Complete feature documentation for Client St0r - Self-hosted IT documentation platform.
- Azure AD / Microsoft Entra ID SSO - Single sign-on with auto-user creation and 2FA bypass
- LDAP/Active Directory - Enterprise directory integration
- Enforced TOTP 2FA - Two-factor authentication required for all users
- Argon2 Password Hashing - Industry-standard password security
- Session Management - Secure session handling with configurable timeout
- Brute-Force Protection - Account lockout after failed login attempts
- Password Policies - Configurable complexity requirements
- AES-GCM Encryption - Military-grade encryption for passwords, credentials, API keys, and tokens
- HMAC-SHA256 API Keys - Secure API key hashing
- Encrypted Storage - All sensitive data encrypted at rest
- Private File Serving - Secure file delivery via X-Accel-Redirect
- SQL Injection Prevention - Parameterized queries throughout
- XSS Protection - Strict output encoding and auto-escaping
- CSRF Protection - Multi-domain CSRF token validation
- SSRF Protection - URL validation with private IP blacklisting
- Path Traversal Prevention - Strict file path validation
- IDOR Protection - Object access verification
- Rate Limiting - Per-user and per-endpoint protection
- Security Headers - CSP, HSTS, X-Frame-Options, X-Content-Type-Options
- Snyk Security Integration - Automated vulnerability scanning for Python and JavaScript dependencies with web UI dashboard
- OS Package Security Scanner - System package vulnerability scanning with automated security update detection
- Multi-platform support (apt, yum/dnf, pacman)
- Security-specific update detection
- Scheduled daily scans with configurable frequency
- Dashboard widget with security status overview
- Scan history with trend visualization
- Manual scan triggers via web interface
- Webhook notifications for critical updates
- Scheduled Scanning - Configurable automatic scans (daily, weekly, monthly)
- Automated Scan with Email Alerts - Opt-in scheduled security scanning (daily by default) that emails all superusers when vulnerabilities are found; toggle on/off from Security Dashboard; shows next scheduled run and last scan status
- Remediation Guidance - Detailed upgrade paths and security advisories
- Trend Analysis - Track vulnerabilities over time
- File Type Whitelist - Only approved file types, dangerous extensions blocked
- File Size Limits - Maximum 25MB per file
- Content-Type Validation - MIME type verification
- Comprehensive Audit Logging - All actions logged with user, timestamp, and details
- Security Event Tracking - Failed logins, permission changes, credential access
- Export Capabilities - CSV/JSON export for compliance
- iptables Firewall Management - Web-based firewall rule management
- GeoIP Country Blocking - Block traffic from specific countries
- IP Whitelist/Blacklist - Manage allowed and blocked IP addresses
- Firewall Logging - Track blocked connection attempts
- Fail2ban Integration - Automated intrusion prevention system
- Ban management (view, unban individual IPs, unban all)
- Jail status monitoring
- IP check functionality
- Auto-installation during updates
- Sudoers configuration for web management
- Complete Data Isolation - Organization-based data separation for managing multiple client organizations
- Unlimited Organizations - MSPs can manage unlimited client organizations
- Custom Branding - Per-organization customization
- Flexible Structure - Hierarchical organization support
- Staff Access - Staff users have global access across all organizations for management
- 42 Granular Permissions - Across 10 permission categories
- Four-Tier Access Levels:
- Owner - Full control including user management
- Admin - Manage integrations, settings, and resources
- Editor - Create, edit, delete content
- Read-Only - View-only access
- Role Templates - Reusable permission sets
- Custom Roles - Create roles with specific permission combinations
- Staff Users - Global access to all organizations
- Organization Users - Scoped access to specific organizations
- User Type Management - Easy assignment and modification
- Bulk User Operations - Import/export users
- Flexible Asset Types - Unlimited custom asset types
- Custom Fields - Add custom fields to any asset type
- Rich Metadata - Name, type, status, location, serial number, etc.
- Asset Relationships - Link assets to documents, passwords, contacts
- Tagging System - Organize with tags
- Asset Photos - Upload and display asset images
- Search & Filter - Full-text search with advanced filters
- Status Tracking - Active, Inactive, Maintenance, Retired
- Bulk Operations - Edit multiple assets at once
- Asset History - Track changes over time
- Lifespan Tracking - Track purchase date, expected lifespan (years), and receive reminders before end-of-life
- Recommended lifespans (Firewall: 5-7 years, Server: 3-5 years, Workstation: 3-4 years, Switch: 5-7 years)
- Configurable reminder periods (months before end-of-life)
- Auto-calculated EOL dates and replacement due dates
- Export - CSV/JSON export capabilities
- Import - Bulk import from CSV
- AES-GCM Encryption - All passwords encrypted before storage
- 15 Password Types - Website logins, email, Windows/AD, database, SSH, API keys, OTP/TOTP, credit cards, network devices, servers, FTP/SFTP, VPN, WiFi, software licenses, and more
- Type-Specific Fields - Relevant fields for each password type
- Folder Organization - Hierarchical folder structure
- Password Reveal - Secure reveal with audit logging
- Secure Password Generator - Configurable length (8-128 characters) with cryptographically secure randomness
- Password Strength Meter - Real-time strength calculation
- Password Breach Detection - HaveIBeenPwned integration with k-anonymity (passwords never leave your server)
- Automatic breach checking against 600+ million compromised passwords
- Configurable scan frequencies (2-24 hours)
- Visual security indicators and breach warnings
- Optional blocking of breached passwords
- Comprehensive audit logging
- Expiration Tracking - Set expiration dates with warnings
- Auto-lock - Passwords automatically masked
- Copy to Clipboard - One-click secure copy
- TOTP Code Generation - Built-in 2FA code generator with QR codes
- Complete Import Support - Import passwords from Bitwarden/Vaultwarden JSON exports
- All Item Types - Supports login items, secure notes, cards, and identity items
- Folder Preservation - Imports folders with optional prefix
- Custom Fields - Preserves all custom fields from Bitwarden
- TOTP Secrets - Imports and encrypts 2FA/TOTP secrets
- Update Existing - Option to update existing passwords with matching title/username
- Detailed Statistics - Shows created/updated/skipped counts
- Error Handling - Comprehensive error reporting with partial import success
- User-Specific Encryption - Each user has their own private vault
- Private Storage - Not accessible by admins
- Quick Notes - Store personal credentials securely
- Per-Organization Docs - Isolated documentation per tenant
- Categories - Organize with predefined categories:
- Company Policies
- IT Procedures
- Network Documentation
- Server Documentation
- Application Documentation
- Disaster Recovery
- Compliance
- Training Materials
- Rich Text Editor - Markdown or WYSIWYG
- Version Control - Track document changes
- Tags - Flexible tagging system
- Search - Full-text search across all docs
- Templates - Create reusable document templates
- Staff-Only Access - Internal knowledge base for staff
- Separate from Org Docs - Global articles not tied to organizations
- Pre-Populated Content - MSP best practices included
- Full Markdown Support - Rich formatting options
- Categories & Tags - Organize internal knowledge
- Search - Quick access to internal docs
- Attachments - Upload files to documents
- Document Templates - Pre-fill new documents
- Favorites - Mark important documents
- Export - PDF/Word export
- Sharing - Generate secure share links
- Access Control - Permission-based viewing
- HTTP/HTTPS Checks - Automated uptime monitoring
- Configurable Intervals - 1, 5, 15, 30, 60 minutes
- Response Time Tracking - Monitor performance
- Status Codes - Track HTTP response codes
- Downtime Alerts - Email/webhook notifications
- Certificate Details:
- Subject (Common Name)
- Issuer
- Serial Number
- Valid From/To dates
- SSL Protocol version (TLS 1.2, 1.3)
- Expiration Warnings - Configurable warning periods
- Days Until Expiration - Real-time countdown
- Certificate Chain - Full chain validation
- Domain Registration Tracking - Monitor domain expiration
- Expiration Warnings - Configurable warning days
- Multi-Domain Support - Track unlimited domains
- Renewal Reminders - Automated reminders
- NetBox-Style Layout - Visual rack diagrams
- U Position Tracking - Track device placement
- Color-Coded Devices - Visual organization
- Power Tracking:
- Power capacity (watts)
- Allocated power
- Utilization percentage
- Power warnings
- Device Details - Name, U start/end, power draw
- Click-to-Edit - Click devices to edit
- Available Space - Visual empty space indicators
- Subnet Management - Track IP subnets
- VLAN Support - Organize by VLANs
- IP Assignment - Assign IPs to assets
- Utilization Tracking - Subnet usage statistics
- IP Status - Active, Reserved, Available
- Network Planning - Visual network organization
- Integrated into Organizations - Manage multiple physical locations per organization directly from the organization detail page — no separate menu required
- Multi-Location Support - Each organization can have unlimited locations (headquarters, branches, data centers, etc.)
- Address Management - Full address details with geocoding support
- Coordinates Support - Latitude/longitude for precise positioning
- Location Types - Headquarters, branch office, data center, remote site, customer site
- Status Tracking - Active, planned, inactive, closed (with colored badges)
- Primary Location - Designate headquarters
- Floor Plan Support - Track whether a floor plan has been generated for each location
- Role-Based Controls - Edit and delete buttons visible to owners and admins only
- Multi-Provider SMS - Send SMS via Twilio, Plivo, Vonage/Nexmo, Telnyx, or AWS SNS
- Navigation Services - Support for Google Maps, Apple Maps, and Waze
- SMS Configuration - Web-based provider settings with encrypted credentials
- E.164 Format - Automatic phone number validation
- Delivery Options - Send via email, SMS, or both
- Custom Messages - Add personalized message to navigation links
- Map Service Selection - Choose specific service or send all navigation links
- Comprehensive Vehicle Details - Make, model, year, VIN, license plate, color, purchase info
- Vehicle Types - Sedan, SUV, truck, van, cargo van, pickup truck
- Status Management - Active, inactive, in maintenance, retired
- Condition Tracking - Excellent, good, fair, poor, needs repair
- Mileage Tracking - Current odometer reading with automatic updates from fuel logs
- GPS Location - Store current vehicle coordinates (6 decimal precision), last update timestamp
- Service History - Complete maintenance record tracking with service dates and mileage
- Maintenance Types - Oil change, tire rotation, brake service, inspection, tune-up, transmission, coolant, battery, repairs
- Cost Tracking - Labor costs, parts costs, total cost calculations
- Recurring Schedules - Set next due date and/or mileage for scheduled maintenance
- Overdue Detection - Automatic alerts for overdue maintenance based on date or mileage
- Service Provider - Track mechanic or service center details
- Fuel Purchases - Log fuel purchases with date, mileage, gallons, cost per gallon
- Automatic MPG Calculation - Calculate miles per gallon based on previous fill-up
- Cost Analysis - Track total fuel costs, average cost per gallon
- Efficiency Trends - Monitor MPG trends over time (30-day average)
- Station Tracking - Record gas station locations for each fill-up
- Interactive Vehicle Diagrams - SVG-based vehicle diagrams with clickable areas for damage reporting
- Damage Severity - Minor, moderate, major, total loss classifications
- Photo Documentation - Upload damage photos via attachment system
- Repair Tracking - Repair status (reported, assessed, in repair, completed, deferred)
- Cost Estimates - Track estimated and actual repair costs
- Insurance Claims - Claim number, insurance payout tracking
- Repair Details - Repair date, shop, notes
- Condition Changes - Track before/after condition status
- Unified Inventory Page - Single page with filter tabs: All, Vehicles (flat), By Vehicle, Shop — no separate menus
- Per-Vehicle Inventory - Track tools, cables, connectors, hardware, supplies stored in each vehicle
- Shop/Warehouse Inventory - Separate inventory pool for items stored at base location (not vehicle-specific)
- Categories - Organize by cables, tools, hardware, supplies, etc.
- Quantity Tracking - Current quantity with units (ea, ft, box, etc.)
- Low Stock Alerts - Set minimum quantity thresholds with high-contrast row highlighting
- Value Tracking - Unit cost and total value calculations
- Storage Location - Note where items are stored (vehicle compartment or shop shelf/cabinet)
- Reorder Links - Store reorder URLs (Amazon, eBay, etc.) with one-click cart button in all inventory tables
- Reorder Quantity - Track how many to order when restocking
- Auto-Generated QR Codes - Every inventory item gets a unique QR code on creation (never changes)
- Vehicle Items - QR codes prefixed
INV-linked to scan interface - Shop Items - QR codes prefixed
SHOP-INV-linked to shop scan interface - Scan-to-Edit - Scanning a QR code opens a mobile-optimized interface with +/- quantity buttons, set quantity, and Full Edit link
- QR Image Download - Download PNG of any QR code from the item edit form
- Global QR Print Sheet - Print all inventory QR codes (vehicle + shop) on one page, filterable by vehicle
- Print-Optimized Layout - 4-column grid layout when printing for adhesive label sheets
- Assignment Management - Assign vehicles to users/technicians
- Assignment History - Track full assignment history with dates
- Mileage Attribution - Record starting and ending mileage for each assignment
- Duration Tracking - Calculate assignment duration in days
- Miles Driven - Calculate miles driven during each assignment period
- Active Status - Identify currently assigned vehicles
- Insurance Details - Provider, policy number, premium amount
- Expiration Tracking - Insurance and registration expiration dates
- Expiration Warnings - 30-day advance warnings for expiring insurance/registration
- Automatic Alerts - Dashboard and webhook notifications for expiring documents
- AI-Powered OCR - Photograph or upload a receipt on any device; Claude vision API automatically extracts vendor, date, total amount, tax, expense category, and odometer reading
- Mobile Camera Capture - Receipt upload form opens rear camera directly on Android and iOS (no app required)
- AI Confidence Indicator - High / Medium / Low confidence banner prompts users to review uncertain extractions before saving
- Duplicate Prevention - SHA-256 image hash blocks the same receipt from being imported twice across any vehicle
- Expense Categories - Fuel, Maintenance, Repair, Insurance, Registration, Tolls/Parking, Cleaning/Detailing, Inspection, Other
- Cost Summary Dashboard - Per-category totals (Fuel, Maintenance, Repair) plus grand total shown as summary cards on the vehicle detail Receipts tab
- Receipt Image Storage - Original receipt image saved alongside the structured data record
- Odometer Integration - If receipt shows a mileage reading, it is extracted and stored for service history correlation
- Phone Shortcut button on every vehicle's Receipts tab — shows a QR code, copyable URL, and Add to Home Screen instructions for Android and iOS
- Per-vehicle QR code — scanning opens Add Receipt directly for that vehicle; no navigation needed
- PWA shortcuts — long-pressing the Client St0r home screen icon shows "Scan Receipt" and "Vehicles" shortcuts (Android Chrome)
- Quick Receipt page (
/vehicles/receipts/quick/) — vehicle picker landing page; auto-redirects if only one active vehicle
- Fleet Statistics - Total vehicles, active count, in maintenance, total mileage
- Clickable Stats - Navigate to filtered vehicle lists from dashboard cards
- Recent Activity - Recent fuel logs, maintenance, damage reports
- Fleet Metrics - Average mileage per vehicle, average MPG, total fuel costs
- Alert System - Insurance/registration expiration, maintenance due, low inventory
- Enable/Disable - Toggle vehicles module on/off via system settings
- Menu Integration - Dynamic navigation menu based on feature status
- Process Templates - Create reusable workflow templates with sequential steps
- Process Categories - Organize by type (onboarding, offboarding, deployment, maintenance, incident, backup, security, change)
- Global & Org Processes - Superuser templates available to all organizations, or org-specific custom workflows
- Tagging & States - Tag workflows for organization, control visibility with published/archived states
- One-Click Launch - Prominent "Launch Workflow" button with automatic assignment to launcher
- Execution Options - Set due date, notes, PSA ticket linking, and note visibility (internal/public) at launch
- Status Tracking - Monitor Not Started, In Progress, Completed, Failed, or Cancelled workflows
- Execution List View - Complete history with advanced filtering by status, workflow, and assigned user
- Visual Dashboard - Color-coded status badges, progress bars, overdue warnings, and sortable columns
- Interactive Checklist - AJAX-powered stage completion with real-time progress updates
- Stage Management - Reorder stages, mark as required, add notes, set time estimates
- Complete Activity Timeline - Every action logged with user, timestamp, and IP address
- Tracked Events - Workflow launches, stage completions/uncompletions, status changes, notes, due dates, PSA updates
- Timeline View - Chronological activity feed grouped by date with color-coded events
- Change History - Old/new values stored in JSON, dual logging to workflow and system-wide audit logs
- Ticket Linking - Link workflows to PSA tickets at launch with automatic completion summaries
- Note Visibility Control - Choose public (customer-visible) or internal (staff-only) notes
- Supported Platforms - ITFlow, ConnectWise Manage, Syncro (more providers framework-ready)
- Error Handling - PSA failures don't block workflow completion
- Flowchart Generation - Auto-generate draw.io diagrams with color-coded stages
- Entity Linking - Link knowledge base docs, passwords, secure notes, or assets to workflow stages
- Quick Access - View all linked entities directly from execution view
3 Network Controller Integrations:
- UniFi - Ubiquiti UniFi Network controller: auto-discover switches, APs, gateways, cameras; import as assets; configurable scheduled sync
- Omada - TP-Link Omada controller: auto-discover switches, APs, gateways, EAPs; session-based auth with CSRF; site-aware sync
- Grandstream - Grandstream UCM/GDMS: Bearer token auth; auto-discover wireless APs; import as assets with MAC/serial deduplication
- Asset Auto-Import - Discovered devices imported as assets with name, type, serial number, MAC address, IP address, firmware version
- Smart Deduplication - Match existing assets by MAC address first, then serial number — updates instead of duplicating
- Scheduled Auto-Sync - Configurable sync interval (minutes); systemd timer runs sync_network_assets management command
- On-Demand Sync - Trigger manual sync from the Integrations page
- Encrypted Credentials - All API keys, tokens, and passwords stored with AES-256-GCM encryption
- Asset Type Mapping - Device types automatically mapped (switch, wireless_ap, gateway, camera, etc.)
- Import Preview - Review discovered devices before importing
- Connection Testing - Verify controller connectivity before saving
8 Fully Implemented Providers:
- ConnectWise Manage - Companies, contacts, tickets, projects, agreements
- Autotask PSA - Companies, contacts, tickets, projects, agreements
- HaloPSA - Companies, contacts, tickets with OAuth2
- Kaseya BMS - Companies, contacts, tickets, projects, agreements
- Syncro - Customers, contacts, tickets
- Freshservice - Departments, requesters, tickets
- Zendesk - Organizations, users, tickets
- ITFlow - Open-source PSA with full API support
- Automated Sync - Scheduled synchronization via systemd timers
- Manual Sync - On-demand sync with force option and test connection
- Field Mapping - Flexible field mapping with conflict resolution
- Error Handling - Comprehensive error logging and sync history
- Auto-Create Organizations - Automatically create Client St0r organizations from PSA companies
- Smart Duplicate Prevention - Detects existing organizations by external ID
- Configurable Settings - Enable/disable per connection, set active/inactive state, add custom name prefixes
- External ID Tracking - Links organizations to PSA companies for update sync
Complete Infrastructure with 5 Provider Frameworks:
- Tactical RMM (Fully Implemented) - Device/site/agent management, real-time monitoring, software inventory, WebSocket updates
- NinjaOne (Infrastructure Ready) - OAuth 2.0 authentication, device management endpoints
- Datto RMM (Infrastructure Ready) - Device inventory sync, component tracking, alerts
- Atera (Infrastructure Ready) - Agent management, ticket integration, monitoring
- ConnectWise Automate (Infrastructure Ready) - Computer management, location tracking, script execution
- Automated Device Sync - Scheduled synchronization via systemd timers with configurable intervals
- Device Location Mapping - Display RMM devices with location data on interactive map with toggle controls, color-coded status markers, and device details
- Asset Mapping - Automatic linking of RMM devices to asset records by serial number/hostname
- Alert Management - Import and track RMM alerts with severity levels and status
- Software Inventory - Track installed software per device with version tracking
- Online Status Tracking - Real-time device connectivity and last-seen timestamps
- Encrypted Credentials - All API keys and tokens encrypted with AES-256-GCM
- Provider Abstraction - Unified interface across all RMM platforms
- Auto-Create Organizations - Automatically create Client St0r organizations from RMM sites/clients
- Smart Duplicate Prevention - Detects existing organizations by external ID
- Configurable Settings - Enable/disable per connection, set active/inactive state, add custom name prefixes
- External ID Tracking - Links organizations to RMM sites for update sync
- Alert Types - Website downtime, SSL expiration, domain expiration, password expiration
- Notification Channels - Email (SMTP), webhooks, in-app dashboard notifications
- Audit Reports - Activity statistics, security events, resource usage with CSV/JSON export
- System Reports - Organization statistics, user activity, integration status, system health metrics
- Feature Toggle - Enable/disable Reports & Analytics per organization via Feature Toggles
- System Settings - Site configuration, security settings, SMTP with encrypted credentials, maintenance mode
- Feature Toggles - Enable/disable features per organization (Reports, Asset Management, Password Vault, Documentation, etc.)
- Database Management - Optimize, analyze, backup, and migration tools
- User Management - Create users with roles, bulk operations, suspension, password reset, 2FA management
- REST API - Full CRUD for all resources with API keys (HMAC-SHA256) or session authentication
- Endpoints - Organizations, users, assets, passwords, documents, contacts, PSA integrations, monitors, audit logs
- Features - Pagination, filtering, sorting, field selection, bulk operations, rate limiting
- Install Page (
/core/install/) - Dedicated, shareable page with everything needed to install Client St0r on any device; no login required so you can send the link to staff - QR Code - Automatically generated QR code of your server URL; scan with any phone camera to open the site instantly
- Downloadable QR PNG - Download the QR code image to print and stick on a desk, wall, or whiteboard for staff to scan
- One-tap Install (Android / Desktop) - Install button appears automatically on Android Chrome and desktop Chrome/Edge when the browser supports PWA install; one tap adds the app icon
- iPhone / iPad (Safari) - Step-by-step instructions: Share button → Add to Home Screen; works without any browser prompt since iOS requires manual flow
- PWA Shortcuts - On Android, long-pressing the installed Client St0r icon shows shortcuts: Scan Receipt and Vehicles
- How to find it - Profile dropdown (top-right avatar) → Install App / Add to Home Screen
- Receipt scanning form - Camera capture (
capture="environment") opens rear camera on mobile; AI Extract button fills fields automatically - Vehicle picker (
/vehicles/receipts/quick/) - Fast mobile landing page for choosing a vehicle before scanning a receipt; auto-redirects when only one vehicle exists - QR scan interfaces - Inventory scan, shop scan, and receipt capture pages all designed for one-handed mobile use
- Responsive layout - Bootstrap 5 grid; all tables, forms, and dashboards adapt to phone screen widths
- Design - Bootstrap 5, dark mode, mobile responsive, DataTables, tooltips, progress indicators
- Navigation - Breadcrumbs, global search, recent items, favorites
- Accessibility - Keyboard navigation, ARIA labels, high contrast, semantic HTML
- Extensibility - Django apps, plugin system, custom fields, hooks, customizable templates
- Development Tools - Management commands, seed data, test suite, debug toolbar, API docs
- Universal CSV Import - Import any data from CSV or spreadsheet files with a visual field mapper
- Field Mapper - Step-by-step import: select target model (Assets, Passwords, Contacts, Documents), then map each CSV column to a destination field
- Preview - See the first 5 rows of your data before mapping to identify columns
- Auto-Suggestion - Column names are automatically matched to likely target fields
- Hudu Import - Direct import from Hudu exports (assets, passwords, contacts, documents)
- IT Glue Import - Direct import from IT Glue exports
- MagicPlan Import - Floor plan import from MagicPlan exports
- Import History - Track all import jobs with status, record counts, and error details
- Source Tracking - Each imported record tagged with source platform
- CSV/JSON Export - Export assets, audit logs, and reports
- Encrypted Backups - Automated encrypted backup with configurable retention
- One-Click Restore - Restore from backup via web interface
- Data Integrity - Comprehensive validation, database constraints, ACID transactions, rollback
- Optimization - Database indexing, query optimization, caching, lazy loading, pagination
- Scalability - Horizontal scaling, database replication, CDN integration, minified assets
- Installation - One-command install, Docker support, systemd integration, Nginx config
- Maintenance - Zero-downtime updates, automated backups, log rotation, health checks
All features developed with assistance from Luna the GSD 🐕