Lien : https://docs.documenso.com/

Lien : https://docs.documenso.com/docs/self-hosting/deployment/docker-compose

• Docker 20.10 or later
• Docker Compose v2.0 or later
• SMTP credentials for sending emails
• At least 2GB of available RAM
• A domain name (for production deployments)

• conteneur LXC : 2 Gio RAM ; 2 coeurs ; DD de 20 Gio
• modifier le fichier /etc/apt/sources.list.d/debian.sources pour avoir ce contenu (http://security.debian.org trixie-security remplacé par http://deb.debian.org/debian-security)

Types: deb
URIs: http://deb.debian.org/debian-security
Suites: trixie-security
Components: contrib main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Types: deb
URIs: http://deb.debian.org/debian
Suites: trixie trixie-updates
Components: contrib main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

• ajouter les dépôts

# Add Docker's official GPG key:
apt update
apt install ca-certificates curl
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/debian
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
Components: stable
Signed-By: /etc/apt/keyrings/docker.asc
EOF

• mettre à jour

apt update && apt upgrade -y

• installer Docker

apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

• Vérifier l'installation:

docker --version
docker compose version

• installer git

apt install git -y

git clone https://github.com/documenso/documenso.git
cd documenso/docker/production

# Generate NEXTAUTH_SECRET
echo "NEXTAUTH_SECRET=$(openssl rand -base64 32)"
# Generate encryption keys
echo "NEXT_PRIVATE_ENCRYPTION_KEY=$(openssl rand -base64 32)"
echo "NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=$(openssl rand -base64 32)"
# Generate database password
echo "POSTGRES_PASSWORD=$(openssl rand -base64 24)"

Créer le fichier d'environnement .env dans le même dossier que celui qui contient compose.yml (documenso/docker/production)

touch .env

• contenu du fichier .env

# Database (used by both database and documenso services)
POSTGRES_USER=documenso
POSTGRES_PASSWORD=your-secure-database-password
POSTGRES_DB=documenso

# Application secrets (generate with: openssl rand -base64 32)
NEXTAUTH_SECRET=your-nextauth-secret
NEXT_PRIVATE_ENCRYPTION_KEY=your-encryption-key-min-32-characters
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=your-secondary-key-min-32-characters

# Public URL where Documenso is accessible
NEXT_PUBLIC_WEBAPP_URL=https://sign.example.com
NEXT_PRIVATE_INTERNAL_WEBAPP_URL=http://localhost:3000

# Database connection (uses Docker service name)
NEXT_PRIVATE_DATABASE_URL=postgresql://documenso:your-secure-database-password@database:5432/documenso

# Email configuration
NEXT_PRIVATE_SMTP_TRANSPORT=smtp-auth
NEXT_PRIVATE_SMTP_HOST=smtp.example.com
NEXT_PRIVATE_SMTP_PORT=587
NEXT_PRIVATE_SMTP_USERNAME=your-smtp-username
NEXT_PRIVATE_SMTP_PASSWORD=your-smtp-password
NEXT_PRIVATE_SMTP_FROM_NAME=Documenso
NEXT_PRIVATE_SMTP_FROM_ADDRESS=noreply@example.com

Un certificat signé est requis pour signer les documents. Généré un certificat .p12 sur le serveur et le monter dans le conteneur.

openssl genrsa -out private.key 2048

openssl req -new -x509 -key private.key -out certificate.crt -days 365

Au prompt, renseigner les informations de l'organisation :

Création du certificat .p12 et création du fichier PKCS#12 (.p12) contenant ce certificat et la clé privée. Un mot de passe doit être renseigné pour protéger le fichier .p12

openssl pkcs12 -export -out certificate.p12 -inkey private.key -in certificate.crt

• Pour saisir le mot de passe de manière non interactive :

 
# Set password securely (won't appear in command history)
read -s -p "Enter certificate password: " CERT_PASS
echo
openssl pkcs12 -export -out certificate.p12 -inkey private.key -in certificate.crt \
    -password env:CERT_PASS

Supprimer les fichiers intermédiaires:

rm private.key certificate.crt

• Gardez certificate.p12 and le mot de passe

# Check certificate details
openssl pkcs12 -in certificate.p12 -info -nokeys
# Verify password works
openssl pkcs12 -in certificate.p12 -noout

Placer le certificat sur l'hôte et définir les permissions pour que le conteneur puisse le lire (UID 1001):

mkdir -p /opt/documenso
cp /root/documenso/docker/production/certificate.p12 /opt/documenso/cert.p12
chown 1001:1001 /opt/documenso/cert.p12
chmod 400 /opt/documenso/cert.p12

Le compose.yml va monter ce chemin dans le conteneur. Ajoutez la passphrase au fichier .env :

NEXT_PRIVATE_SIGNING_PASSPHRASE=your-certificate-password

If file mounting is not available, you can set NEXTPRIVATESIGNINGLOCALFILE_CONTENTS with the base64-encoded certificate string instead.

docker compose --env-file .env up -d

* vérifier que les conteneurs s'exécutent:

docker compose ps

* sorties attendues :

NAME                             STATUS              PORTS
documenso-production-database-1  running (healthy)   5432/tcp
documenso-production-documenso-1 running             0.0.0.0:3000->3000/tcp
Wait for the database to be healthy and for migrations to complete. Check the logs:

docker compose logs -f documenso