Operate / PRODUCT GUIDE

System requirements

Components and versions, platforms, the services you provide, ports, clients and sizing defaults for release 1.0.0-rc.1.

Reviewed 2026-11-15Print-friendly guide

What this chapter covers#

This chapter lists what release 1.0.0-rc.1 needs: the components and the versions its deployment files use, where it can be deployed, the services you provide, the ports and outbound connections, the clients, and the sizing defaults in the deployment files. Where the release states no minimum version or size, this chapter says it is not specified.

Runtime components#

ComponentVersion in this releaseNotes
Backend image1.0.0-rc.1One image for the API (which contains the integration gateway), the workers, database migrations, the upgrade check, the bootstrap command and the CUCM gateway service. Go binaries on Alpine Linux 3.24, run as a non-root user.
Web image1.0.0-rc.1The Web UI and its server-side API proxy. The image carries its own Node.js runtime, so nothing is installed on the host.
Voice-gateway Asterisk image1.0.0-rc.1, optionalOnly for live call routing through Cisco CUCM.
PostgreSQL16The system of record. The supplied Compose files, the on-prem image example and continuous integration all use PostgreSQL 16; no other major version is stated as tested. The first migration creates the pgcrypto extension if it is missing, so the migration identity must be allowed to create it, or install it beforehand.
NATS with JetStream2.10Durable transport for committed outbox events. Compose runs one node with one stream replica. Production expects your own cluster of three or five nodes with TLS, authentication, file storage and at least three stream replicas; the chart sets three by default.
Redis7.4 in the on-prem example, optionalIncluded in the on-prem Compose profile for customer cache workloads. The application does not use it, and the Helm chart needs no Redis endpoint.
IngressNGINX stable-alpine in the on-prem exampleTerminates TLS for the Web and API host names. With Helm, use your own ingress controller; the chart's default ingress class is nginx.
Prometheus, Grafana, OpenTelemetry CollectorPrometheus 3.5.0 in the on-prem example; Grafana and the Collector are not pinnedThe optional local observability profile. Use your approved versions.

Release images are built for linux/amd64 and linux/arm64; see Prepare the environment for signing, SBOMs and image mirroring.

Deployment targets#

TargetWhat it needsMinimum version
Small install with Docker ComposeOne container host with Docker Engine and the Compose v2 docker compose command, plus Bash and OpenSSL. The backup script also needs Python 3 and sha256sum or shasum.Not specified for Docker Engine or Compose.
Production on Kubernetes with HelmA cluster with an ingress controller, plus your own PostgreSQL and NATS. The on-prem overlay's egress policy needs a CNI that enforces NetworkPolicy. ServiceMonitors need the Prometheus Operator CRDs, and External Secrets is optional.Helm 3 or later, because the chart uses chart API version v2. Kubernetes: not specified; the chart declares no minimum version.
Hosts and nodeslinux/amd64 or linux/arm64 container hosts.Operating system and kernel versions: not specified.

Build toolchains#

These are needed only where you build images or the mobile apps, not on the hosts that run AckNexa.

What you buildToolchain used by this release
Backend imageGo 1.27.4 in the Dockerfile's build stage; the Go module requires Go 1.26 or newer. The build cross-compiles for amd64 and arm64.
Web imageNode.js 24 in the build stage. The resulting image carries its own Node.js runtime.
iOS appA Mac with Xcode 16 or newer, XcodeGen, and an Apple Developer Program membership for push notifications and TestFlight.
Android appAndroid Studio (Ladybug 2024.2 or newer) or the included Gradle 8.9 wrapper, JDK 17 or 21, and Android SDK Platform 35. Direct push needs your own Firebase project.

Services you provide#

Every deployment needs these:

ServiceNotes
TLS ingress or load balancerTwo host names, one for the Web UI and one for the API, with certificates from your PKI. Compose includes NGINX with your tls.crt and tls.key. With Helm, use your ingress controller and an internal VIP, appliance or load balancer; no cloud load balancer is needed.
DNS and time synchronizationPrivate DNS for both host names. Keep clocks synchronized: signed webhooks with a timestamp more than five minutes off are rejected, and voice-gateway callbacks are signed with timestamps.
PostgreSQL and NATS for HelmYour highly available PostgreSQL with verified TLS and separate runtime and migration identities, and an authenticated TLS NATS cluster. The chart deploys only the stateless AckNexa components. Compose runs both on the same host.
Secret storageProtected files for Compose; Kubernetes Secrets or an internal secret manager for Helm. This includes ACKNEXA_CONFIG_KEY, which needs its own protected backup.
Backup storageEncrypted, customer-controlled storage for database backups and keys. For production, PostgreSQL WAL archiving and point-in-time recovery tooling.
Independent monitoring (recommended)Prometheus and Alertmanager in a separate failure domain. The optional Compose observability profile runs on the same host it watches.

Only for the features you enable:

ServiceNotes
Private CAMount your CA bundle for the backend (SSL_CERT_FILE) and the Web runtime (NODE_EXTRA_CA_CERTS), and install it on browsers and phones.
SMTP serverEmail notifications, stakeholder and status-page subscriber email, and postmortem reminders. STARTTLS and certificate verification are required.
Identity providerOpenID Connect single sign-on, LDAP or Active Directory over ldaps:// or StartTLS, and SCIM 2.0 provisioning. Keep a local break-glass administrator.
Mobile pushYour own APNs key for a self-built iOS app, your own Firebase service account for a self-built Android app, or a push-relay credential. The relay cannot be combined with your own APNs or FCM settings.
TwilioSMS, voice calls and a Twilio hotline number. Twilio must reach PROVIDER_CALLBACK_BASE_URL over HTTPS.
TelephonyAn HTTPS bridge to your PBX for voice paging (VOICE_GATEWAY_URL), or Cisco CUCM with a SIP trunk to the bundled gateway for live call routing.
Jira or HaloTickets per incident. Inbound ticket webhooks also use PROVIDER_CALLBACK_BASE_URL.
SIEMAn HTTPS collector, or a syslog receiver over TLS, for audit streaming.

Ports#

The ports AckNexa components listen on inside their containers, as set by the supplied deployment files.

ComponentPort inside the containerExposure
Ingress (Compose NGINX)443, HTTPSPublished on ACKNEXA_BIND_ADDR and ACKNEXA_HTTPS_PORT, by default loopback port 8443. Serves the Web and API host names.
API8080, HTTPBehind the ingress. Also serves /health/live, /health/ready and /metrics. The Helm API ingress publishes only /v1, /v2, /scim, /integrations, /calendar, /heartbeat and /health.
Workers9090, HTTPHealth and metrics only; not published.
Web3000, HTTPBehind the ingress.
PostgreSQL and NATS in Compose5432; 4222 for clients and 8222 for monitoringOn the internal backend network only; not published.
Grafana (observability profile)3000Published on loopback port 3300 by default (GRAFANA_PORT).
CUCM gateway: Asterisk (optional)SIP 5060 over UDP and TCP; RTP over UDP 10000 to 10099Published on the host in Compose, and bound with host networking by default in Helm. Allow them only from CUCM and your media endpoints. Calls to CUCM go to its port 5060 over TCP by default.
CUCM gateway service (optional)4573 for FastAGI from Asterisk; 8090 for voicemail recordingsInternal. Compose serves voicemail links through the ingress on port 8444.

Outbound connections#

The core needs none of these: each is needed only when you enable the matching feature. Private destinations configured by an organization also need NOTIFICATION_PRIVATE_CIDRS; see Notification egress.

FeatureDestinationProtocol
APNs with your own keyapi.push.apple.com, and api.sandbox.push.apple.com for development buildsHTTPS
FCM with your own service accountfcm.googleapis.com and oauth2.googleapis.comHTTPS
Push relayThe relay URL you are given (PUSH_RELAY_URL)HTTPS
Twilioapi.twilio.com; Twilio calls back to PROVIDER_CALLBACK_BASE_URLHTTPS
Slackhooks.slack.com and hooks.slack-gov.com, always allowedHTTPS on port 443
Microsoft Teams, Mattermost, outbound webhooks, HTTPS SIEM collectorsHosts you list in NOTIFICATION_WEBHOOK_HOSTSHTTPS on port 443
Syslog SIEMHosts you list in AUDIT_SYSLOG_HOSTSSyslog over TLS
EmailYour SMTP server (SMTP_ADDR); servers configured by an organization must be in NOTIFICATION_SMTP_HOSTSSMTP with STARTTLS
Jira and HaloThe configured base URLs, limited by TICKETING_HOSTS when setHTTPS; HTTP only with TICKETING_ALLOW_HTTP=true
Identity providerYour OIDC issuer and LDAP serversHTTPS; ldaps:// or StartTLS
Voice bridge to your PBXVOICE_GATEWAY_URLHTTPS

Clients#

ClientRequirement
Web browserNot specified: no list of supported browsers is published for this release. The browser must reach the Web host name over HTTPS and trust its certificate chain.
iOS appiOS 17.0 or later. For this release the operator builds the app; it is not in the App Store.
Android appAndroid 8.0 (API level 26) or later; it targets Android 15 (API level 35). For this release the operator builds the app; it is not in Google Play.
Phones on a private networkA route to the API host name, directly or over your VPN, with private DNS and your CA on the device. Push also needs Apple or Google connectivity.

See Web and mobile access for how the apps are distributed and how pages reach a phone.

Sizing#

This release has no certified sizing guide. The figures below are the defaults in the supplied deployment files, not a capacity statement. Validate CPU, memory, storage and connection limits against your own load, as described in Capacity and deployment evidence.

Helm workloadDefault replicasRequests per containerLimits per container
API3500m CPU, 512 MiB2 CPU, 2 GiB
Workers3500m CPU, 512 MiB2 CPU, 2 GiB
Web3200m CPU, 256 MiB1 CPU, 1 GiB
Upgrade-check and migration JobsOne run per install or upgrade100m CPU, 128 MiB1 CPU, 512 MiB
CUCM gateway (optional)1Asterisk 100m CPU, 128 MiB; gateway 50m CPU, 64 MiBAsterisk 1 CPU, 512 MiB; gateway 500m CPU, 256 MiB
  • Together, the default API, worker and Web pods request 3.6 CPU and 3.75 GiB of memory, with limits of 15 CPU and 15 GiB. PostgreSQL, NATS, ingress and monitoring come on top and are not sized by the chart.
  • Each API pod opens up to 20 database connections and each worker pod up to 60 (config.apiDatabaseMaxConnections and config.workerDatabaseMaxConnections): up to 240 at the default replica counts, plus the migration Job. Allow for this in PostgreSQL's connection limit or a connection pooler; a pooler must pass statement_timeout through.
  • With the chart defaults, each worker pod runs 24 escalation workers, 4 notification workers per channel and 4 raw-event workers.
  • The on-prem Compose file sets no CPU or memory limits. The API and the worker each use the built-in pool of 20 database connections, NATS keeps one stream replica, and the optional Prometheus keeps 30 days of metrics.
  • Disk sizes for PostgreSQL, NATS and backups are not specified. They grow with your event, incident and audit volume.

Storage and backups#

  • PostgreSQL is the system of record: configuration, raw events, incidents, escalation jobs, notification attempts, the outbox and audit.
  • Workers prune operational data hourly. By default, outbox rows go after 7 days, payloads of processed raw events after 30 days, and finished delivery rows after 30 days. Raw-event rows, incidents, timelines, notifications and audit events are kept until you archive or purge them; see Retention.
  • NATS needs persistent file storage, but its stream is not authoritative: when the stream is empty, the workers recover every unprocessed raw event from PostgreSQL.
  • Compose also keeps volumes for Redis, which is not authoritative, and, when their profile or overlay is enabled, for Prometheus, Grafana and voicemail recordings. Voicemail recordings are kept for 30 days by default.
  • Keep ACKNEXA_CONFIG_KEY in an independently protected copy. Without it, saved provider credentials cannot be decrypted.

Small installs back up with scripts/onprem_backup.sh, which by default takes a consistent database snapshot while paging continues, and restore into a new, isolated project. Production uses your PostgreSQL tooling with continuous WAL archiving and point-in-time recovery to encrypted, customer-controlled storage; cloud object storage is not required. See Backups and disaster recovery.

Find your next step.

Search runs locally. Nothing is sent to a search service.