Requirements

What Kantan Desk expects around it.

The project is a web client and API backed by PostgreSQL, Redis, SMTP/IMAP services, and a production reverse proxy. These requirements are drawn from the project install and configuration docs.

Runtime packages

Core software requirements.

Package	Required version	Purpose
Node.js	22.19+	Application runtime and builds; the docs recommend the project-tested LTS line where possible.
Yarn	4.2.2	Workspace package manager, enabled through Corepack and pinned in package metadata.
PostgreSQL	12+	Application data through Prisma.
Redis	7+	Rate limiting, sessions, BullMQ queues, email jobs, cached state, and scheduled jobs.
Git	Current stable	Clone-based installs and development; not required when deploying a release tarball/source export.
rsync	Current stable	Used by the production upgrade script when backing up uploads.
bash	5+	Required by deployment and E2E helper scripts.
curl	Current stable	Used by production install scripts for local health checks.
openssl	Current stable	Used to generate `SECRET` and `DATA_ENCRYPTION_SECRET`.

Process

systemd or PM2

Production should use a process manager. The docs prefer systemd for VM/bare-metal deployments; PM2 remains an option if already standard for the host.

Proxy

nginx or Caddy

Production should sit behind an HTTPS reverse proxy. The documented nginx baseline forwards host and request headers and includes security headers.

SMTP and IMAP

System SMTP is required for account email, notifications, password resets, and outbound ticket mail. IMAP mailboxes power inbound email ticket creation.

Storage

Uploads directory

UPLOAD_DIR should point to a directory readable and writable by the API process. Readiness checks include upload access.

Secrets

Separate generated secrets

SECRET and DATA_ENCRYPTION_SECRET must be generated separately and must not match.

Origins

Production CORS

CORS_ORIGIN should be set to exact HTTPS origins. Wildcards are rejected in production.

Minimum environment

The app needs both API and client configuration.

At minimum, the API and client environment files must point at the database, Redis, secrets, production origin, and public API URL.

API: DATABASE_URL, REDIS_URL, SECRET, DATA_ENCRYPTION_SECRET, NODE_ENV=production, and CORS_ORIGIN.
Client: NEXT_PUBLIC_API_URL.
Email: SYSTEM_SMTP_* before using account email, notifications, password resets, or outbound ticket mail.
Public ticket forms can optionally use Turnstile through the documented public site key and API secret key.
Production API processes should be bound behind the reverse proxy rather than exposed directly.

Verification

Checks the project documents for operators.

Build and quality	`yarn type-check`, `yarn test`, and `yarn build`.
Database	`yarn release:prepare-db`, `yarn db:deploy`, and `yarn db:generate` appear in the install flow.
Runtime health	API liveness and readiness are exposed at `/livez` and `/readyz`.
Full release gate	`yarn release:check` runs the maintainer release gate, but it requires the full development checkout and is not part of a normal production-source install.