Appliance Installation — Coming Soon
The Moftgate virtual appliance images are being finalized. The full installation guide will be published once the downloads are available.
Installation Video#
System Requirements#
| vCPU | 4 cores (minimum 2) |
| Memory | 8 GB RAM (minimum 4 GB) |
| Disk | 60 GB thin/thick provisioned |
| Hypervisor | OVA: VMware ESXi/Workstation/Fusion, VirtualBox 7+ · VHDX: Hyper-V · qcow2: Proxmox VE, KVM/libvirt, XCP-ng |
| Network | DHCP or static IPv4; agents must reach the appliance on TCP 4222 |
| Guest OS | Included: Ubuntu Server 24.04 LTS (no manual OS install required) |
RMM Module CPU / RAM / Disk Sizing by Endpoint Count#
| Scale Profile | Endpoint (Agent) Count | vCPU | RAM | Disk (SSD / NVMe) | Concurrent Remote Sessions & Workload Capacity |
|---|---|---|---|---|---|
| Lab / PoC (Minimum) | 1 – 50 Endpoints | 2 vCPU | 4 GB | 60 GB | 1–2 concurrent remote sessions, basic inventory and monitoring |
| Small Scale (Starter) | 50 – 250 Endpoints | 4 vCPU | 8 GB | 100 GB | 3–5 concurrent remote sessions, standard patch and script automation |
| Medium Scale (Standard) | 250 – 1,000 Endpoints | 6 vCPU | 16 GB | 200 GB | 5–10 concurrent remote sessions, intensive package/patch deployment |
| Large Scale (Corporate) | 1,000 – 2,500 Endpoints | 8 vCPU | 32 GB | 350 GB | 10–20 concurrent remote sessions, high-frequency telemetry and auditing |
| High Density (Enterprise) | 2,500 – 5,000 Endpoints | 12 – 16 vCPU | 48 – 64 GB | 500+ GB | 25+ concurrent remote sessions, fleet-wide automations |
| 5,000+ Endpoints | 5,000+ Endpoints | 16+ vCPU | 64+ GB | 1 TB+ NVMe | Separation of database and application tiers (Cluster/HA) is recommended |
Download and Import the Appliance Image#
The Moftgate appliance images are being finalized. Pick the hypervisor format you plan to use; downloads will appear here once the release is live.
This format will be released soon.
Power On - Automatic First-Boot Provisioning#
On the first boot, the moftgate-firstboot systemd service provisions the appliance automatically. This takes about 2–5 minutes and runs only once.
- Generates unique secrets: APP_KEY, database and Redis passwords, license encryption key, and a company ID.
- Writes a hardened .env file with 0600 permissions under /opt/moftgate.
- Starts PostgreSQL, Redis, and NATS, then runs database migrations and the initial seed.
- Prepares the first-run setup wizard - no pre-generated credentials are stored on the appliance.
- Registers the bundled endpoint agents (Windows, macOS, Linux) so they are ready to deploy.
tail -f /var/log/moftgate-firstboot.log
Complete the First-Run Setup Wizard#
When provisioning finishes, the VM console banner shows the panel URL. Open it in a browser:
http://<vm-ip>
On the first visit, the panel opens a setup wizard: create the administrator account with your own e-mail and password, then sign in. No pre-generated credentials are stored anywhere on the appliance.
Network Ports and Firewall Rules#
Only four ports are published on the appliance host. PostgreSQL and Redis stay inside the container network and are never reachable from outside.
| Port | Service | Purpose |
|---|---|---|
| 80 / TCP | Web Panel (nginx) | Administrator console and end-user facing UI |
| 4222 / TCP | NATS (agent channel) | Endpoint agents connect here for commands and telemetry |
| 8222 / TCP | NATS monitoring | Health checks and cluster metrics (optional exposure) |
| 9222 / TCP | NATS WebSocket | Browser real-time updates and agent WS transport |
What Runs Inside the Appliance#
Reverse proxy and static asset serving on port 80
Laravel application (PHP 8.4 FPM) - panel, API, license checks
Queue worker for jobs, notifications, and automation pipelines
Cron runner for periodic tasks (stale run detection, reports)
Rust ingestion service: NATS agent telemetry → PostgreSQL
PostgreSQL 15 - system of record (not exposed to the host)
Cache, sessions, and queue backend (not exposed to the host)
Message bus for real-time agent and UI communication
Day-2 Operations#
The whole stack is managed by a single systemd unit. Run these commands from the hypervisor’s VM console - the appliance does not accept remote shell (SSH) sessions:
systemctl status moftgate-stack sudo systemctl restart moftgate-stack cd /opt/moftgate && docker compose -f docker-compose.ova.yml --env-file .env ps docker compose -f docker-compose.ova.yml --env-file .env logs -f
If the VM gets a new IP address (DHCP), the render-env.sh helper rewrites APP_URL and the WebSocket endpoint at every boot - no manual reconfiguration needed. A static IP or DHCP reservation is still recommended for production.
Deploy Endpoint Agents#
Windows, macOS, and Linux agent installers are bundled inside the appliance and registered automatically at first boot. In the panel, go to Settings → Endpoint Visibility → Agent Versions to download them. Agents connect back to the appliance over NATS on TCP 4222.
Post-Install Security Checklist#
- 1SSH is disabled by design - administer the VM only through the hypervisor console and the web panel.
- 2Change the console password at first login - the appliance enforces this automatically.
- 3Complete the first-run setup wizard with a strong admin password before connecting agents.
- 4Give the appliance a static IP or DHCP reservation so agents always reach the same address.
- 5Place the panel behind your reverse proxy or TLS terminator for HTTPS access in production.
- 6Restrict inbound firewall rules to ports 80, 4222, and 9222; expose 8222 only to monitoring systems.
Troubleshooting#
Panel not loading?
Containers down?
Agents cannot connect?
Forgot the admin password?
Our engineering team can guide appliance sizing, network design, and agent rollout.