Onlyoffice Nextcloud connector cant get files: HTTP 403 Access denied - nextcloud

Question

Environment:
we run Onlyoffice with Docker, my docker-compose.yml file is:
version: "2.0"
services:
Onlyoffice5.2.3.64:
image: 'onlyoffice/documentserver:5.2.3.64'
restart: always
volumes:
- '/etc/selfmade/docker/onlyoffice/5.2.3.64_default.json:/etc/onlyoffice/documentserver/default.json'
ports:
- '80:80'
Any requests are forwarded by our nginx proxy, the proxy delivers https.
The Nextcloud runs on a stand-alone system with an apache2 web server, there are no special deny rules configured. Only .htaccess files are included, they are not modified.
Nextcloud version: 14.0.3
App version: 2.0.4 (installed by Store in Nextcloud)
Action:
Pressing save
Problem:
Onlyoffice5.2.3.64_1 | ==> /var/log/onlyoffice/documentserver/converter/out.log <==
Onlyoffice5.2.3.64_1 | [2018-11-14 10:49:46.970] [ERROR] nodeJS - error downloadFile:url=https://onlyoffice.domain.tld/index.php/apps/onlyoffice/empty?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhY3Rpb24iOiJlbXB0eSJ9.V1-30DUaR5kUHFN3zxuU-oHGmtO9DQE0BtTYAcxVVco;attempt=1;code:undefined;connect:undefined;(id=conv_check_1738130868_docx)
Onlyoffice5.2.3.64_1 | Error: Error response: statusCode:403 ;body:
Onlyoffice5.2.3.64_1 | {"message":"Access denied"}
Onlyoffice5.2.3.64_1 | at Request._callback (/var/www/onlyoffice/documentserver/server/Common/sources/utils.js:250:18)
Onlyoffice5.2.3.64_1 | at Request.self.callback (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:185:22)
Onlyoffice5.2.3.64_1 | at emitTwo (events.js:126:13)
Onlyoffice5.2.3.64_1 | at Request.emit (events.js:214:7)
Onlyoffice5.2.3.64_1 | at Request.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1161:10)
Onlyoffice5.2.3.64_1 | at emitOne (events.js:116:13)
Onlyoffice5.2.3.64_1 | at Request.emit (events.js:211:7)
Onlyoffice5.2.3.64_1 | at IncomingMessage.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1083:12)
Onlyoffice5.2.3.64_1 | at Object.onceWrapper (events.js:313:30)
Onlyoffice5.2.3.64_1 | at emitNone (events.js:111:20)
Onlyoffice5.2.3.64_1 | [2018-11-14 10:49:48.021] [ERROR] nodeJS - error downloadFile:url=https://onlyoffice.domain.tld/index.php/apps/onlyoffice/empty?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhY3Rpb24iOiJlbXB0eSJ9.V1-30DUaR5kUHFN3zxuU-oHGmtO9DQE0BtTYAcxVVco;attempt=2;code:undefined;connect:undefined;(id=conv_check_1738130868_docx)
Onlyoffice5.2.3.64_1 | Error: Error response: statusCode:403 ;body:
Onlyoffice5.2.3.64_1 | {"message":"Access denied"}
Onlyoffice5.2.3.64_1 | at Request._callback (/var/www/onlyoffice/documentserver/server/Common/sources/utils.js:250:18)
Onlyoffice5.2.3.64_1 | at Request.self.callback (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:185:22)
Onlyoffice5.2.3.64_1 | at emitTwo (events.js:126:13)
Onlyoffice5.2.3.64_1 | at Request.emit (events.js:214:7)
Onlyoffice5.2.3.64_1 | at Request.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1161:10)
Onlyoffice5.2.3.64_1 | at emitOne (events.js:116:13)
Onlyoffice5.2.3.64_1 | at Request.emit (events.js:211:7)
Onlyoffice5.2.3.64_1 | at IncomingMessage.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1083:12)
Onlyoffice5.2.3.64_1 | at Object.onceWrapper (events.js:313:30)
Onlyoffice5.2.3.64_1 | at emitNone (events.js:111:20)
Onlyoffice5.2.3.64_1 | [2018-11-14 10:49:49.077] [ERROR] nodeJS - error downloadFile:url=https://onlyoffice.domain.tld/index.php/apps/onlyoffice/empty?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhY3Rpb24iOiJlbXB0eSJ9.V1-30DUaR5kUHFN3zxuU-oHGmtO9DQE0BtTYAcxVVco;attempt=3;code:undefined;connect:undefined;(id=conv_check_1738130868_docx)
Onlyoffice5.2.3.64_1 | Error: Error response: statusCode:403 ;body:
Onlyoffice5.2.3.64_1 | {"message":"Access denied"}
Onlyoffice5.2.3.64_1 | at Request._callback (/var/www/onlyoffice/documentserver/server/Common/sources/utils.js:250:18)
Onlyoffice5.2.3.64_1 | at Request.self.callback (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:185:22)
Onlyoffice5.2.3.64_1 | at emitTwo (events.js:126:13)
Onlyoffice5.2.3.64_1 | at Request.emit (events.js:214:7)
Onlyoffice5.2.3.64_1 | at Request.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1161:10)
Onlyoffice5.2.3.64_1 | at emitOne (events.js:116:13)
Onlyoffice5.2.3.64_1 | at Request.emit (events.js:211:7)
Onlyoffice5.2.3.64_1 | at IncomingMessage.<anonymous> (/var/www/onlyoffice/documentserver/server/Common/node_modules/request/request.js:1083:12)
Onlyoffice5.2.3.64_1 | at Object.onceWrapper (events.js:313:30)
Onlyoffice5.2.3.64_1 | at emitNone (events.js:111:20)
And an ngrep tell me:
T <ip onlyoffice>:80 -> <load balancer>:52070 [AP]
HTTP/1.1 200 OK..Server: nginx..Date: Wed, 14 Nov 2018 10:49:50 GMT..Content-Type: text/xml; charset=UTF-8..Content-Length: 80..Connection: close..Vary: Accept-Encoding..X-Powered-By: Express..ETag: W/"50-z
nhOfxspmYa/tCyRfpwopdInS1U"....<?xml version="1.0" encoding="utf-8"?><FileResult><Error>-4</Error></FileResult>

Answer 1

'/etc/selfmade/docker/onlyoffice/5.2.3.64_default.json:/etc/onlyoffice/documentserver/default.json'
Please also map /etc/onlyoffice/documentserver/local.json
It should contain your secret key, as the value from local.json will overwrite the value from default.json