Here are the results of the tail command you requested:
ā ~ tail -25 /srv/onlyoffice/logs/documentserver/converter/out.log
at Request.emit (events.js:400:28)
at Request.onRequestResponse (/snapshot/server/build/server/Common/node_modules/request/request.js:1059:10)
at ClientRequest.emit (events.js:400:28)
at HTTPParser.parserOnIncomingClient (_http_client.js:647:27)
at HTTPParser.parserOnHeadersComplete (_http_common.js:126:17)
at TLSSocket.socketOnData (_http_client.js:515:22)
at TLSSocket.emit (events.js:400:28)
at addChunk (internal/streams/readable.js:290:12)
at readableAddChunk (internal/streams/readable.js:265:9)
at TLSSocket.Readable.push (internal/streams/readable.js:204:10)
at TLSWrap.onStreamRead (internal/stream_base_commons.js:188:23)
[2022-06-15T23:41:04.954] [ERROR] nodeJS - error downloadFile:url=https://cloud.txp-network.ml/apps/onlyoffice/empty?doc=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhY3Rpb24iOiJlbXB0eSJ9.bJ2t7gW_WS2fxz5y41YqbzaXU56MfQfEDGF1ZbLcbHg;attempt=3;code:undefined;connect:undefined;(id=conv_check_302951734_docx)
Error: Error response: statusCode:403; headers:{"server":"openresty","date":"Wed, 15 Jun 2022 23:41:04 GMT","content-type":"application/json; charset=utf-8","content-length":"27","connection":"keep-alive","referrer-policy":"no-referrer","x-content-type-options":"nosniff","x-download-options":"noopen","x-frame-options":"SAMEORIGIN","x-permitted-cross-domain-policies":"none","x-robots-tag":"none","x-xss-protection":"1; mode=block","x-powered-by":"PHP/8.0.19","set-cookie":["oc4cibqapg7s=6c23616ef3b76f304c48fec09a8c4f32; path=/; secure; HttpOnly; SameSite=Lax","oc_sessionPassphrase=xvx5ef8lpgK4hiKa5s%2BNBcKArAupvpCxuNjLsMw0rt8emnOdIFfxw3wCC2HnwMvk0iOguRIx0YFQGlh8IaGaBmxcTiMj5vAy1nXQTyAwDQ%2Bg09AsloxO9vp1RLB1ve9%2B; path=/; secure; HttpOnly; SameSite=Lax","oc4cibqapg7s=37a0c69ca2516f6ccf34330a162d4cf4; path=/; secure; HttpOnly; SameSite=Lax","__Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax","__Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict"],"expires":"Thu, 19 Nov 1981 08:52:00 GMT","cache-control":"no-cache, no-store, must-revalidate","pragma":"no-cache","content-security-policy":"default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'","feature-policy":"autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'","strict-transport-security":"max-age=63072000; preload"};
at Request.fResponse (/snapshot/server/build/server/Common/sources/utils.js)
at Request.emit (events.js:400:28)
at Request.onRequestResponse (/snapshot/server/build/server/Common/node_modules/request/request.js:1059:10)
at ClientRequest.emit (events.js:400:28)
at HTTPParser.parserOnIncomingClient (_http_client.js:647:27)
at HTTPParser.parserOnHeadersComplete (_http_common.js:126:17)
at TLSSocket.socketOnData (_http_client.js:515:22)
at TLSSocket.emit (events.js:400:28)
at addChunk (internal/streams/readable.js:290:12)
at readableAddChunk (internal/streams/readable.js:265:9)
at TLSSocket.Readable.push (internal/streams/readable.js:204:10)
at TLSWrap.onStreamRead (internal/stream_base_commons.js:188:23)
The Nextcloud and OnlyOffice instances have their own subdomains - cloud.domain.suffix and docs.domain.suffix respectively.