System requirements
TrakState runs as one server process next to one PostgreSQL database. The process serves the API, the interface and the plugin parts over a single network port. Workstations need nothing but a browser.
Software
Section titled “Software”| Part | Requirement | Note |
|---|---|---|
| Container runtime | Docker with docker compose |
The delivered build artefact is a container image. |
| Database | PostgreSQL 16 | One database for the application, a second for the tenant’s business data. |
| Node.js | 24 or newer | Only needed if you run without a container. The image brings Node 24. |
| Python | python3 |
Only for Python scripts. Included in the image, without pip and without virtual environments. |
| Identity provider | Zitadel | TrakState has no user login of its own, see below. |
Node 24 is not a preference but a condition: the process boundary that plugin code runs in
requires the --permission model, which only exists from Node 22.13 onwards.
Database
Section titled “Database”TrakState needs several database roles, not one:
| Role | For | Rights |
|---|---|---|
| Owner | migrations, schema, policies | Owns the schema. |
| Runtime role | every business request | No ownership, no DDL, row level security applies to it. |
| Install role | the install of a package, and nothing else | DDL only inside its own schema. |
| Operational role | the tenant’s business data | Reaches only its own database. |
This split is not a recommendation. The service checks it at start and refuses to start if the runtime role could bypass row level security.
Network and encryption
Section titled “Network and encryption”The service speaks plain HTTP on PORT (default 3000) and listens on all addresses.
It does not bring TLS. A reverse proxy in front of it terminates the encrypted
connection; on our own operation that is Traefik.
PUBLIC_BASE_URL must be the address the browser actually uses. Session cookies are marked
secure exactly when that value starts with https://.
User login runs through Zitadel as the identity provider, over OIDC. TrakState itself
has no password form for users. IDENTITY_MODE decides whether Zitadel holds the users
itself (local) or federates to a customer directory (federated).
Only the operator surface (Console) has a local login of its own.
Workstations
Section titled “Workstations”A current browser. Testing is done against Chromium; the interface is built without back-translation for older browsers.
What has no figure yet
Section titled “What has no figure yet”There is no binding size for CPU cores, memory or disk. Nor is it established how fast the database grows with the number of captured records and tag changes. Please settle both for your plant with us before you buy hardware.