# Document Signing — DocuSeal Deployment

## Deploy

```yaml
# docker-compose.yml — deployed at /root/docker/docuseal/
services:
  docuseal:
    image: docuseal/docuseal:latest
    container_name: docuseal
    restart: always
    ports:
      - "127.0.0.1:3000:3000"
    volumes:
      - ./data:/data
    environment:
      - HOST=http://localhost:3000
      - FORCE_SSL=false
```

Deploy:
```bash
docker compose -f /root/docker/docuseal/docker-compose.yml up -d
```

## Live Status (Jul 7, 2026)

- **URL:** https://sign.itpropartner.com — LIVE with HTTPS via Caddy
- **Caddy config:** `/etc/caddy/Caddyfile` — reverse proxy to 127.0.0.1:3000
- **Admin:** info@itpropartner.com (Germaine Brown)
- **API Token:** yyQ39y1fPtvWzUzFPZXfGBJhGD9ko3o7ACZLc3388sz
- **Docker:** docuseal/docuseal:latest on Core (netcup)
- **Data:** `/root/docker/docuseal/data/` (SQLite)
- **Port 443 freed by:** Stopping Tailscale Serve (which was serving portal mockups)

## API Usage

```bash
curl -s -H "X-Auth-Token: <token>" https://sign.itpropartner.com/api/user
```

## Why DocuSeal over Documenso

| Factor | Documenso | DocuSeal |
|---|---|---|
| Docker image | 690 MB | 227 MB |
| Database | PostgreSQL required | SQLite (no extra service) |
| Embed SDK | Paid (~$300/yr) | Free (React, Vue, Angular, JS) |
| Webhooks | Basic | Auto-retry |
| Features | Core signing | Bulk CSV send, conditional fields, SMS |

## Usage across entities

- **Debt Recovery Experts** — LPOA notarization via Proof API + service agreements via DocuSeal
- **Forefront Wireless** — customer service agreements, waivers
- **BoxPilot Logistics** — intake forms, LPOA
- **Apex Track Experience** — liability waivers (alternative to WPForms)

## Planned Webhook (DRE)

When the DRE portal builds: `https://debtrecoveryexperts.com/api/webhooks/docuseal` — events: document signed, completed, signer link opened.

## Note on Notarized Documents (LPOA)

DocuSeal handles digital signatures (ESIGN/UETA compliant). For **Remote Online Notarization** (RON) of Limited Power of Attorney forms, use **Proof** (formerly Notarize) API — ~$25-35 per notarization, with on-demand notaries 24/7. Texas RON compliant (HB 3496, SB 1624).

## Digest timestamp server

In DocuSeal e-signature settings, set the RFC 3161 timestamp server to: `http://timestamp.digicert.com` (DigiCert, free, no auth, universally trusted). This embeds a cryptographic timestamp in every signed document for long-term verification validity. Backup option: `http://timestamp.sectigo.com`.

## TLS setup (blocked port 443)

Tailscale Serve uses port 443 for tailnet HTTPS. To run a public-facing web service on port 443 alongside Tailscale, either:
- Stop Tailscale Serve (`tailscale serve --https=443 off`) — frees port 443 for Caddy/nginx. The portal mockups will lose their tailscale URL until re-served on a different port or redirected.
- Or use **Cloudflare Tunnel** (cloudflared) — creates an outbound-only tunnel to Cloudflare's edge, lives on an ephemeral port, never conflicts with other services. Requires `cloudflared tunnel login` (browser-based OAuth to Cloudflare account). The tunnel cert file is created in `~/.cloudflared/`. After auth, create the tunnel, route the DNS, and configure ingress.

**Pitfall:** `cloudflared tunnel login` prints a URL that must be opened in a browser OUTSIDE the terminal — it's an OAuth flow. If there's no browser available (headless server), use a different approach.

## DocuSeal auth setup

After first deployment at `https://sign.itpropartner.com`, the initial visit redirects to `/setup` — create the admin account (name, email, password, company). After setup, generate an API token from Settings → API tokens. Token format: `yyQ39y...` (JWT-like string). The token read-only endpoint: `GET /api/user` with `X-Auth-Token` header.

## Backup Required

`/root/docker/docuseal/data/` contains the SQLite DB (all users, templates, signed documents). NOT yet in the nightly S3 backup rotation — needs to be added.