Security and operations checklist
Applies to: the IT Admin User and Workspace Admins · Time: about 30 minutes once, then a few minutes a month
At a glance
| Priority | Task | Who | How often |
|---|---|---|---|
| Must | Limit port 3000 to the server and admin PCs | IT Admin User | Once |
| Must | Keep a safe copy of the settings file (.env) | IT Admin User | Once, and after every change |
| Must | Copy backups off the server | IT Admin User | Daily (automatic) |
| Must | Keep at least two Workspace Admins | Workspace Admin | Always |
| Must | Deactivate people who leave | Workspace Admin | When someone leaves |
| Should | Keep the server clock and time zone right | IT Admin User | Once (automatic sync) |
| Should | Watch disk space and the health check | IT Admin User | Monitoring |
| Should | Check all services after a server restart | IT Admin User | After each restart |
| Should | Renew certificates and secrets before they expire | IT Admin User | Before each end date |
| Optional | Set up SPF and DKIM for the sender domain | IT Admin User | Once |
1. Port 3000
Must do
Port 3000 opens the app directly over plain http and skips HTTPS, so passwords sent on it can be read on the network. Allow it in the firewall only from the server itself and the admins' PCs.
Keep it for emergencies: if HTTPS stops working, admins can still sign in at http://<server IP>:3000 and fix it.
2. The settings file
Warning
Backups don't include /opt/digital-workspace/.env. It holds the key (AUTH_SECRET) that protects stored passwords and certificates. Without it, a restore on a new server loses them.
- Keep a copy in your company's password vault or another safe place away from the server.
- Update the copy after every change to the file (for example after adding Google or Microsoft keys).
- Only administrators should be able to read the file on the server.
3. Backups off the server
Nightly backups stay on the server's own disk until IT copies them elsewhere. See "Backups and restore" for the copy command and how to restore.
4. Two Workspace Admins
Must do
On a server with one organization, Workspace Admins also manage the license, updates, backups and HTTPS. Keep at least two, so the company isn't locked out when one is away or leaves.
Invite the second admin in Workspace settings › Invite a new Workspace Admin. If every admin is locked out, the IT Admin User can create a one-time sign-in link on the server (see "Getting help and server commands").
5. People who leave
- Turn the person off in User Management (the Active/Off switch) on their last day. They lose access at once and their seat is free again.
- With single sign-on, also turn off their Microsoft account; they then can't sign in at all.
- Their records, documents and history stay in the workspace.
6. Server clock and time zone
- Turn on automatic time sync (NTP) on the server. If the clock is set back, the License tab warns you, because license dates are counted from the latest time seen.
- The server's time zone (
TZin .env, set by the installer) decides when nightly backups and automatic updates run. It is separate from the workspace time zone your colleagues see.
7. Disk space and health
- Uploaded files and backups grow over time. Alert at 80% disk use. A full disk stops backups and updates first.
- Add the health check to your monitoring:
https://<your address>/api/healthanswers 200 with the version when the app and database work, and 503 when the database doesn't answer.
Tip
Besides the app, the scheduler service must run. Without it, notifications, reminders, campaign emails and the Huddles auto-stop rules quietly stop. docker compose ps shows it.
8. Server restarts and patching
- Install operating system and Docker updates as usual. All services start again by themselves after a restart.
- After each restart, run
docker compose psin /opt/digital-workspace: app, db, proxy, scheduler and updater (and livekit for Huddles) should be running. - Update Digital Workspace itself only from Workspace settings › Updates (see "Installing updates").
9. Certificates and secrets that expire
| What | Where to see the date | What to do before it ends |
|---|---|---|
| Your company's HTTPS certificate | Workspace settings › HTTPS (valid until) | Upload the renewed certificate and key. Let's Encrypt and this server's own certificate renew by themselves. |
| Microsoft client secret for single sign-on | Workspace settings › Security (Secret expires on) | Create a new secret in Entra and paste it in. |
| Microsoft or Google secret for mailboxes | Entra or Google Cloud console | Create a new secret and update .env. |
| The license | Workspace settings › License (Valid until) | Contact your vendor (see "License, seats and renewal"). |
10. Emails that land in spam
All emails, including campaign emails to many people, go out through your company mail server.
- Ask your mail team to publish SPF and DKIM records for the sender address's domain, so recipients trust the emails.
- Check the mail server's sending limits before large campaigns. Some servers allow only a few hundred emails per hour.
These articles are also in the Knowledge Base on your own server, after it is updated.