Setting Up Docuseal for Document Signing

Managing docuseal effectively is a crucial skill for any system administrator. This tutorial provides step-by-step instructions for documents configuration, along with best practices for production environments.

Prerequisites

• A reverse proxy configured (Nginx or Traefik)
• Root or sudo access to the server
• Basic familiarity with the Linux command line
• A VPS running Ubuntu 22.04 or later (2GB+ RAM recommended)
• Docker and Docker Compose installed

Docker Compose Setup

If you encounter issues during setup, check the system logs first. Most problems can be diagnosed by examining the output of journalctl or the application-specific log files in /var/log/.

# docker-compose.yml
version: '3.8'
services:
  docuseal:
    image: docuseal/docuseal:latest
    restart: unless-stopped
    ports:
      - "8080:8080"
    volumes:
      - docuseal_data:/data
      - docuseal_config:/config
    environment:
      - TZ=UTC
      - PUID=1000
      - PGID=1000
    depends_on:
      - db

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    volumes:
      - db_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=docuseal
      - POSTGRES_USER=docuseal
      - POSTGRES_PASSWORD=changeme

volumes:
  docuseal_data:
  docuseal_config:
  db_data:

This configuration provides a good balance between performance and resource usage. For high-traffic scenarios, you may need to increase the limits further.

• Document all configuration changes
• Maintain runbooks for common operations
• Test disaster recovery procedures regularly
• Set up monitoring before going to production
• Use version control for configuration files

Initial Configuration

Regular maintenance is essential for keeping your docuseal installation running smoothly. Schedule periodic reviews of log files, disk usage, and security updates to prevent issues before they occur.

# Reverse proxy configuration
server {
    listen 443 ssl http2;
    server_name docuseal.example.com;

    ssl_certificate /etc/letsencrypt/live/docuseal.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/docuseal.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        client_max_body_size 0;
    }
}

Each line in the configuration serves a specific purpose. The comments explain the reasoning behind each setting, making it easier to customize for your specific use case.

Advanced Settings

After applying these changes, monitor the server's resource usage for at least 24 hours to ensure stability. Tools like htop, iostat, and vmstat can provide real-time insights into system performance.

Reverse Proxy Integration

The default configuration works well for development environments, but production servers require additional tuning. Pay particular attention to connection limits, timeout values, and logging settings.

# docker-compose.yml
version: '3.8'
services:
  docuseal:
    image: docuseal/docuseal:latest
    restart: unless-stopped
    ports:
      - "8080:8080"
    volumes:
      - docuseal_data:/data
      - docuseal_config:/config
    environment:
      - TZ=UTC
      - PUID=1000
      - PGID=1000
    depends_on:
      - db

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    volumes:
      - db_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=docuseal
      - POSTGRES_USER=docuseal
      - POSTGRES_PASSWORD=changeme

volumes:
  docuseal_data:
  docuseal_config:
  db_data:

This configuration provides a good balance between performance and resource usage. For high-traffic scenarios, you may need to increase the limits further.

Important Notes

The default configuration works well for development environments, but production servers require additional tuning. Pay particular attention to connection limits, timeout values, and logging settings.

• Review log files weekly for anomalies
• Test your backup restore procedure monthly
• Enable automatic security updates for critical patches

Data Persistence

For production deployments, consider implementing high availability by running multiple instances behind a load balancer. This approach provides both redundancy and improved performance under heavy load.

# Reverse proxy configuration
server {
    listen 443 ssl http2;
    server_name docuseal.example.com;

    ssl_certificate /etc/letsencrypt/live/docuseal.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/docuseal.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        client_max_body_size 0;
    }
}

Make sure to restart the service after applying these changes. Some settings require a full restart rather than a reload to take effect.

• Use strong, unique passwords for all services
• Enable firewall and allow only necessary ports
• Set up fail2ban for brute force protection
• Use SSH keys instead of password authentication

Common Issues and Solutions

• Connection timeout: Verify your firewall rules allow traffic on the required ports. Use ss -tlnp to confirm the service is listening on the expected port.
• Service won't start: Check the logs with journalctl -xe -u docuseal. Common causes include port conflicts, missing configuration files, or insufficient permissions.

Wrapping Up

Following this guide, your docuseal setup should be production-ready. Keep an eye on resource usage as your traffic grows and don't forget to test your backup and recovery procedures periodically.