SignaturePDF

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Use a larger size for very large documents or heavier concurrent use.

In the network security group (NSG), allow inbound 22/tcp from your management network and 80/tcp for the web interface.

The image serves plain HTTP on port 80 by default. HTTP Basic authentication sends the password in an easily decoded header, so enable TLS before you expose the instance to the public internet, as described in Step 10.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, choose Create a resource, search the Marketplace for SignaturePDF by SecureAnyCloud, and select Create.

1. On Basics, pick your subscription, resource group, region and size.
2. Under Administrator account, choose SSH public key and paste your key.
3. Under Inbound port rules, allow SSH (22) and HTTP (80).
4. Choose Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:signature-pdf-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name signaturepdf \
  --image sac1647283583153:signature-pdf-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 to the web interface:

az vm open-port --resource-group <your-rg> --name signaturepdf --port 80

Find the public address to browse to:

az vm show --resource-group <your-rg> --name signaturepdf --show-details --query publicIps -o tsv

Step 3 - Connect and confirm the services are running

SSH in as azureuser:

ssh azureuser@<vm-public-ip>

Confirm that nginx, PHP FPM and the first-boot unit are all active:

systemctl is-active nginx php8.3-fpm signature-pdf-firstboot

Expected output:

active active active

Step 4 - Retrieve the per-VM administrator password

Every VM generates its own administrator password on first boot and writes it, along with the login user, to a root-only credentials file. Read the file with sudo:

sudo cat /root/signature-pdf-credentials.txt

Sign in with username admin and the SIGNATUREPDF_ADMIN_PASSWORD value from this file.

The SIGNATUREPDF_URL line records the address the VM sees itself on. Azure does not expose a Standard SKU public IP through the instance metadata service, so on those VMs this line shows the private address. Browse to the public address from Step 2 instead.

Step 5 - Confirm authentication is enforced

This property matters most. SignaturePDF has no login of its own, so nothing is reachable without credentials. Confirm that an unauthenticated request to the application is refused with 401, while the health probe endpoint stays open for Azure Load Balancer:

curl -s -o /dev/null -w 'unauthenticated app -> HTTP %{http_code}\n' http://127.0.0.1/

curl -s -o /dev/null -w 'health probe -> HTTP %{http_code}\n' http://127.0.0.1/healthz

Now confirm that the per-VM password authenticates:

curl -s -o /dev/null -w 'authenticated app -> HTTP %{http_code}\n' -u 'admin:<SIGNATUREPDF_ADMIN_PASSWORD>' http://127.0.0.1/

Expected output:

unauthenticated app -> HTTP 401 health probe -> HTTP 200 authenticated app -> HTTP 200

Step 6 - Sign in to SignaturePDF

Browse to http://<vm-public-ip>/. Your browser prompts for a username and password in a native sign-in dialog. Enter admin and the password from Step 4. Nothing is served until you do.

After you sign in, SignaturePDF opens on its tools: organize pages, sign, edit metadata and compress.

Step 7 - Sign a PDF

Open the Sign tool and choose a PDF. The PDF renders in the editor.

Draw or type a signature, or add an initial, stamp, text, checkbox, strikethrough, redaction area or watermark, then place it on the page. When you finish, choose Download the signed PDF. To send the document to others to sign in turn, choose Share to sign with multiple people.

Step 8 - Compress, organise pages and edit metadata

Open the Compress tool, choose a PDF, pick a compression level and select Compress. SignaturePDF processes the file on the server, reports the new size and offers the file for download. The document is processed in place and is not retained on the server.

The Organize tool shows every page as a thumbnail. Use it to reorder, rotate, delete or extract pages, or to merge several PDFs into one.

The Metadata tool reads the document's existing metadata into editable fields. Change the title, author, producer or other properties, then save and download the updated PDF.

Step 9 - The PDF toolchain and an end-to-end check

SignaturePDF's operations are backed by standard open source tools, all pre-installed. Confirm that they are present:

gs --version && rsvg-convert --version && potrace --version | head -1

pdftk --version 2>/dev/null | grep -i -m1 version && convert --version | head -1

The image ships a sample PDF that you can use to test the compress pipeline end to end from the shell. This command uploads the sample, compresses it and saves the result:

curl -s -u 'admin:<SIGNATUREPDF_ADMIN_PASSWORD>' -F 'pdf=@/usr/local/share/signature-pdf/sample.pdf;type=application/pdf' -F 'compressionType=medium' http://127.0.0.1/compress -o /tmp/compressed.pdf && head -c 5 /tmp/compressed.pdf && echo ' <- a valid PDF was returned'

Expected output:

%PDF- <- a valid PDF was returned

Step 10 - Enable HTTPS with Let's Encrypt

HTTP Basic authentication sends your password in an easily decoded header, so do not use it over plain HTTP on an untrusted network. Before you expose this instance to the public internet, point a DNS name at the VM, open port 443 in the NSG, and issue a certificate.

Run these commands on the VM. Replace the domain and email with your own:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com -m you@example.com --agree-tos --redirect --non-interactive

Certbot edits the nginx server block in place, keeps the existing authentication stanza and installs a renewal timer. When it completes, browse to https://your-domain.example.com/.

Step 11 - Change the administrator password

The credential is an nginx htpasswd entry. To set your own password, run htpasswd and reload nginx:

sudo htpasswd -B /etc/nginx/.htpasswd-signaturepdf admin
sudo systemctl reload nginx

To add a second account, use the same command with a different username. Every account listed in the file has the same access to the application.

Server components

Component Version Purpose

SignaturePDF 1.10.0 The PDF signing, organising, metadata and compression web app

nginx Ubuntu 24.04 package Web server, and the point at which authentication is enforced

PHP FPM 8.3 Runs the SignaturePDF application

ghostscript / pdftk / ImageMagick / librsvg / potrace Ubuntu 24.04 packages The PDF operation toolchain

Ubuntu Server 24.04 LTS Base operating system, patched at build time

Filesystem layout

Path Purpose

/var/www/signaturepdf The SignaturePDF application tree

/var/www/signaturepdf/public The nginx document root (front controller)

/var/www/signaturepdf/config/config.ini The application configuration

/var/lib/signaturepdf/storage Temporary storage for the shared signing feature, outside the document root

/usr/local/share/signature-pdf/sample.pdf A sample PDF for testing

/etc/nginx/.htpasswd-signaturepdf The HTTP Basic credential file

/etc/nginx/sites-available/sac-signaturepdf The nginx server block

/root/signature-pdf-credentials.txt The per VM credentials, readable only by root

Managing the service

systemctl status nginx --no-pager | head -3

sudo systemctl restart nginx php8.3-fpm
sudo journalctl -u nginx -n 50 --no-pager

Troubleshooting

The browser keeps asking for a password. The password is the SIGNATUREPDF_ADMIN_PASSWORD value in /root/signature-pdf-credentials.txt, and the username is admin. If you have lost it, set a new one with sudo htpasswd -B /etc/nginx/.htpasswd-signaturepdf admin, then run sudo systemctl reload nginx.

A PDF opens but does not render in the browser. The in-browser viewer uses JavaScript modules that must be served with a JavaScript content type. This image is configured to do that. If you have edited the nginx server block, compare it against /etc/nginx/sites-available/sac-signaturepdf and run sudo nginx -t.

Uploads fail for large files. The image allows uploads up to 64 MB. To raise it, edit upload_max_filesize and post_max_size in /etc/php/8.3/fpm/conf.d/99-signaturepdf.ini, raise client_max_body_size in the nginx server block to match, then restart both services.

The health probe returns 401. The /healthz endpoint is the single deliberately unauthenticated path. If it prompts for credentials, the server block has been edited. Compare it against /etc/nginx/sites-available/sac-signaturepdf and run sudo nginx -t.

Security notes

• Authentication is enforced by nginx on every path except /healthz. SignaturePDF has no login of its own, so this front door keeps your instance private. There is no unauthenticated route to any PDF operation.
• The image serves plain HTTP by default. Enable TLS as described in Step 10 before you expose the instance to the public internet. Until then, restrict port 80 in the NSG to trusted networks.
• The per-VM administrator password is stored in /root/signature-pdf-credentials.txt, readable only by root. Keep a copy somewhere safe, and change it to a password of your own with htpasswd.
• Your documents are processed entirely on this instance and are not sent to any third party. The shared signing storage sits outside the web document root, so the web server can never execute an uploaded file.
• Everyone listed in the htpasswd file has full access to the application. Give out accounts accordingly.
• Keep the VM patched. The image is patched at build time and ships with unattended security upgrades enabled.

Support

SecureAnyCloud images come with 24/7 support. If you have questions about this SignaturePDF image or need help with your deployment, contact us through the SecureAnyCloud website.

Deploy on Azure

Launch SignaturePDF on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com