LibreSign on Ubuntu 24.04 LTS

Why the cloudimg image

The part that normally goes wrong is the toolchain. LibreSign cannot sign anything until a Java runtime, JSignPdf and a PDF toolkit are present, and out of the box it downloads them from the internet the first time an administrator tries to use it, which fails outright on a locked down network and leaves a half configured signer if it is interrupted. cloudimg installs all of it at build time, checksum verified, and the instance passes the signer's own integrity checks with no outbound access at all, so it signs the moment it boots.

The second thing cloudimg closes is identity. Everything a signature depends on is generated on your own instance the first time it boots, before the web front door is allowed to start: the administrator password, the database and cache passwords, the instance identifier, the session secret and password salt, the TLS certificate, and the root certificate authority that issues every signer certificate. No two instances share a value and nothing usable is baked into the image, so the private key behind your signatures never existed anywhere else. Only three ports are reachable, the database and cache answer on the loopback interface only and the cache refuses unauthenticated connections, documents and database sit on a dedicated data volume you can back up as one mount point, and the base is fully patched with unattended security updates left enabled. Every image is paired with a deploy guide tested against this exact build and backed by 24/7 cloudimg support.