DocuSeal on Ubuntu 24.04 on Azure User Guide

Overview

DocuSeal is an open source document signing and electronic signature platform, a self hosted alternative to services such as DocuSign, PandaDoc and HelloSign. You upload a PDF or document, place signature, initials, date, text, checkbox and file fields for each signer with a drag and drop editor, then send it out and collect legally binding electronic signatures with a full audit trail. Signers complete documents from any browser with no account required, and every completed PDF stays on infrastructure you control. The cloudimg image runs DocuSeal 3.1.5 as the official upstream container behind nginx as a systemd service, so a complete signing workflow is online within minutes of launch.

What is included:

• DocuSeal 3.1.5 (AGPL-3.0) deployed as the official docuseal/docuseal:3.1.5 container image, pinned so the image never silently upgrades
• Docker Engine (Docker CE) and the Docker Compose plugin, installed from the official Docker package repository
• A single container that runs the DocuSeal web app (Puma on port 3000) with an embedded background job runner and an embedded Redis, storing data in an SQLite database at /opt/docuseal/data on the VM
• A system nginx reverse proxy on port 80 forwarding to the app on 127.0.0.1:3000, with the WebSocket upgrade headers DocuSeal needs and an unauthenticated static /health endpoint
• A fresh SECRET_KEY_BASE (the key that encrypts your data and secures sessions) generated per instance on first boot, so no two deployments share signing or session secrets
• No pre-created account: DocuSeal's own setup wizard creates the first and only administrator on your first visit, so no default login ships in the image
• Three systemd units: nginx.service, docuseal.service (a wrapper around docker compose up -d) and docuseal-firstboot.service
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key, and a VNet plus subnet. Standard_B2s (2 vCPU / 4 GB RAM) is a comfortable size for a single team; scale up for heavier document volumes. NSG inbound rules: allow 22/tcp from your management CIDR for SSH and 80/tcp from the CIDR that needs the DocuSeal web app (add 443/tcp if you enable HTTPS with your own domain).

Step 1: Connect over SSH

Replace <vm-ip> with the public IP of your VM. The default login user is azureuser.

ssh azureuser@<vm-ip>

Step 2: Confirm the services are active

sudo systemctl is-active docker.service nginx.service docuseal.service
docker --version

You should see active printed three times, followed by the Docker Engine version.

Step 3: Confirm the DocuSeal container is running

sudo docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}"

You should see the docuseal-app-1 container running the pinned docuseal/docuseal:3.1.5 image in the Up state.

Step 4: Confirm DocuSeal is answering behind nginx

curl -s -o /dev/null -w 'GET /health   -> HTTP %{http_code}\n' http://127.0.0.1/health
curl -s -o /dev/null -w 'GET /up       -> HTTP %{http_code}\n' http://127.0.0.1/up
curl -s -o /dev/null -w 'GET /          -> HTTP %{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'GET /setup     -> HTTP %{http_code}\n' http://127.0.0.1/setup

/health and /up return 200, the root / returns 302 (it redirects an unauthenticated visitor to sign in or to the setup wizard), and /setup returns 200 on a fresh instance.

Step 5: Create your first administrator

DocuSeal ships with no accounts at all. The first person to open the instance is guided through a one time setup wizard that creates the first and only administrator. Open a browser to your VM's public address and complete the wizard immediately after launch so nobody else can claim the admin account:

http://<vm-ip>/

Fill in your name, email, a company name and a strong password, confirm the App URL, then submit. This account becomes the sole administrator of your DocuSeal instance.

Step 6: The document templates dashboard

After setup you land on the Document Templates dashboard. This is where you create reusable signable documents and track what has been sent and signed. Upload a document to get started, or click CREATE to build one from scratch.

Step 7: Build a signable document

Upload a PDF or document and DocuSeal renders every page in the template editor. Drag signature, initials, date, text, checkbox and other fields from the palette on the right onto the document and assign each one to a signer. When the document is ready, use SEND to email it to signers or SIGN YOURSELF to sign it in place.

Step 8: Manage your instance in Settings

The Settings area lets you manage your account and company name, add and remove users, configure SMTP email so signing invitations are delivered, set your electronic signature options, connect storage and webhooks, and generate API keys for integrations.

Step 9: Instance details and licence

Your per instance details are recorded on the VM. The credentials note records the instance URL and setup instructions (it holds no password, since you set that in the wizard), and the image ships the DocuSeal AGPL-3.0 licence notice:

sudo docker image ls docuseal/docuseal
sudo docker exec docuseal-app-1 cat /app/.version
sudo ls -l /root/docuseal-credentials.txt
sudo head -6 /usr/share/doc/cloudimg/third-party-licences/DOCUSEAL-LICENCE-NOTICE.txt

Enabling HTTPS with your own domain

DocuSeal is served over plain HTTP on port 80 so it works the moment the VM boots. For production use, put it behind your own domain with a TLS certificate. Point a DNS record at the VM, then obtain a certificate with Certbot and let it manage the nginx site:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> -m <your-email> --agree-tos --redirect

After HTTPS is live, open the DocuSeal Settings area and set the App URL to https://<your-domain> so signing links in emails point at your domain.

Updating DocuSeal

The image pins a specific DocuSeal release so it never changes underneath you. To move to a newer version, edit the image tag in /opt/docuseal/docker-compose.yml, then pull and recreate the container:

sudo docker compose -f /opt/docuseal/docker-compose.yml pull
sudo docker compose -f /opt/docuseal/docker-compose.yml up -d

Your database and uploaded documents live in /opt/docuseal/data and are preserved across updates. Take a snapshot of the VM disk before a major upgrade.

Support

This image is maintained by cloudimg with 24/7 support. DocuSeal is open source under the AGPL-3.0 licence; the DocuSeal name and attribution are retained in the interface as the licence requires. For product help, or to enable single sign on and advanced branding, see the DocuSeal documentation and the cloudimg support channels.