mirror of
https://github.com/documenso/documenso.git
synced 2026-06-22 04:12:06 +10:00
Lucas Smith
d5ce222482
Adds Cloud Signature Consortium (CSC) integration for AES/QES signing against a configured TSP. v1 ships as instance-wide configuration via environment variables, with per-envelope signature level selection, license gating, and an OAuth-driven signing flow (capture + FIFO signers, SAD session, blocking/in-progress recipient pages). Includes signature level compatibility checks (role, signing order, dictate next signer), envelope mutability assertions, Prisma migration for signature level and CSC tables, and docs for the new signing certificate options.
236 lines
12 KiB
Bash
236 lines
12 KiB
Bash
# The license key to enable enterprise features for self hosters
|
|
NEXT_PRIVATE_DOCUMENSO_LICENSE_KEY=
|
|
|
|
# [[AUTH]]
|
|
NEXTAUTH_SECRET="secret"
|
|
|
|
# [[CRYPTO]]
|
|
# Application Key for symmetric encryption and decryption
|
|
# REQUIRED: This should be a random string of at least 32 characters
|
|
NEXT_PRIVATE_ENCRYPTION_KEY="CAFEBABE"
|
|
# REQUIRED: This should be a random string of at least 32 characters
|
|
NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY="DEADBEEF"
|
|
|
|
# [[AUTH OPTIONAL]]
|
|
# Find documentation on setting up Google OAuth here:
|
|
# https://docs.documenso.com/developers/self-hosting/setting-up-oauth-providers#google-oauth-gmail
|
|
NEXT_PRIVATE_GOOGLE_CLIENT_ID=""
|
|
NEXT_PRIVATE_GOOGLE_CLIENT_SECRET=""
|
|
# Find documentation on setting up Microsoft OAuth here:
|
|
# https://docs.documenso.com/developers/self-hosting/setting-up-oauth-providers#microsoft-oauth-azure-ad
|
|
NEXT_PRIVATE_MICROSOFT_CLIENT_ID=""
|
|
NEXT_PRIVATE_MICROSOFT_CLIENT_SECRET=""
|
|
|
|
NEXT_PRIVATE_OIDC_WELL_KNOWN=""
|
|
NEXT_PRIVATE_OIDC_CLIENT_ID=""
|
|
NEXT_PRIVATE_OIDC_CLIENT_SECRET=""
|
|
NEXT_PRIVATE_OIDC_PROVIDER_LABEL="OIDC"
|
|
NEXT_PRIVATE_OIDC_SKIP_VERIFY=""
|
|
# Specifies the prompt to use for OIDC signin, explicitly setting
|
|
# an empty string will omit the prompt parameter.
|
|
# See: https://www.cerberauth.com/blog/openid-connect-oauth2-prompts/
|
|
NEXT_PRIVATE_OIDC_PROMPT="login"
|
|
|
|
# [[URLS]]
|
|
NEXT_PUBLIC_WEBAPP_URL="http://localhost:3000"
|
|
# URL used by the web app to request itself (e.g. local background jobs)
|
|
NEXT_PRIVATE_INTERNAL_WEBAPP_URL="http://localhost:3000"
|
|
# OPTIONAL: Comma-separated hostnames or IPs whose webhooks are allowed to resolve to private/loopback addresses. (e.g., internal.example.com,192.168.1.5).
|
|
NEXT_PRIVATE_WEBHOOK_SSRF_BYPASS_HOSTS=
|
|
|
|
# [[SERVER]]
|
|
# OPTIONAL: The port the server will listen on. Defaults to 3000.
|
|
PORT=3000
|
|
|
|
# [[DATABASE]]
|
|
NEXT_PRIVATE_DATABASE_URL="postgres://documenso:password@127.0.0.1:54320/documenso"
|
|
# Defines the URL to use for the database when running migrations and other commands that won't work with a connection pool.
|
|
NEXT_PRIVATE_DIRECT_DATABASE_URL="postgres://documenso:password@127.0.0.1:54320/documenso"
|
|
|
|
# [[SIGNING]]
|
|
# The transport to use for document signing. Available options: local (default) | gcloud-hsm | csc
|
|
NEXT_PRIVATE_SIGNING_TRANSPORT="local"
|
|
# OPTIONAL: The passphrase to use for the local file-based signing transport.
|
|
NEXT_PRIVATE_SIGNING_PASSPHRASE=
|
|
# OPTIONAL: The local file path to the .p12 file to use for the local signing transport.
|
|
NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=
|
|
# OPTIONAL: The base64-encoded contents of the .p12 file to use for the local signing transport.
|
|
NEXT_PRIVATE_SIGNING_LOCAL_FILE_CONTENTS=
|
|
# OPTIONAL: The path to the Google Cloud HSM key to use for the gcloud-hsm signing transport.
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_KEY_PATH=
|
|
# OPTIONAL: The path to the Google Cloud HSM public certificate file to use for the gcloud-hsm signing transport.
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_PATH=
|
|
# OPTIONAL: The base64-encoded contents of the Google Cloud HSM public certificate file to use for the gcloud-hsm signing transport.
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_PUBLIC_CRT_FILE_CONTENTS=
|
|
# OPTIONAL: The path to the Google Cloud Credentials file to use for the gcloud-hsm signing transport.
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_APPLICATION_CREDENTIALS_CONTENTS=
|
|
# OPTIONAL: The path to the certificate chain file for the gcloud-hsm signing transport.
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_CERT_CHAIN_FILE_PATH=
|
|
# OPTIONAL: The base64-encoded contents of the certificate chain for the gcloud-hsm signing transport.
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_CERT_CHAIN_CONTENTS=
|
|
# OPTIONAL: The Google Secret Manager path to retrieve the certificate for the gcloud-hsm signing transport.
|
|
NEXT_PRIVATE_SIGNING_GCLOUD_HSM_SECRET_MANAGER_CERT_PATH=
|
|
# OPTIONAL: The base URL of the Cloud Signature Consortium (CSC) provider for the csc signing transport.
|
|
NEXT_PRIVATE_SIGNING_CSC_PROVIDER_BASE_URL=
|
|
# OPTIONAL: The OAuth client ID registered with the CSC provider for the csc signing transport.
|
|
NEXT_PRIVATE_SIGNING_CSC_OAUTH_CLIENT_ID=
|
|
# OPTIONAL: The OAuth client secret registered with the CSC provider for the csc signing transport.
|
|
NEXT_PRIVATE_SIGNING_CSC_OAUTH_CLIENT_SECRET=
|
|
# OPTIONAL: Default signature level for envelopes created on a CSC instance when the caller doesn't specify one. Available options: AES (default) | QES. Explicit AES/QES requests always pass through unchanged.
|
|
NEXT_PRIVATE_SIGNING_CSC_SIGNATURE_LEVEL=
|
|
# OPTIONAL: Comma-separated list of timestamp authority URLs for PDF signing (enables LTV and archival timestamps).
|
|
NEXT_PRIVATE_SIGNING_TIMESTAMP_AUTHORITY=
|
|
# OPTIONAL: Contact info to embed in PDF signatures. Defaults to the webapp URL.
|
|
NEXT_PUBLIC_SIGNING_CONTACT_INFO=
|
|
# OPTIONAL: Set to "true" to use the legacy adbe.pkcs7.detached subfilter instead of ETSI.CAdES.detached.
|
|
NEXT_PRIVATE_USE_LEGACY_SIGNING_SUBFILTER=
|
|
|
|
# [[STORAGE]]
|
|
# OPTIONAL: Defines the storage transport to use. Available options: database (default) | s3
|
|
NEXT_PUBLIC_UPLOAD_TRANSPORT="database"
|
|
# OPTIONAL: Defines the endpoint to use for the S3 storage transport. Relevant when using third-party S3-compatible providers.
|
|
NEXT_PRIVATE_UPLOAD_ENDPOINT="http://127.0.0.1:9002"
|
|
# OPTIONAL: Defines the force path style to use for the S3 storage transport. Relevant when using third-party S3-compatible providers.
|
|
# This will change it from using virtual hosts <bucket>.domain.com/<path> to fully qualified paths domain.com/<bucket>/<path>
|
|
NEXT_PRIVATE_UPLOAD_FORCE_PATH_STYLE="false"
|
|
# OPTIONAL: Defines the region to use for the S3 storage transport. Defaults to us-east-1.
|
|
NEXT_PRIVATE_UPLOAD_REGION="unknown"
|
|
# REQUIRED: Defines the bucket to use for the S3 storage transport.
|
|
NEXT_PRIVATE_UPLOAD_BUCKET="documenso"
|
|
# OPTIONAL: Defines the access key ID to use for the S3 storage transport.
|
|
NEXT_PRIVATE_UPLOAD_ACCESS_KEY_ID="documenso"
|
|
# OPTIONAL: Defines the secret access key to use for the S3 storage transport.
|
|
NEXT_PRIVATE_UPLOAD_SECRET_ACCESS_KEY="password"
|
|
|
|
# [[SMTP]]
|
|
# OPTIONAL: Defines the transport to use for sending emails. Available options: smtp-auth (default) | smtp-api | mailchannels
|
|
NEXT_PRIVATE_SMTP_TRANSPORT="smtp-auth"
|
|
# OPTIONAL: Defines the host to use for sending emails.
|
|
NEXT_PRIVATE_SMTP_HOST="127.0.0.1"
|
|
# OPTIONAL: Defines the port to use for sending emails.
|
|
NEXT_PRIVATE_SMTP_PORT=2500
|
|
# OPTIONAL: Defines the username to use with the SMTP server.
|
|
NEXT_PRIVATE_SMTP_USERNAME="documenso"
|
|
# OPTIONAL: Defines the password to use with the SMTP server.
|
|
NEXT_PRIVATE_SMTP_PASSWORD="password"
|
|
# OPTIONAL: Defines the API key user to use with the SMTP server.
|
|
NEXT_PRIVATE_SMTP_APIKEY_USER=
|
|
# OPTIONAL: Defines the API key to use with the SMTP server.
|
|
NEXT_PRIVATE_SMTP_APIKEY=
|
|
# OPTIONAL: Defines whether to force the use of TLS.
|
|
NEXT_PRIVATE_SMTP_SECURE=
|
|
# OPTIONAL: if this is true and NEXT_PRIVATE_SMTP_SECURE is false then TLS is not used even if the server supports STARTTLS extension
|
|
NEXT_PRIVATE_SMTP_UNSAFE_IGNORE_TLS=
|
|
# REQUIRED: Defines the sender name to use for the from address.
|
|
NEXT_PRIVATE_SMTP_FROM_NAME="Documenso"
|
|
# REQUIRED: Defines the email address to use as the from address.
|
|
NEXT_PRIVATE_SMTP_FROM_ADDRESS="noreply@documenso.com"
|
|
# OPTIONAL: Defines the service for nodemailer
|
|
NEXT_PRIVATE_SMTP_SERVICE=
|
|
# OPTIONAL: The API key to use for Resend.com
|
|
NEXT_PRIVATE_RESEND_API_KEY=
|
|
# OPTIONAL: The API key to use for MailChannels.
|
|
NEXT_PRIVATE_MAILCHANNELS_API_KEY=
|
|
# OPTIONAL: The endpoint to use for the MailChannels API if using a proxy.
|
|
NEXT_PRIVATE_MAILCHANNELS_ENDPOINT=
|
|
# OPTIONAL: The domain to use for DKIM signing.
|
|
NEXT_PRIVATE_MAILCHANNELS_DKIM_DOMAIN=
|
|
# OPTIONAL: The selector to use for DKIM signing.
|
|
NEXT_PRIVATE_MAILCHANNELS_DKIM_SELECTOR=
|
|
# OPTIONAL: The private key to use for DKIM signing.
|
|
NEXT_PRIVATE_MAILCHANNELS_DKIM_PRIVATE_KEY=
|
|
# OPTIONAL: Displays the maximum document upload limit to the user in MBs
|
|
NEXT_PUBLIC_DOCUMENT_SIZE_UPLOAD_LIMIT=5
|
|
|
|
# [[EE ONLY]]
|
|
# OPTIONAL: The AWS SES API KEY to verify email domains with.
|
|
NEXT_PRIVATE_SES_ACCESS_KEY_ID=
|
|
NEXT_PRIVATE_SES_SECRET_ACCESS_KEY=
|
|
NEXT_PRIVATE_SES_REGION=
|
|
|
|
# [[STRIPE]]
|
|
NEXT_PRIVATE_STRIPE_API_KEY=
|
|
NEXT_PRIVATE_STRIPE_WEBHOOK_SECRET=
|
|
|
|
# [[BACKGROUND JOBS]]
|
|
# Available options: local (default) | inngest | bullmq
|
|
NEXT_PRIVATE_JOBS_PROVIDER="local"
|
|
NEXT_PRIVATE_INNGEST_EVENT_KEY=
|
|
# OPTIONAL: Redis URL for the BullMQ jobs provider.
|
|
NEXT_PRIVATE_REDIS_URL="redis://localhost:63790"
|
|
# OPTIONAL: Key prefix for Redis to namespace queues (useful when sharing a Redis instance).
|
|
NEXT_PRIVATE_REDIS_PREFIX="documenso"
|
|
# OPTIONAL: Number of concurrent jobs to process. Defaults to 10.
|
|
# NEXT_PRIVATE_BULLMQ_CONCURRENCY=10
|
|
|
|
# [[FEATURES]]
|
|
# OPTIONAL: Leave blank to disable PostHog and feature flags.
|
|
NEXT_PUBLIC_POSTHOG_KEY=""
|
|
# OPTIONAL: Leave blank to disable billing.
|
|
NEXT_PUBLIC_FEATURE_BILLING_ENABLED=
|
|
# OPTIONAL: Set to "true" to disable all signup methods (email, Google, Microsoft, OIDC, including the organisation OIDC portal).
|
|
NEXT_PUBLIC_DISABLE_SIGNUP=
|
|
# OPTIONAL: Set to "true" to disable email/password signup only.
|
|
NEXT_PUBLIC_DISABLE_EMAIL_PASSWORD_SIGNUP=
|
|
# OPTIONAL: Set to "true" to block new-account creation through Google. Existing linked users can still sign in.
|
|
NEXT_PUBLIC_DISABLE_GOOGLE_SIGNUP=
|
|
# OPTIONAL: Set to "true" to block new-account creation through Microsoft. Existing linked users can still sign in.
|
|
NEXT_PUBLIC_DISABLE_MICROSOFT_SIGNUP=
|
|
# OPTIONAL: Set to "true" to block new-account creation through OIDC (including the organisation portal).
|
|
NEXT_PUBLIC_DISABLE_OIDC_SIGNUP=
|
|
# OPTIONAL: Comma-separated list of email domains allowed to sign up (e.g., example.com,acme.org).
|
|
NEXT_PRIVATE_ALLOWED_SIGNUP_DOMAINS=
|
|
# OPTIONAL: Set to true to use internal webapp url in browserless requests.
|
|
NEXT_PUBLIC_USE_INTERNAL_URL_BROWSERLESS=false
|
|
|
|
# [[TELEMETRY]]
|
|
# OPTIONAL: Set to "true" to disable anonymous telemetry for self-hosted instances.
|
|
# Telemetry helps us understand how Documenso is being used and improve the product.
|
|
# We only collect: app version, installation ID, and node ID. No personal data is collected.
|
|
DOCUMENSO_DISABLE_TELEMETRY=
|
|
|
|
# [[AI]]
|
|
# OPTIONAL: Google Cloud Project ID for Vertex AI.
|
|
GOOGLE_VERTEX_PROJECT_ID=""
|
|
# OPTIONAL: Google Cloud region for Vertex AI. Defaults to "global".
|
|
GOOGLE_VERTEX_LOCATION="global"
|
|
# OPTIONAL: API key for Google Vertex AI (Gemini). Get your key from:
|
|
# https://console.cloud.google.com/vertex-ai/studio/settings/api-keys
|
|
GOOGLE_VERTEX_API_KEY=""
|
|
|
|
# [[CLOUDFLARE TURNSTILE]]
|
|
# OPTIONAL: Cloudflare Turnstile site key (public). When configured, Turnstile challenges
|
|
# will be shown on sign-up (visible) and sign-in (invisible) pages.
|
|
# See: https://developers.cloudflare.com/turnstile/
|
|
NEXT_PUBLIC_TURNSTILE_SITE_KEY=
|
|
# OPTIONAL: Cloudflare Turnstile secret key (server-side verification).
|
|
NEXT_PRIVATE_TURNSTILE_SECRET_KEY=
|
|
|
|
# [[E2E Tests]]
|
|
E2E_TEST_AUTHENTICATE_USERNAME="Test User"
|
|
E2E_TEST_AUTHENTICATE_USER_EMAIL="testuser@mail.com"
|
|
E2E_TEST_AUTHENTICATE_USER_PASSWORD="test_Password123"
|
|
# OPTIONAL: Set to "true" to disable all rate limiting. Only use for E2E tests.
|
|
DANGEROUS_BYPASS_RATE_LIMITS=
|
|
|
|
# [[LOGGER]]
|
|
# OPTIONAL: The file to save the logger output to. Will disable stdout if provided.
|
|
NEXT_PRIVATE_LOGGER_FILE_PATH=
|
|
|
|
# [[PLAIN SUPPORT]]
|
|
NEXT_PRIVATE_PLAIN_API_KEY=
|
|
|
|
# [[DOCUMENT CONVERSION]]
|
|
# OPTIONAL: Base URL of a Gotenberg-compatible service used to convert uploaded
|
|
# DOCX files to PDF on the server. When unset, DOCX uploads are disabled and
|
|
# only PDF is accepted. The dev docker compose exposes Gotenberg on port 3005.
|
|
# NEXT_PRIVATE_DOCUMENT_CONVERSION_URL="http://localhost:3005"
|
|
# OPTIONAL: Per-request timeout in milliseconds for the conversion service.
|
|
# Defaults to 30000 (30s) if unset.
|
|
# NEXT_PRIVATE_DOCUMENT_CONVERSION_TIMEOUT_MS=30000
|
|
# OPTIONAL: HTTP Basic auth credentials for the conversion service. Set both
|
|
# when the service is started with `--api-enable-basic-auth` (the dev compose
|
|
# does this; the matching values there are `documenso` / `password`).
|
|
# NEXT_PRIVATE_DOCUMENT_CONVERSION_USERNAME=documenso
|
|
# NEXT_PRIVATE_DOCUMENT_CONVERSION_PASSWORD=password
|