OffSign

Local-first PDF signature editor. Open a PDF in the browser, place a visual signature or lightweight fields, and export a new PDF without uploading the source document.

npm install
npm run dev

Run the production build with:

npm run check
npm run build

The app uses PDF.js for rendering and pdf-lib for writing. PDF bytes, signatures, and field text remain in browser memory; saved signatures are opt-in IndexedDB records. No analytics, remote fonts, or processing API is configured.

npm run build
docker build -t offsign:local .
docker run --rm -p 8080:3000 offsign:local

The production image uses lipanski/docker-static-website:2.6.0 as a small, non-root static runtime. It has no shell, package manager, TLS termination, or nginx configuration; put HTTPS, security headers, and advanced caching in the outer proxy or platform.

Build dist/ and deploy with the checked-in wrangler.jsonc. No server-side PDF processing or storage binding is required.

Two workflows are included:

• .github/workflows/docker-image.yml runs for every pushed tag and publishes a multi-platform image to ghcr.io/<owner>/<repository>.
• .github/workflows/cloudflare-deploy.yml runs for pushes to main, checks and builds the app, then deploys dist/ as Workers Static Assets.

Configure these GitHub repository secrets before enabling Cloudflare deployment:

The Docker workflow uses the automatically-provided GITHUB_TOKEN with packages: write, so it does not require Docker Hub credentials. The image name and Cloudflare project name are currently derived from github.repository and wrangler.jsonc; change those files if a different registry or project name is needed.

The current MVP supports local PDF opening, draw/type/image signatures, text/date/checkbox fields, drag/resize/delete, undo/redo, local signature persistence, PWA caching, and local export. It is a visual PDF stamping tool, not a certificate-backed digital signature system. Editing an already cryptographically signed PDF can invalidate its original signature.