Skip to content

Installation

NexaDesk is distributed as a single archive (it-helpdesk.tar.gz) containing everything needed to run the stack — including a prebuilt frontend. No Node.js or build tooling is required on your server.

Requirements

  • A Linux server (bare metal, VM, or VPS)
  • Docker Engine with the Compose plugin (docker compose version should work)
  • 2 CPU cores, 4 GB RAM, 20 GB disk (comfortable minimum)
  • Port 80 free on the host (the only published application port)
  • Outbound internet access for pulling base images and license validation

Install

# 1. Extract the bundle and enter the project
tar xzf it-helpdesk.tar.gz
cd it-helpdesk

# 2. Create your environment file
cp .env.example .env

Edit .env — at minimum, set:

Variable What it is How to generate
SECRET_KEY Application secret openssl rand -hex 32
JWT_SECRET Signs access tokens openssl rand -hex 32
JWT_REFRESH_SECRET Signs refresh tokens openssl rand -hex 32
ADMIN_PASSWORD Initial admin password change from the default!
POSTGRES_PASSWORD Database password strong random value

Never leave the defaults

Weak or default values for JWT_SECRET / ADMIN_PASSWORD are flagged as critical warnings on the admin dashboard until you fix them. Generate real secrets before first start.

# 3. Start the stack
docker compose up -d

# 4. Get your one-time setup token from the api logs
docker compose logs api | grep -A1 "SETUP TOKEN"

# 5. Open http://<your-server>/ and complete the setup wizard
#    (it asks for the setup token first)

Database migrations run automatically on API startup, and first-run seed data (default admin, SLA policies, business hours, categories, canned responses, branding) is created for you.

Enabling NetManager

The NetManager network-documentation module ships in the same bundle behind a Compose profile:

# set NM_DB_PASSWORD and NM_JWT_SECRET in .env first, then:
docker compose --profile netmanager up -d

The NetManager containers always run once enabled, but the module only appears in the sidebar when your license includes the netmanager feature.

Putting it behind HTTPS

NexaDesk's nginx listens on plain HTTP (port 80). For production, put a TLS terminator in front:

  • Cloudflare Tunnel — no inbound ports at all; point the tunnel at http://localhost:80
  • Reverse proxy (Traefik, Caddy, nginx) — proxy to port 80 and handle certificates there

Set PORTAL_URL, FRONTEND_URL, and ALLOWED_HOSTS in .env to your public hostname.

Network exposure

Only nginx (port 80) is published to the network. PostgreSQL is bound to 127.0.0.1 on the host — reachable for local psql maintenance but not from the LAN or internet. Redis and the internal services are not published at all.

Next step

Head to the Setup Wizard to create your admin account.