docs: add legal storage policy, DocuSeal deploy template, and app4 migration plan

2026-08-15 15:45:36 -04:00
parent 4d43623db6
commit 26b985f6a4
5 changed files with 619 additions and 0 deletions
@@ -0,0 +1,33 @@
+# DocuSeal environment template. Replace every <...> placeholder.
+# Never commit real values. chmod 600 after filling.
+
+# Public base URL
+HOST=https://sign.<entity>.example.com
+FORCE_SSL=true
+
+# Encryption root. Generate with: openssl rand -hex 64
+# NEVER rotate on a live instance (ActiveRecord encryption root).
+SECRET_KEY_BASE=<openssl rand -hex 64>
+
+# SMTP (netcup smarthost: only port 2525 works; 25/465/587 are blocked)
+SMTP_ADDRESS=<smtp-relay-hostname>
+SMTP_PORT=2525
+SMTP_USERNAME=<noreply@entity-domain>
+SMTP_PASSWORD=<smtp-relay-password>
+SMTP_AUTHENTICATION=login
+SMTP_ENABLE_STARTTLS=true
+SMTP_DOMAIN=<entity-domain>
+SMTP_SSL_VERIFY=true
+
+# SMTP_FROM is inert: DocuSeal hardcodes the mailer from as
+# "DocuSeal <info@docuseal.com>". Do not expect it to change the sender.
+
+# S3/Wasabi attachments. Uncomment and fill once the <entity>-legal bucket exists.
+# Presence of S3_ATTACHMENTS_BUCKET activates S3 storage. Left unset, DocuSeal
+# uses local disk storage under ./data/attachments.
+#S3_ATTACHMENTS_BUCKET=<entity>-legal
+#S3_ENDPOINT=s3.us-east-1.wasabisys.com
+#AWS_ACCESS_KEY_ID=<wasabi-access-key-id>
+#AWS_SECRET_ACCESS_KEY=<wasabi-secret-access-key>
+#AWS_REGION=us-east-1
+#ACTIVE_STORAGE_PUBLIC=false