SignaturePDF on Ubuntu 24.04 on Azure User Guide

Overview

SignaturePDF is a free, open source web application for working with PDF documents in the browser. You can sign a PDF on your own or send it to several people to sign in turn, reorder, rotate or delete pages, edit document metadata, and compress large files, all without installing anything on your desktop. Because everything runs on a server you own, your documents are processed on your own instance and never pass through a third party. The cloudimg image serves SignaturePDF 1.10.0 through nginx and PHP 8.3 FPM on a hardened, fully patched Ubuntu 24.04 LTS base, with the complete PDF toolchain pre installed and proven working.

SignaturePDF has no built in login of its own, so a self managed deployment left open would let anyone who finds the address reach your PDF tools. This image closes that gap before the VM is ever reachable. Authentication is enforced by nginx across the entire application, so there is no unauthenticated route to any PDF operation. A unique administrator password is generated on the first boot of every VM and written to a root only file, so no shared or default login ever ships in the image. Backed by 24/7 cloudimg support.

What is included:

• SignaturePDF 1.10.0 served by nginx and PHP 8.3 FPM, managed by systemd
• The full PDF toolchain: ghostscript, pdftk, ImageMagick, librsvg and potrace, pre installed and verified
• HTTP Basic authentication enforced on every application route, so there is no unauthenticated route to your PDFs
• A per VM administrator password generated on first boot and recorded in a root only file
• The in browser PDF viewer served correctly, so documents render and can be signed, organised and edited in the browser
• Raised PHP upload limits so real, multi megabyte PDFs upload without error
• Shared signing storage kept outside the web document root, so an uploaded file can never be executed
• nginx.service and php8.3-fpm.service as enabled systemd units, plus a daily cleanup timer for shared documents
• An open /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for very large documents or heavier concurrent use. NSG inbound: allow 22/tcp from your management network and 80/tcp for the web interface. The image serves plain HTTP on port 80 by default. Because HTTP Basic authentication sends the password in an easily decoded header, enable TLS before exposing the instance to the public internet, as described in Step 9.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for SignaturePDF by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name signaturepdf \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the web interface:

az vm open-port --resource-group <your-rg> --name signaturepdf --port 80

Find the public address to browse to:

az vm show --resource-group <your-rg> --name signaturepdf --show-details --query publicIps -o tsv

Step 3 - Connect and confirm the services are running

SSH in as azureuser:

ssh azureuser@<vm-public-ip>

Confirm nginx, PHP FPM and the first boot unit are all active:

systemctl is-active nginx php8.3-fpm signature-pdf-firstboot

Expected output:

active
active
active

Step 4 - Retrieve the per VM administrator password

Every VM generates its own administrator password on first boot and writes it, along with the login user, to a root only credentials file. Read it with sudo:

sudo cat /root/signature-pdf-credentials.txt

You sign in with username admin and the SIGNATUREPDF_ADMIN_PASSWORD value from this file.

Note that the SIGNATUREPDF_URL line records the address the VM sees itself on. Azure does not expose a Standard SKU public IP through the instance metadata service, so on those VMs this line shows the private address. Browse to the public address from Step 2 instead.

Step 5 - Confirm authentication is enforced

This is the property that matters most, because SignaturePDF has no login of its own: nothing is reachable without credentials. Confirm that an unauthenticated request to the application is refused with 401, while the health probe endpoint stays open for Azure Load Balancer:

curl -s -o /dev/null -w 'unauthenticated app -> HTTP %{http_code}\n' http://127.0.0.1/

curl -s -o /dev/null -w 'health probe -> HTTP %{http_code}\n' http://127.0.0.1/healthz

Now confirm the per VM password does authenticate:

curl -s -o /dev/null -w 'authenticated app -> HTTP %{http_code}\n' -u 'admin:<SIGNATUREPDF_ADMIN_PASSWORD>' http://127.0.0.1/

Expected output:

unauthenticated app -> HTTP 401
health probe -> HTTP 200
authenticated app -> HTTP 200

Step 6 - Sign in to SignaturePDF

Browse to http://<vm-public-ip>/. Your browser prompts for a username and password with a native sign in dialog. Enter admin and the password from Step 4. Nothing is served until you do, so there is no way to reach the PDF tools without these credentials.

Once authenticated, SignaturePDF opens on its tools: organise pages, sign, edit metadata and compress, all reachable from the interface.

Step 7 - Sign a PDF

Open the Sign tool, choose a PDF, and it renders in the editor. Draw or type a signature, or add an initial, stamp, text, checkbox, strikethrough, redaction area or watermark, then place it on the page. When you are done, choose Download the signed PDF, or Share to sign with multiple people to send the document to others to sign in turn.

Step 8 - Compress, organise pages and edit metadata

Open the Compress tool, choose a PDF, pick a compression level and select Compress. SignaturePDF processes the file on the server and reports the new size, then offers it for download. The document is processed in place and is not retained on the server.

The Organize tool shows every page as a thumbnail so you can reorder, rotate, delete or extract pages, or merge several PDFs into one.

The Metadata tool reads the document's existing metadata into editable fields, so you can change the title, author, producer and other properties, then save and download the updated PDF.

Step 9 - The PDF toolchain and an end to end check

SignaturePDF's operations are backed by standard open source tools, all pre installed. Confirm they are present:

gs --version && rsvg-convert --version && potrace --version | head -1

pdftk --version 2>/dev/null | grep -i -m1 version && convert --version | head -1

The image ships a sample PDF you can use to confirm the compress pipeline end to end from the shell. This uploads the sample, compresses it, and saves the result:

curl -s -u 'admin:<SIGNATUREPDF_ADMIN_PASSWORD>' -F 'pdf=@/usr/local/share/signature-pdf/sample.pdf;type=application/pdf' -F 'compressionType=medium' http://127.0.0.1/compress -o /tmp/compressed.pdf && head -c 5 /tmp/compressed.pdf && echo ' <- a valid PDF was returned'

Expected output:

%PDF- <- a valid PDF was returned

Step 10 - Enable HTTPS with Let's Encrypt

HTTP Basic authentication sends your password in an easily decoded header, so it must not be used over plain HTTP on an untrusted network. Before exposing this instance to the public internet, point a DNS name at the VM, open port 443 in the NSG, and issue a certificate. Run these on the VM, replacing the placeholders with your own domain and email:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com -m you@example.com --agree-tos --redirect --non-interactive

Certbot edits the nginx server block in place, keeps the existing authentication stanza, and installs a renewal timer. After it completes, browse to https://your-domain.example.com/.

Step 11 - Change the administrator password

The credential is an nginx htpasswd entry. To set your own password, run htpasswd and reload nginx:

sudo htpasswd -B /etc/nginx/.htpasswd-signaturepdf admin
sudo systemctl reload nginx

To add a second account, use the same command with a different username. Every account listed in the file has the same access to the application.

Server components

Filesystem layout

Managing the service

systemctl status nginx --no-pager | head -3

sudo systemctl restart nginx php8.3-fpm
sudo journalctl -u nginx -n 50 --no-pager

Troubleshooting

The browser keeps asking for a password. The password is the SIGNATUREPDF_ADMIN_PASSWORD value in /root/signature-pdf-credentials.txt, and the username is admin. If you have lost it, set a new one with sudo htpasswd -B /etc/nginx/.htpasswd-signaturepdf admin followed by sudo systemctl reload nginx.

A PDF opens but does not render in the browser. The in browser viewer uses JavaScript modules that must be served with a JavaScript content type. This image is configured to do that; if you have edited the nginx server block, compare it against /etc/nginx/sites-available/cloudimg-signaturepdf and run sudo nginx -t.

Uploads fail for large files. The image allows uploads up to 64 MB. To raise it, edit upload_max_filesize and post_max_size in /etc/php/8.3/fpm/conf.d/99-signaturepdf.ini, raise client_max_body_size in the nginx server block to match, then restart both services.

The health probe returns 401. The /healthz endpoint is the single deliberately unauthenticated path. If it is prompting for credentials, the server block has been edited; compare it against /etc/nginx/sites-available/cloudimg-signaturepdf and run sudo nginx -t.

Security notes

• Authentication is enforced by nginx on every path except /healthz. SignaturePDF has no login of its own, so this front door is what keeps your instance private; there is no unauthenticated route to any PDF operation.
• The image serves plain HTTP by default. Enable TLS as described in Step 10 before exposing the instance to the public internet, and restrict port 80 in the NSG to trusted networks in the meantime.
• The per VM administrator password lives in /root/signature-pdf-credentials.txt, readable only by root. Keep a copy somewhere safe and change it to a password of your own with htpasswd.
• Your documents are processed entirely on this instance and are not sent to any third party. The shared signing storage sits outside the web document root, so an uploaded file can never be executed by the web server.
• Everyone listed in the htpasswd file has full access to the application. Give out accounts accordingly.
• Keep the VM patched. The image ships fully patched with unattended security upgrades enabled.

Support

cloudimg images come with 24/7 support. If you have any questions about this SignaturePDF image or need help with your deployment, contact us through the cloudimg website.