Administrator guide
Everything needed to deploy, run and remove YARMA. Start with the quick start if you want a working server in about 15 minutes.
| Guide | Covers |
|---|---|
| Quick start | One Linux server, from nothing to the first managed device |
| Single-host installation | Docker Compose deployment in detail: TLS, TURN, upgrades, backup, uninstall |
| Native installation | Ubuntu without Docker, behind an existing reverse proxy (systemd, local services) |
| Kubernetes installation | Helm chart, external dependencies, secrets, upgrades, uninstall |
| First-time setup | Organizations, administrators, sign-in, license, enrollment, policies |
| Organizations | Hosting provider, MSPs and clients: creating, licensing, suspending and opening organizations |
| Agents | Installing, mass-deploying, upgrading and uninstalling the agent on Windows, macOS and Linux |
| Troubleshooting | Common problems and how to diagnose them |
Related operations documents: releases and verification, high availability, backup and disaster recovery, privileged access (PAM), load testing and ports.
Choosing a deployment
| Single host (Docker Compose) | Kubernetes (Helm) | |
|---|---|---|
| Fleet size | up to a few thousand devices | 10,000+ devices |
| Availability | one server; restart on failure | 2–10 API replicas, rolling upgrades |
| Dependencies | all bundled (PostgreSQL, Redis, NATS, S3 store, ClamAV, TURN, Caddy) | bring your own PostgreSQL, Redis, NATS, S3, ClamAV, TURN |
| TLS | automatic Let's Encrypt, your own certificate, or self-signed | ingress controller / cert-manager |
Components
| Component | Role | Exposed to |
|---|---|---|
Console (yarma-web) |
Web console and end-user support portal; proxies /api to the API |
browsers, HTTPS 443 |
API (yarma-api) |
REST API, signaling, agent service (mTLS gRPC), background jobs | agents on TCP 18443; browsers only through the console |
| PostgreSQL 17 | all state, row-level security per tenant, append-only audit log | API only |
| Redis | rate limits, short-lived session state | API only |
| NATS JetStream | events between API replicas | API only |
| S3-compatible storage | encrypted file transfers and session recordings | API only |
ClamAV (clamd) |
malware scanning of transferred files | API only |
| TURN (coturn) | relays remote-session media when a direct WebRTC path fails | browsers and agents, UDP/TCP 3478 + relay range |
| License Center (optional) | online license activation for your customers | only if you sell YARMA licenses |
Network requirements
| Port | Protocol | From | To | Purpose |
|---|---|---|---|---|
| 443 | TCP (and UDP for HTTP/3) | technicians, end users | console | web console, support portal, API |
| 80 | TCP | anyone | console | Let's Encrypt HTTP-01 challenge, redirect to HTTPS |
| 18443 | TCP | managed devices | API | agent enrollment and control stream (mutual TLS) |
| 3478 | UDP and TCP | technicians, devices | TURN | TURN allocation |
| 49160–49200 | UDP | technicians, devices | TURN | media relay (widen for more concurrent sessions) |
Agents only make outbound connections; nothing is opened on managed devices.
Server sizing
Guidance for the single-host bundle (everything on one machine):
| Devices | vCPU | RAM | Disk |
|---|---|---|---|
| up to 500 | 4 | 8 GB | 50 GB + recordings |
| up to 2,500 | 8 | 16 GB | 100 GB + recordings |
| more | use Kubernetes with managed PostgreSQL |
ClamAV alone needs about 1.5–2 GB of RAM. Session recordings dominate storage when they are
enabled; measure a few recorded sessions and size from your retention
(files.recording_retention_days, default 90). The measured 10,000-device baseline is in
load testing.
Documentation for Yarma 0.1.0-alpha.4. Something unclear? .