What you need
Platforms
Section titled “Platforms”Windows Server, Linux and macOS, on both Intel and ARM. The portable bundle ships per-platform archives:
| Platform | Archive |
|---|---|
| Windows, any recent Server or desktop | plugboard-win32-x64.zip |
| Linux, Intel or AMD | plugboard-linux-x64.tar.gz |
| Linux, ARM | plugboard-linux-arm64.tar.gz |
| macOS, Apple silicon | plugboard-darwin-arm64.tar.gz |
| macOS, Intel | plugboard-darwin-x64.tar.gz |
Runtime and database
Section titled “Runtime and database”| Requirement | Notes | |
|---|---|---|
| Node.js | 20.9 or later | Only needed for a source install. The bundle can carry its own |
| pnpm | Any recent version | Source installs only. npm i -g pnpm |
| PostgreSQL | 14 or later | 16 is what CI tests against. The bundle carries its own |
| Redis | Optional | Only the legacy people-sync and digest worker use it |
| Object storage | Optional | S3-compatible. MinIO locally, S3 in cloud. Only for logos, photos and exports |
| Docker | Optional | Only for the Compose route |
If you are running the bundle, none of the above needs to exist on the machine. That is the point of it.
| Port | Process | Exposure |
|---|---|---|
| 3000 | Web | Behind your proxy, or direct on a trusted LAN |
| 4000 | API | Behind your proxy, or direct on a trusted LAN |
| 443 | Reverse proxy | The only one that should face users |
| 5432 | PostgreSQL | Never exposed beyond the host or the container network |
Both application ports are configurable with WEB_PORT and API_PORT.
The Compose stack publishes nothing by default. It listens on the internal network only, and you attach an ingress profile or your own proxy.
Outbound network access
Section titled “Outbound network access”The application itself needs no outbound access to run. Connectors do, and only the ones you enable.
| If you enable | It reaches |
|---|---|
| Jamf Pro | https://yourorg.jamfcloud.com |
| Microsoft Intune | login.microsoftonline.com, graph.microsoft.com |
| Kandji | https://yourorg.api.kandji.io |
| Mosyle | managerapi.mosyle.com or businessapi.mosyle.com |
| Chrome Enterprise | oauth2.googleapis.com, admin.googleapis.com |
| Google Workspace or Sheets | oauth2.googleapis.com, gmail.googleapis.com, sheets.googleapis.com |
| Zendesk | https://yourorg.zendesk.com |
| Twilio | api.twilio.com |
| Salesforce | https://yourorg.my.salesforce.com |
| ThreatLocker | Your ThreatLocker portal API |
| Stripe | api.stripe.com |
| Apple GSX, CompNow, Dell | The vendor endpoint you configure |
| Automatic updates | The release endpoint and GitHub Releases |
| Usage telemetry | Your telemetry endpoint, if licensed and not disabled |
Connectors that reach systems on your own network instead of the internet are LDAP and Active Directory, Synergetic, Web Help Desk, PaperCut and printers over SNMP. A self-hosted install on the same network reaches them directly.
Outbound fetch guard
Section titled “Outbound fetch guard”Plugboard blocks outbound requests to private, loopback and link-local addresses by default, so a tenant-supplied URL (a service monitor target, a webhook endpoint) cannot be used to reach internal hosts or a cloud metadata service.
An on-premises install that legitimately monitors LAN addresses needs to opt out:
ALLOW_PRIVATE_EGRESS=1Leave it off for anything multi-tenant. See the security model.
Nothing emails anyone until an email connector exists. Repair tracking links, ready-for-collection notices, purchase receipts, monitor alerts, backup failure alerts and scheduled reports all go through it.
You need either an SMTP server you can authenticate to, or a Google Workspace service account with domain-wide delegation. See SMTP and Google Workspace.
Certificates
Section titled “Certificates”HTTPS is expected. The application will start without it and tell you so, which is fine for a first look on the machine itself and not fine for anything a staff member reaches.
Any of these work:
- A public certificate from Let’s Encrypt, issued automatically by the bundled Caddy profile.
- A wildcard you already own.
- A certificate from your school’s internal CA, including Active Directory Certificate Services.
- A PKCS#12 file, which is what most Windows tooling produces.
The machine’s clock matters more than it looks. SLA calculations, scheduled backups, the overnight update check, TOTP two-factor codes and licence expiry all read it. Run NTP.
The overnight update check uses the machine’s own local time, so a server set to
UTC in a school in Sydney will update at 1am UTC, which is the middle of the
school day. Either fix the timezone or set AUTO_UPDATE_HOUR.
A note on antivirus
Section titled “A note on antivirus”Endpoint protection that scans every file write will make the database slow.
Exclude the data directory (.pgdata for the bundle, the Docker volume
otherwise) if you can.