I am looking for how such a setup could look like. As of now I am would be very happy with a Nextcloud instance storing the collaborative files to be used as whiteboards with draw.io. However, at the moment I am concerned with one thing you mentioned here:

Collaborative ediiting works with draw.io in:

• [...]
• Nextcloud when Autosave is enabled with the official draw.io servers

[...]

1. Can you please elaborate on what data is actually routed through your servers ("official draw.io servers")? It might be the case that company policy prohibits any data leaving our infrastructure and so we would not be able to use it unfortunately.

2. If that would be the case then how does that look like for a none-live collaborative whiteboard? So essentially merging all user's files after manually saving. How could I ensure that no data leaves our infrastructure?

I appreciate any help! Thank you for your time!

[draw-io-triage-bot[bot]]

1. What passes through draw.io's servers during realtime collaboration

With the default Editor URL (https://embed.diagrams.net), the browser reads the diagram file from your Nextcloud and writes it back there; the file isn't saved on draw.io's servers. Live collaboration is different, though: the open editors talk to each other through a relay, and that relay runs on draw.io's servers. While people are editing, it carries:

• the live changes to the diagram: every shape and connector that is added, changed or deleted, including its label, style and position
• cursor positions, visible areas and selections
• each collaborator's Nextcloud user ID and display name

On top of that, the editor application itself is downloaded from embed.diagrams.net (which, like any website, sees the user's IP address, see https://www.drawio.com/docs/security/), and the browser connects to the Pusher messaging service that draw.io uses for save notifications. Those notifications carry no diagram content.

So if your policy is that no diagram content may leave your infrastructure, realtime collaboration in Nextcloud doesn't meet it. The relay isn't part of the open source code. It is built specifically for Cloudflare, and there is no self-hostable version (see #3734).

2. Merge on save with nothing leaving your infrastructure

Host the editor yourself and point the Nextcloud app at it:

1. Run the jgraph/drawio Docker image on your own server. The docker-drawio repository has a compose file and setup script for exactly this setup, Nextcloud plus a self-hosted draw.io: https://github.com/jgraph/docker-drawio/tree/dev/nextcloud
2. In Nextcloud, go to Administration settings > Diagramming and set Editor URL to your draw.io server, or run:

   php occ config:app:set drawio DrawioUrl --value="https://drawio.example.com"
   

3. Leave Activate offline mode? set to No (explained below).

The editor, its Nextcloud plugin and all of its requests then come from your own server, and the Content-Security-Policy that the image adds by default doesn't allow scripts from or connections to draw.io's servers. Files are still read and written only through Nextcloud. When someone saves and Nextcloud already has a newer version from a colleague, draw.io loads that version from Nextcloud, merges both sets of changes in the browser and saves the result. Other people's changes don't appear live: you see them when your next save merges them in, or when you reopen the file. You may see failed connection attempts to /rt on your draw.io host in the browser console. That is the live relay, which the image doesn't include, and it doesn't affect saving or merging.

Why not offline mode: Activate offline mode? adds offline=1&stealth=1 to the editor URL, and in offline mode draw.io doesn't load plugins, including the Nextcloud plugin that does the merging. A save made on top of someone else's newer version is then rejected with "The file you are working on was updated in the meantime" instead of being merged. That is fine when one person edits a file at a time, but not for a shared whiteboard.

PDF export also stays local with the Docker image: File > Export as > PDF uses the browser's print dialog instead of draw.io's export server (https://www.drawio.com/docs/security/diagrams-docker-app/).

If you need live collaboration on your own infrastructure, a community member has posted a self-hosted relay in a comment on #3734. We don't maintain it and haven't reviewed it.

Notes for maintainers

Question, not a bug: what the Nextcloud realtime path sends to draw.io servers, and how to get merge-on-save fully on-premises.

Traced in the code:

• Live path: RT_WEBSOCKET_URL is wss://<editor host>/rt (Init.js#L54-L55). NO_P2P is on by default, so diffs, cursor, view and selection messages all go over the socket, with userId/username in the envelope (P2PCollab.js#L178-L188). Pusher is loaded for embedRT=1 unless offline/stealth (App.js#L1086-L1094) and DrawioFileSync.start subscribes to the channel. Nextcloud EmbedFile is optimistic sync, so no patches go to /cache, only the optimistic notify.
• The Nextcloud app's offline mode adds offline=1&stealth=1 (jgraph/drawio-nextcloud templates/editor.php#L4-L8, unchanged in the new maintainer's fork). offline=1 skips all plugins, including p=nxtcld (App.js#L1104-L1105), so the app's editor.js falls back to its own save handler, which surfaces the backend 409 as an error with no merge. stealth=1 also skips startSync (DrawioFile.js#L2479-L2483).
• Self-hosted Docker with offline mode off: the plugin loads from the own host, the WAR has no /rt or /cache (web.xml), and the entrypoint's default CSP leaves diagrams.net/pusher out of script-src/connect-src (docker-entrypoint.sh#L29-L36). On a 409 the plugin calls sync.fileConflict (nextcloud.js#L258-L266), and catchup without the cache reloads the file from Nextcloud and merges. This comes from reading the code; I haven't run it end to end.
• Maintainer position on a self-hostable RT relay: (Real-time) diagram collaboration via a GDPR-compliant, on-premise Nextcloud / gitlab / jgraph instance (for Teaching) #3734 (Cloudflare-specific, out of scope).

Other: jgraph/drawio-nextcloud README now marks the repo deprecated in favour of a third-party fork. The concurrent-editing docs page only says "with the official draw.io servers"; a sentence on what passes through the relay would pre-empt questions like this one.

_{Automated first response by the draw.io triage bot.}