PoC Requirements - Latest

These are the requirements for a PoC (single-server) installation of Monosign, Monopam and Monosync. When they are ready, continue with PoC Requirements - Check - Latest to verify them, then PoC Installation - Latest.

Monofor products run as containers pulled from Monofor's official registry. Access to that registry comes with your installation code — contact your Monofor Sales Engineer, authorized partner, or [email protected].

Operating systems

Both x86_64 and arm64 are supported — the installer picks the matching build.

Windows is not supported as a Monofor server, because Windows does not run Linux containers. (The Monopam Gateway is a separate Windows component — see the last section.)

Hardware

The installer enforces these before it changes anything on the server:

Where the free disk must be. The installer downloads the product images and keeps the containers, their volumes and the PoC database under Docker’s data folder, /var/lib/docker. The free disk in the table is needed on the disk that holds this folder. On a server with one root filesystem that is /. On a server where /var is a separate partition it is /var — a 10 GB /var is not enough, and the installation fails while downloading the images. The images alone take about 15 GB; the data grows from there. The installer measures this disk before it changes anything and names it in its output. To keep Docker’s data on another disk, set data-root in /etc/docker/daemon.json before installing.

One server is enough for a PoC.

An installation code can carry its own thresholds. When it does, those replace the values above.

Software

Docker Engine

The installer installs these from Docker's official repository (download.docker.com) when they are missing. Pass --install-docker to let it do so without asking, or install them yourself beforehand.

curl or wget must be present — one of them fetches the installer.

Database

A PoC needs no external database. The installer deploys an internal PostgreSQL container and creates the monopam and monosync databases on it.

Host firewall

Leave the host firewall running. If your policy forbids an installer touching it, run the installation with --skip-firewall; the installer then prints the ports and you open them yourself.

Ports the server listens on after installation

Network access

Internet access

Internal access

Between servers (multi-server only)

A Single Data Center installation also needs Docker Swarm's own ports between the nodes: TCP/2377 (cluster management), TCP and UDP/7946 (node discovery), UDP/4789 (overlay network).

DNS records

Every product name must resolve to the server before the installation starts — the services reach each other through these names. The installer checks them and stops with nothing changed if one is missing.

• id, iam and iam-api are required for every installation. The pam* and sync records are required when those products are in the PoC scope — and when the installation code enables them, the installer checks them.

• The license is bound to iam.example.com.

• id.example.com must also be published on your external DNS if Monosign Authenticator push notifications are to be used over the internet.

• A /etc/hosts entry on the server is not a substitute. Docker's embedded DNS does not read the host's /etc/hosts, so the containers would still fail to resolve each other. With no DNS records, install with --local-dns — the installer then writes the entries both on the host and inside every service.

• In a split-DNS environment, make sure the resolver the server uses is the one holding the zone. A server pointed at a different resolver recurses to the public internet and gets NXDOMAIN.

Time and NTP

Monofor services are sensitive to time synchronization; a server whose clock differs from the client devices causes authentication failures, and Swarm nodes with drifting clocks fail to join. Configure the timezone and NTP before installing.

SSL certificate

Monosign serves several hostnames under one domain, so it needs a wildcard certificate (*.example.com).

For a PoC the installer generates a self-signed wildcard certificate automatically — browsers will warn once. Replace it at any time with your own:

monofor cert install --crt fullchain.pem --key private.key

Use a full chain (leaf plus intermediates). The pair is validated before anything changes, the previous certificate is kept, and the change is rolled back automatically if the products do not come back healthy.

User source — Active Directory

Monosign supports a Unified Directory architecture: the user directory can be internal or external. Microsoft Active Directory and LDAP servers are supported natively.

Create a service user in Active Directory — for example monosign_svc — with these permissions:

If the Self-Service Portal (SSP) is not in scope, default AD user permissions are enough.

Monopam Gateway

Required only if Monopam is in the PoC scope. Skip this section otherwise.

The Monopam Gateway Service runs only on Microsoft Windows Server, uses RDS, and the server must be joined to the Active Directory domain.

IPv6 must be disabled on the Windows Server.

Next step

When the requirements are ready, verify them with PoC Requirements - Check - Latest.