What this chapter covers#
This chapter lists what release 1.0.0-rc.1 needs: the components and the versions its deployment files use, where it can be deployed, the services you provide, the ports and outbound connections, the clients, and the sizing defaults in the deployment files. Where the release states no minimum version or size, this chapter says it is not specified.
Runtime components#
| Component | Version in this release | Notes |
|---|---|---|
| Backend image | 1.0.0-rc.1 | One image for the API (which contains the integration gateway), the workers, database migrations, the upgrade check, the bootstrap command and the CUCM gateway service. Go binaries on Alpine Linux 3.24, run as a non-root user. |
| Web image | 1.0.0-rc.1 | The Web UI and its server-side API proxy. The image carries its own Node.js runtime, so nothing is installed on the host. |
| Voice-gateway Asterisk image | 1.0.0-rc.1, optional | Only for live call routing through Cisco CUCM. |
| PostgreSQL | 16 | The system of record. The supplied Compose files, the on-prem image example and continuous integration all use PostgreSQL 16; no other major version is stated as tested. The first migration creates the pgcrypto extension if it is missing, so the migration identity must be allowed to create it, or install it beforehand. |
| NATS with JetStream | 2.10 | Durable transport for committed outbox events. Compose runs one node with one stream replica. Production expects your own cluster of three or five nodes with TLS, authentication, file storage and at least three stream replicas; the chart sets three by default. |
| Redis | 7.4 in the on-prem example, optional | Included in the on-prem Compose profile for customer cache workloads. The application does not use it, and the Helm chart needs no Redis endpoint. |
| Ingress | NGINX stable-alpine in the on-prem example | Terminates TLS for the Web and API host names. With Helm, use your own ingress controller; the chart's default ingress class is nginx. |
| Prometheus, Grafana, OpenTelemetry Collector | Prometheus 3.5.0 in the on-prem example; Grafana and the Collector are not pinned | The optional local observability profile. Use your approved versions. |
Release images are built for linux/amd64 and linux/arm64; see Prepare the environment for signing, SBOMs and image mirroring.
Deployment targets#
| Target | What it needs | Minimum version |
|---|---|---|
| Small install with Docker Compose | One container host with Docker Engine and the Compose v2 docker compose command, plus Bash and OpenSSL. The backup script also needs Python 3 and sha256sum or shasum. | Not specified for Docker Engine or Compose. |
| Production on Kubernetes with Helm | A cluster with an ingress controller, plus your own PostgreSQL and NATS. The on-prem overlay's egress policy needs a CNI that enforces NetworkPolicy. ServiceMonitors need the Prometheus Operator CRDs, and External Secrets is optional. | Helm 3 or later, because the chart uses chart API version v2. Kubernetes: not specified; the chart declares no minimum version. |
| Hosts and nodes | linux/amd64 or linux/arm64 container hosts. | Operating system and kernel versions: not specified. |
Build toolchains#
These are needed only where you build images or the mobile apps, not on the hosts that run AckNexa.
| What you build | Toolchain used by this release |
|---|---|
| Backend image | Go 1.27.4 in the Dockerfile's build stage; the Go module requires Go 1.26 or newer. The build cross-compiles for amd64 and arm64. |
| Web image | Node.js 24 in the build stage. The resulting image carries its own Node.js runtime. |
| iOS app | A Mac with Xcode 16 or newer, XcodeGen, and an Apple Developer Program membership for push notifications and TestFlight. |
| Android app | Android Studio (Ladybug 2024.2 or newer) or the included Gradle 8.9 wrapper, JDK 17 or 21, and Android SDK Platform 35. Direct push needs your own Firebase project. |
Services you provide#
Every deployment needs these:
| Service | Notes |
|---|---|
| TLS ingress or load balancer | Two host names, one for the Web UI and one for the API, with certificates from your PKI. Compose includes NGINX with your tls.crt and tls.key. With Helm, use your ingress controller and an internal VIP, appliance or load balancer; no cloud load balancer is needed. |
| DNS and time synchronization | Private DNS for both host names. Keep clocks synchronized: signed webhooks with a timestamp more than five minutes off are rejected, and voice-gateway callbacks are signed with timestamps. |
| PostgreSQL and NATS for Helm | Your highly available PostgreSQL with verified TLS and separate runtime and migration identities, and an authenticated TLS NATS cluster. The chart deploys only the stateless AckNexa components. Compose runs both on the same host. |
| Secret storage | Protected files for Compose; Kubernetes Secrets or an internal secret manager for Helm. This includes ACKNEXA_CONFIG_KEY, which needs its own protected backup. |
| Backup storage | Encrypted, customer-controlled storage for database backups and keys. For production, PostgreSQL WAL archiving and point-in-time recovery tooling. |
| Independent monitoring (recommended) | Prometheus and Alertmanager in a separate failure domain. The optional Compose observability profile runs on the same host it watches. |
Only for the features you enable:
| Service | Notes |
|---|---|
| Private CA | Mount your CA bundle for the backend (SSL_CERT_FILE) and the Web runtime (NODE_EXTRA_CA_CERTS), and install it on browsers and phones. |
| SMTP server | Email notifications, stakeholder and status-page subscriber email, and postmortem reminders. STARTTLS and certificate verification are required. |
| Identity provider | OpenID Connect single sign-on, LDAP or Active Directory over ldaps:// or StartTLS, and SCIM 2.0 provisioning. Keep a local break-glass administrator. |
| Mobile push | Your own APNs key for a self-built iOS app, your own Firebase service account for a self-built Android app, or a push-relay credential. The relay cannot be combined with your own APNs or FCM settings. |
| Twilio | SMS, voice calls and a Twilio hotline number. Twilio must reach PROVIDER_CALLBACK_BASE_URL over HTTPS. |
| Telephony | An HTTPS bridge to your PBX for voice paging (VOICE_GATEWAY_URL), or Cisco CUCM with a SIP trunk to the bundled gateway for live call routing. |
| Jira or Halo | Tickets per incident. Inbound ticket webhooks also use PROVIDER_CALLBACK_BASE_URL. |
| SIEM | An HTTPS collector, or a syslog receiver over TLS, for audit streaming. |
Ports#
The ports AckNexa components listen on inside their containers, as set by the supplied deployment files.
| Component | Port inside the container | Exposure |
|---|---|---|
| Ingress (Compose NGINX) | 443, HTTPS | Published on ACKNEXA_BIND_ADDR and ACKNEXA_HTTPS_PORT, by default loopback port 8443. Serves the Web and API host names. |
| API | 8080, HTTP | Behind the ingress. Also serves /health/live, /health/ready and /metrics. The Helm API ingress publishes only /v1, /v2, /scim, /integrations, /calendar, /heartbeat and /health. |
| Workers | 9090, HTTP | Health and metrics only; not published. |
| Web | 3000, HTTP | Behind the ingress. |
| PostgreSQL and NATS in Compose | 5432; 4222 for clients and 8222 for monitoring | On the internal backend network only; not published. |
| Grafana (observability profile) | 3000 | Published on loopback port 3300 by default (GRAFANA_PORT). |
| CUCM gateway: Asterisk (optional) | SIP 5060 over UDP and TCP; RTP over UDP 10000 to 10099 | Published on the host in Compose, and bound with host networking by default in Helm. Allow them only from CUCM and your media endpoints. Calls to CUCM go to its port 5060 over TCP by default. |
| CUCM gateway service (optional) | 4573 for FastAGI from Asterisk; 8090 for voicemail recordings | Internal. Compose serves voicemail links through the ingress on port 8444. |
Outbound connections#
The core needs none of these: each is needed only when you enable the matching feature. Private destinations configured by an organization also need NOTIFICATION_PRIVATE_CIDRS; see Notification egress.
| Feature | Destination | Protocol |
|---|---|---|
| APNs with your own key | api.push.apple.com, and api.sandbox.push.apple.com for development builds | HTTPS |
| FCM with your own service account | fcm.googleapis.com and oauth2.googleapis.com | HTTPS |
| Push relay | The relay URL you are given (PUSH_RELAY_URL) | HTTPS |
| Twilio | api.twilio.com; Twilio calls back to PROVIDER_CALLBACK_BASE_URL | HTTPS |
| Slack | hooks.slack.com and hooks.slack-gov.com, always allowed | HTTPS on port 443 |
| Microsoft Teams, Mattermost, outbound webhooks, HTTPS SIEM collectors | Hosts you list in NOTIFICATION_WEBHOOK_HOSTS | HTTPS on port 443 |
| Syslog SIEM | Hosts you list in AUDIT_SYSLOG_HOSTS | Syslog over TLS |
Your SMTP server (SMTP_ADDR); servers configured by an organization must be in NOTIFICATION_SMTP_HOSTS | SMTP with STARTTLS | |
| Jira and Halo | The configured base URLs, limited by TICKETING_HOSTS when set | HTTPS; HTTP only with TICKETING_ALLOW_HTTP=true |
| Identity provider | Your OIDC issuer and LDAP servers | HTTPS; ldaps:// or StartTLS |
| Voice bridge to your PBX | VOICE_GATEWAY_URL | HTTPS |
Clients#
| Client | Requirement |
|---|---|
| Web browser | Not specified: no list of supported browsers is published for this release. The browser must reach the Web host name over HTTPS and trust its certificate chain. |
| iOS app | iOS 17.0 or later. For this release the operator builds the app; it is not in the App Store. |
| Android app | Android 8.0 (API level 26) or later; it targets Android 15 (API level 35). For this release the operator builds the app; it is not in Google Play. |
| Phones on a private network | A route to the API host name, directly or over your VPN, with private DNS and your CA on the device. Push also needs Apple or Google connectivity. |
See Web and mobile access for how the apps are distributed and how pages reach a phone.
Sizing#
This release has no certified sizing guide. The figures below are the defaults in the supplied deployment files, not a capacity statement. Validate CPU, memory, storage and connection limits against your own load, as described in Capacity and deployment evidence.
| Helm workload | Default replicas | Requests per container | Limits per container |
|---|---|---|---|
| API | 3 | 500m CPU, 512 MiB | 2 CPU, 2 GiB |
| Workers | 3 | 500m CPU, 512 MiB | 2 CPU, 2 GiB |
| Web | 3 | 200m CPU, 256 MiB | 1 CPU, 1 GiB |
| Upgrade-check and migration Jobs | One run per install or upgrade | 100m CPU, 128 MiB | 1 CPU, 512 MiB |
| CUCM gateway (optional) | 1 | Asterisk 100m CPU, 128 MiB; gateway 50m CPU, 64 MiB | Asterisk 1 CPU, 512 MiB; gateway 500m CPU, 256 MiB |
- Together, the default API, worker and Web pods request 3.6 CPU and 3.75 GiB of memory, with limits of 15 CPU and 15 GiB. PostgreSQL, NATS, ingress and monitoring come on top and are not sized by the chart.
- Each API pod opens up to 20 database connections and each worker pod up to 60 (
config.apiDatabaseMaxConnectionsandconfig.workerDatabaseMaxConnections): up to 240 at the default replica counts, plus the migration Job. Allow for this in PostgreSQL's connection limit or a connection pooler; a pooler must passstatement_timeoutthrough. - With the chart defaults, each worker pod runs 24 escalation workers, 4 notification workers per channel and 4 raw-event workers.
- The on-prem Compose file sets no CPU or memory limits. The API and the worker each use the built-in pool of 20 database connections, NATS keeps one stream replica, and the optional Prometheus keeps 30 days of metrics.
- Disk sizes for PostgreSQL, NATS and backups are not specified. They grow with your event, incident and audit volume.
Storage and backups#
- PostgreSQL is the system of record: configuration, raw events, incidents, escalation jobs, notification attempts, the outbox and audit.
- Workers prune operational data hourly. By default, outbox rows go after 7 days, payloads of processed raw events after 30 days, and finished delivery rows after 30 days. Raw-event rows, incidents, timelines, notifications and audit events are kept until you archive or purge them; see Retention.
- NATS needs persistent file storage, but its stream is not authoritative: when the stream is empty, the workers recover every unprocessed raw event from PostgreSQL.
- Compose also keeps volumes for Redis, which is not authoritative, and, when their profile or overlay is enabled, for Prometheus, Grafana and voicemail recordings. Voicemail recordings are kept for 30 days by default.
- Keep
ACKNEXA_CONFIG_KEYin an independently protected copy. Without it, saved provider credentials cannot be decrypted.
Small installs back up with scripts/onprem_backup.sh, which by default takes a consistent database snapshot while paging continues, and restore into a new, isolated project. Production uses your PostgreSQL tooling with continuous WAL archiving and point-in-time recovery to encrypted, customer-controlled storage; cloud object storage is not required. See Backups and disaster recovery.