01MINIMUM
Pilot / module-only
Evaluation, private teams, or Core plus one product profile.
- Compute
- 8 vCPU
- Memory
- 16 GB RAM
- Storage
- 250 GB NVMe
- Network
- 100 Mbps
SecurePhone appliance requirements
Provision once.
Deploy prepared.
Use these supported starting configurations to plan compute, memory, NVMe storage, networking, DNS, and backups before installation. Final sizing follows your actual data and realtime workload.
01Fresh Ubuntu host02Static IP + DNS03External backups04Profile-based firewall
Supported starting configurations
Match the host
to the operating model.
These profiles are starting points—not hard capacity ceilings. Mailbox quotas, concurrent calls, VPN throughput, retention, and high availability are confirmed during architecture review.
02RECOMMENDED
Production all-in-one
Core, Realtime, and Mail on one commercial host.
- Compute
- 16 vCPU
- Memory
- 32 GB RAM
- Storage
- 1 TB NVMe
- Network
- 1 Gbps
03COMMERCIAL
Standard three-node
Operational isolation for a reseller running the full suite.
- Servers
- 3 nodes
- Compute
- 24 vCPU total
- Memory
- 48 GB total
- Storage
- 1.5 TB NVMe
Host baseline
A clean foundation
before installation.
The installer preflights the operating system, container runtime, DNS, reachability, certificates, storage, and required provider access before appliance services start.
- 01
Ubuntu 24.04 LTS, x86-64
Fresh supported host with root or equivalent administrator access.
- 02
Docker Engine 24+ and Compose v2
SecurePhone installs signed OCI containers; nested virtualization is not required.
- 03
Static public addressing and DNS control
One public IPv4 per internet-facing node; IPv6 is recommended.
- 04
External backup destination
Keep at least 2× protected data capacity outside the appliance.
- 05
Time sync and outbound HTTPS/DNS
NTP, package registry, license renewal, provider APIs, and certificate issuance must be reachable.
Three-node baseline
Start each profile
with dedicated capacity.
The standard commercial topology begins with independent Core, Realtime, and Mail hosts connected by private networking.
A
8 vCPU16 GB250 GBCoreCommerce Hub · MDM · data
B
8 vCPU16 GB250 GBRealtimeChat · SIP · TURN · media
C
8 vCPU16 GB1 TBMailKeyMail · queues · mailboxes
Network and firewall
Open only what each licensed profile uses.
SSH remains restricted to trusted administrator IPs. Cleartext SIP on 5060 stays closed by default, while the installer validates required public services.
KeyMail requires: a dedicated public IP, forward DNS, working PTR/rDNS, and outbound TCP 25 permitted by the provider.
Administration22/TCPTrusted IPs only
Web + API80, 443/TCP · 443/UDPPublic
Global Chat5222/TCP · 5269/TCP5269 only for federation
Voice + media5061/TCP · 10000–20000/UDPSIP-TLS + SRTP
STUN / TURN3478/UDP · 5349/TCPPublic
KeyMail25, 465, 587, 993/TCPDedicated IP + PTR
Managed VPN51820/UDPWhen enabled
Final architecture review
Storage follows data.
Bandwidth follows traffic.
The final configuration converts business usage into infrastructure capacity and identifies where a scale-out profile is appropriate.
Mailbox data
Size KeyMail from user quotas, attachment volume, retention, growth, and backup history.
Concurrent realtime traffic
Size Voice and media from concurrent calls, codec choices, recording, and TURN relay demand.
VPN throughput
Size managed VPN around aggregate encrypted throughput, not only the number of enrolled devices.
Availability target
High availability may add load balancers, databases, object storage, or additional profile nodes.
Ready for architecture review
Build the complete appliance quote.
Choose users, modules, deployment infrastructure, and custom requirements in one customer-ready configuration.
Open the configurator