Deployment guide

DocuSeal

Overview

DocuSeal is an open-source document signing and electronic signature platform, a self-hosted alternative to services such as DocuSign, PandaDoc and HelloSign. You upload a PDF or document, place signature, initials, date, text, checkbox and file fields for each signer with a drag-and-drop editor, then send it out and collect legally binding electronic signatures with a full audit trail.

Signers complete documents from any browser with no account required, and every completed PDF stays on infrastructure you control. The SecureAnyCloud image runs DocuSeal 3.1.5 as the official upstream container behind nginx as a systemd service, so a complete signing workflow is online within minutes of launch.

What you get:

  • DocuSeal 3.1.5 (AGPL-3.0) deployed as the official docuseal/docuseal:3.1.5 container image, pinned so the image never silently upgrades.
  • Docker Engine (Docker CE) and the Docker Compose plugin, installed from the official Docker package repository.
  • A single container that runs the DocuSeal web app (Puma on port 3000) with an embedded background job runner and an embedded Redis, storing data in an SQLite database at /opt/docuseal/data on the VM.
  • A system nginx reverse proxy on port 80 forwarding to the app on 127.0.0.1:3000, with the WebSocket upgrade headers DocuSeal needs and an unauthenticated static /health endpoint.
  • A fresh SECRET_KEY_BASE (the key that encrypts your data and secures sessions) generated per instance on first boot, so no two deployments share signing or session secrets.
  • No pre-created account. DocuSeal's own setup wizard creates the first and only administrator on your first visit, so no default login ships in the image.
  • Three systemd units: nginx.service, docuseal.service (a wrapper around docker compose up -d) and docuseal-firstboot.service.
  • 24/7 SecureAnyCloud support.

Prerequisites

Before you deploy, make sure you have:

  • An active Azure subscription, an SSH key, and a VNet plus subnet.
  • A Standard_B2s (2 vCPU / 4 GB RAM) VM, which is a comfortable size for a single team. Scale up for heavier document volumes.
  • An NSG inbound rule that allows 22/tcp from your management CIDR for SSH.
  • An NSG inbound rule that allows 80/tcp from the CIDR that needs the DocuSeal web app. Add 443/tcp if you enable HTTPS with your own domain.
1

Connect over SSH

Connect with SSH as azureuser, the default login user. Replace <vm-ip> with the public IP of your VM.

ssh azureuser@<vm-ip>
2

Confirm the services are active

Check the three services and the Docker version:

sudo systemctl is-active docker.service nginx.service docuseal.service docker --version

The output shows active three times, followed by the Docker Engine version.

3

Confirm the DocuSeal container is running

List the running containers:

sudo docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}"

The docuseal-app-1 container runs the pinned docuseal/docuseal:3.1.5 image in the Up state.

4

Confirm DocuSeal is answering behind nginx

Send four requests to the local nginx and print the status code of each:

curl -s -o /dev/null -w 'GET /health -> HTTP %{http_code}\n' http://127.0.0.1/health
curl -s -o /dev/null -w 'GET /up -> HTTP %{http_code}\n' http://127.0.0.1/up
curl -s -o /dev/null -w 'GET / -> HTTP %{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'GET /setup -> HTTP %{http_code}\n' http://127.0.0.1/setup

/health and /up return 200. The root / returns 302, because it redirects an unauthenticated visitor to sign in or to the setup wizard. /setup returns 200 on a fresh instance.

5

Create your first administrator

DocuSeal ships with no accounts at all. The first person to open the instance is guided through a one-time setup wizard that creates the first and only administrator. Open a browser to your VM's public address, and complete the wizard immediately after launch so nobody else can claim the admin account:

http://<vm-ip>/

Fill in your name, email, a company name and a strong password. Confirm the App URL, then submit. This account becomes the sole administrator of your DocuSeal instance.

6

The document templates dashboard

After setup, you land on the Document Templates dashboard. This is where you create reusable signable documents and track what has been sent and signed. Upload a document to get started, or click CREATE to build one from scratch.

7

Build a signable document

Upload a PDF or document, and DocuSeal renders every page in the template editor. Drag signature, initials, date, text, checkbox and other fields from the palette on the right onto the document, and assign each one to a signer.

When the document is ready, use SEND to email it to signers or SIGN YOURSELF to sign it in place.

8

Manage your instance in Settings

Open Settings to manage your account and company name, and to add and remove users. Configure SMTP email there so signing invitations are delivered. You can also set your electronic signature options, connect storage and webhooks, and generate API keys for integrations.

9

Instance details and licence

Your per-instance details are recorded on the VM. The credentials note records the instance URL and setup instructions. It holds no password, because you set that in the wizard. The image also ships the DocuSeal AGPL-3.0 licence notice. Run these commands to inspect them:

sudo docker image ls docuseal/docuseal
sudo docker exec docuseal-app-1 cat /app/.version
sudo ls -l /root/docuseal-credentials.txt
sudo head -6 /usr/share/doc/sac/third-party-licences/DOCUSEAL-LICENCE-NOTICE.txt

Enabling HTTPS with your own domain

DocuSeal is served over plain HTTP on port 80, so it works the moment the VM boots. For production use, put it behind your own domain with a TLS certificate. Point a DNS record at the VM, then obtain a certificate with Certbot and let it manage the nginx site:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> -m <your-email> --agree-tos --redirect

After HTTPS is live, open the DocuSeal Settings area and set the App URL to https://<your-domain>, so signing links in emails point at your domain.

Updating DocuSeal

The image pins a specific DocuSeal release, so it never changes underneath you. To move to a newer version, edit the image tag in /opt/docuseal/docker-compose.yml, then pull and recreate the container:

sudo docker compose -f /opt/docuseal/docker-compose.yml pull
sudo docker compose -f /opt/docuseal/docker-compose.yml up -d

Your database and uploaded documents live in /opt/docuseal/data and are preserved across updates. Take a snapshot of the VM disk before a major upgrade.

Support

SecureAnyCloud maintains this image and provides 24/7 support. DocuSeal is open source under the AGPL-3.0 licence, and the DocuSeal name and attribution are retained in the interface as the licence requires.

For product help, or to enable single sign-on and advanced branding, see the DocuSeal documentation and the SecureAnyCloud support channels.

Deploy on Azure

Launch DocuSeal 3.1.5 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure