Documenso

cpln helm install RELEASE_NAME oci://ghcr.io/controlplane-com/templates/documenso \
  --version 1.0.0 --gvc GVC_NAME \
  --set location=LOCATION_NAME \
  --set secrets.name=APP_KEYS_SECRET_NAME \
  --set signing.certificateSecretName=SIGNING_CERT_SECRET_NAME \
  --set postgres.config.credentialsSecretName=DB_CREDENTIALS_SECRET_NAME

# The ONE location of your GVC that Documenso runs in; it must already be a GVC location.
location: aws-us-east-1

documenso:
  image: documenso/documenso:v2.21.1  # published tags carry the leading v
  replicas: 1                         # stateless; 2+ keeps the UI up through a rolling restart
  publicUrl: ""                       # empty = canonical endpoint (http://localhost:3000 when private); custom domain with scheme, e.g. https://sign.example.com
  resources:
    minCpu: 500m
    maxCpu: 2000m
    minMemory: 1Gi
    maxMemory: 2Gi

secrets:
  name: my-documenso-secrets
signing:
  certificateSecretName: my-documenso-signing-cert

signup:
  disabled: false        # open so you can create your account; set true right after
  allowedDomains: ""     # comma-separated, e.g. "example.com,acme.org"; empty = any

storage:
  type: database              # database (PDFs stored in PostgreSQL) | s3
  documentSizeLimitMb: 5      # max single upload
  s3:
    bucket: my-documenso-bucket
    region: us-east-1
    endpoint: ""              # S3-compatible servers only, e.g. http://my-minio.GVC.cpln.local:9000
    forcePathStyle: false     # true for most S3-compatible servers (MinIO)
    cloudAccountName: my-documenso-cloud-account   # AWS keyless auth (used when auth.secretName is empty)
    policyName: my-documenso-s3-policy             # your bucket-scoped IAM policy (README Storage setup)
    auth:
      secretName: ""          # S3-compatible servers only: dictionary with accessKeyId + secretAccessKey, e.g. my-documenso-s3-keys

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket"],
    "Resource": ["arn:aws:s3:::YOUR_BUCKET_NAME", "arn:aws:s3:::YOUR_BUCKET_NAME/*"]
  }]
}

cpln secret create-dictionary --name S3_KEYS_SECRET_NAME \
  --entry accessKeyId=ACCESS_KEY \
  --entry secretAccessKey=SECRET_KEY

smtp:
  enabled: false              # off = no verification or signature-request mail
  host: smtp.example.com
  port: 587
  secure: false               # false = STARTTLS/plain (587); true = implicit TLS (465)
  fromAddress: documenso@example.com
  fromName: Documenso
  auth:
    secretName: ""            # optional dictionary with username + password, e.g. my-documenso-smtp

cpln secret create-dictionary --name SMTP_SECRET_NAME \
  --entry username=SMTP_USERNAME \
  --entry password=SMTP_PASSWORD

telemetry:
  enabled: false              # true = upstream's PostHog startup event and hourly heartbeat

publicAccess:
  enabled: true               # signers are external, so signing links need the public endpoint
internalAccess:
  type: same-gvc              # none | same-gvc | same-org | workload-list
  workloads: []               # workload-list only; this release's own workloads are always added
  # workloads:
  #   - //gvc/GVC_NAME/workload/WORKLOAD_NAME

# set postgresHA.enabled: true (and postgres.enabled: false) for near-zero-downtime upgrades and failover
postgres:
  enabled: true
  image: postgres:18
  config:
    # REQUIRED — MUST EXIST BEFORE INSTALL, or the deployment WEDGES silently. A `dictionary` with the
    # URL-safe keys username, password, database (see README Prerequisites).
    credentialsSecretName: my-documenso-db-credentials
  resources:
    minCpu: 250m
    maxCpu: 1000m
    minMemory: 512Mi
    maxMemory: 1Gi
  volumeset:
    capacity: 10              # GiB (minimum 10); raise it for `database` storage

postgresHA:
  enabled: false
  config:
    # REQUIRED in HA mode — MUST EXIST BEFORE INSTALL. Same `dictionary` shape as postgres.config above.
    credentialsSecretName: my-documenso-db-credentials
  replicas: 3
  resources:
    minCpu: 500m
    maxCpu: 1000m
    minMemory: 1Gi
    maxMemory: 2Gi
  volumeset:
    capacity: 10              # GiB per replica (minimum 10)

cpln port-forward RELEASE_NAME-documenso 3000:3000 --gvc GVC_NAME
curl -s http://localhost:3000/api/certificate-status

cpln workload exec RELEASE_NAME-postgres --gvc GVC_NAME --container postgresql -- \
  psql -U documenso -d documenso \
  -c "UPDATE \"User\" SET \"emailVerified\" = NOW(), roles = '{ADMIN}' WHERE email = 'you@example.com';"

cpln workload force-redeployment RELEASE_NAME-documenso --gvc GVC_NAME