DocuSeal
Overview
DocuSeal is an open-source document signing and electronic signature platform, a self-hosted alternative to services such as DocuSign, PandaDoc and HelloSign. You upload a PDF or document, place signature, initials, date, text, checkbox and file fields for each signer with a drag-and-drop editor, then send it out and collect legally binding electronic signatures with a full audit trail.
Signers complete documents from any browser with no account required, and every completed PDF stays on infrastructure you control. The SecureAnyCloud image runs DocuSeal 3.1.5 as the official upstream container behind nginx as a systemd service, so a complete signing workflow is online within minutes of launch.
What you get:
- DocuSeal 3.1.5 (AGPL-3.0) deployed as the official
docuseal/docuseal:3.1.5container image, pinned so the image never silently upgrades. - Docker Engine (Docker CE) and the Docker Compose plugin, installed from the official Docker package repository.
- A single container that runs the DocuSeal web app (Puma on port 3000) with an embedded background job runner and an embedded Redis, storing data in an SQLite database at
/opt/docuseal/dataon the VM. - A system
nginxreverse proxy on port 80 forwarding to the app on127.0.0.1:3000, with the WebSocket upgrade headers DocuSeal needs and an unauthenticated static/healthendpoint. - A fresh
SECRET_KEY_BASE(the key that encrypts your data and secures sessions) generated per instance on first boot, so no two deployments share signing or session secrets. - No pre-created account. DocuSeal's own setup wizard creates the first and only administrator on your first visit, so no default login ships in the image.
- Three systemd units:
nginx.service,docuseal.service(a wrapper arounddocker compose up -d) anddocuseal-firstboot.service. - 24/7 SecureAnyCloud support.
Prerequisites
Before you deploy, make sure you have:
- An active Azure subscription, an SSH key, and a VNet plus subnet.
- A Standard_B2s (2 vCPU / 4 GB RAM) VM, which is a comfortable size for a single team. Scale up for heavier document volumes.
- An NSG inbound rule that allows
22/tcpfrom your management CIDR for SSH. - An NSG inbound rule that allows
80/tcpfrom the CIDR that needs the DocuSeal web app. Add443/tcpif you enable HTTPS with your own domain.
Connect over SSH
Connect with SSH as azureuser, the default login user. Replace <vm-ip> with the public IP of your VM.
ssh azureuser@<vm-ip>Confirm the services are active
Check the three services and the Docker version:
sudo systemctl is-active docker.service nginx.service docuseal.service docker --versionThe output shows active three times, followed by the Docker Engine version.
Confirm the DocuSeal container is running
List the running containers:
sudo docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}"The docuseal-app-1 container runs the pinned docuseal/docuseal:3.1.5 image in the Up state.
Confirm DocuSeal is answering behind nginx
Send four requests to the local nginx and print the status code of each:
curl -s -o /dev/null -w 'GET /health -> HTTP %{http_code}\n' http://127.0.0.1/health
curl -s -o /dev/null -w 'GET /up -> HTTP %{http_code}\n' http://127.0.0.1/up
curl -s -o /dev/null -w 'GET / -> HTTP %{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'GET /setup -> HTTP %{http_code}\n' http://127.0.0.1/setup/health and /up return 200. The root / returns 302, because it redirects an unauthenticated visitor to sign in or to the setup wizard. /setup returns 200 on a fresh instance.
Create your first administrator
DocuSeal ships with no accounts at all. The first person to open the instance is guided through a one-time setup wizard that creates the first and only administrator. Open a browser to your VM's public address, and complete the wizard immediately after launch so nobody else can claim the admin account:
http://<vm-ip>/Fill in your name, email, a company name and a strong password. Confirm the App URL, then submit. This account becomes the sole administrator of your DocuSeal instance.
The document templates dashboard
After setup, you land on the Document Templates dashboard. This is where you create reusable signable documents and track what has been sent and signed. Upload a document to get started, or click CREATE to build one from scratch.
Build a signable document
Upload a PDF or document, and DocuSeal renders every page in the template editor. Drag signature, initials, date, text, checkbox and other fields from the palette on the right onto the document, and assign each one to a signer.
When the document is ready, use SEND to email it to signers or SIGN YOURSELF to sign it in place.
Manage your instance in Settings
Open Settings to manage your account and company name, and to add and remove users. Configure SMTP email there so signing invitations are delivered. You can also set your electronic signature options, connect storage and webhooks, and generate API keys for integrations.
Instance details and licence
Your per-instance details are recorded on the VM. The credentials note records the instance URL and setup instructions. It holds no password, because you set that in the wizard. The image also ships the DocuSeal AGPL-3.0 licence notice. Run these commands to inspect them:
sudo docker image ls docuseal/docuseal
sudo docker exec docuseal-app-1 cat /app/.version
sudo ls -l /root/docuseal-credentials.txt
sudo head -6 /usr/share/doc/sac/third-party-licences/DOCUSEAL-LICENCE-NOTICE.txtEnabling HTTPS with your own domain
DocuSeal is served over plain HTTP on port 80, so it works the moment the VM boots. For production use, put it behind your own domain with a TLS certificate. Point a DNS record at the VM, then obtain a certificate with Certbot and let it manage the nginx site:
sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> -m <your-email> --agree-tos --redirectAfter HTTPS is live, open the DocuSeal Settings area and set the App URL to https://<your-domain>, so signing links in emails point at your domain.
Updating DocuSeal
The image pins a specific DocuSeal release, so it never changes underneath you. To move to a newer version, edit the image tag in /opt/docuseal/docker-compose.yml, then pull and recreate the container:
sudo docker compose -f /opt/docuseal/docker-compose.yml pull
sudo docker compose -f /opt/docuseal/docker-compose.yml up -dYour database and uploaded documents live in /opt/docuseal/data and are preserved across updates. Take a snapshot of the VM disk before a major upgrade.
Support
SecureAnyCloud maintains this image and provides 24/7 support. DocuSeal is open source under the AGPL-3.0 licence, and the DocuSeal name and attribution are retained in the interface as the licence requires.
For product help, or to enable single sign-on and advanced branding, see the DocuSeal documentation and the SecureAnyCloud support channels.
Deploy on Azure
Launch DocuSeal 3.1.5 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.
View on Marketplace
Need Help?
Our support team is available 24/7.
sales@secureanycloud.com