Environment requirements
The complete single-node Compose stack needs startup/steady-state measurements. CPU/RAM thresholds below are provisional warning thresholds, not verified sizing of the new model.
Terms used in this guide
- A reverse proxy accepts external requests and forwards them to MassAccess services.
- Transport Layer Security (TLS) encrypts connections to the public address.
- A health check confirms that a service is ready to handle requests.
- Enrollment binds an installed instance to the created license.
System requirements
| Component | Minimum | Recommended |
|---|---|---|
| OS | Linux kernel 5.x+ | Ubuntu 22.04 / Debian 12 |
| Docker Engine | 24.0+ | 27.0+ |
| Docker Compose | v2.24+ | v2.30+ |
| Installer | Bash, Python 3, curl, OpenSSL, flock | Bash, Python 3, curl, OpenSSL, flock |
| CPU | 4 cores: provisional sizing | 8 cores |
| RAM | 8 GiB: provisional sizing | 16 GB |
| Disk | 50 GB SSD | 100 GB SSD |
| Internet | 100 Mbps | 1 Gbps |
Public ports
Publish API/UI through the customer HTTPS reverse proxy. Receiver accepts mTLS/443 only from the agreed central jump IPs. RabbitMQ and bot mTLS/8443 remain private. Receiver and reverse proxy must use separate host IP/443.
| Port | Purpose | Access |
|---|---|---|
| 443 | Receiver mTLS | Only agreed central jump IPs |
| 10001 | Platform API | Only for the reverse proxy (not exposed directly) |
| 10002 | Service checks | No public access required |
| 10011 | Web panel | Only for the reverse proxy (not exposed directly) |
Domain and TLS
The central jump serves the public provider HTTPS certificate. Local CA, Receiver and bot mTLS are issued automatically. The customer UI/API reverse proxy requires its own public TLS certificate.
Connectivity requirements
The product is not offline or air-gapped. Keep the documented outbound routes available for license heartbeat, signed usage metering, cloud billing, image delivery, and Telegram/MAX connectivity.