Hardware
Recommended hardware and virtualization requirements for production environments.
Minimum requirements
Processor: Intel Xeon E5 or newer / AMD Ryzen 5 or newer
CPU: At least 4 cores; 8 cores or more recommended
RAM: At least 4 GB; 8 GB or more recommended
Disk space: At least 80 GB; 260 GB or more (SSD) recommended
Network card: Gigabit Ethernet
Operating system: Debian 12 (Bookworm) or newer
Software & Operating System
Requirements for the installed operating system.
Installation:
NDPro is a Node.js project designed to run on the Debian Linux distribution.
Operating system: Debian 12 (Bookworm, "No-Desktop" default setup) on a single partition
Configuration of an IPv4 adapter (static or DHCP) via 1GbE or 10GbE Ethernet
SSH access for administration; provision of a user named "ndpro"
Configuration of hostname and hosts file according to project requirements
Installation of the NDPro environment via the included *.sh script; this script automates the installation of the following additional modules: curl, openvpn, openssl, htop, zip, unzip, ufw, samba, sqlite3, ca-certificates, gnupg, and apache2
The script installs the latest Node.js LTS version (22.11 or newer) for NDPro operation, along with PM2 as a watchdog process and npm/ncu as package managers
The installation process includes an option to configure SMB/Samba for directory sharing
Automatic setup of the UFW firewall, allowing traffic for SSH, (SMB), HTTP, and HTTPS
Download of the current NDPro package from update.ndpro.app
Extraction and installation of the NDPro environment within the "ndpro" user's home directory
User Context:
NDPro runs under the "ndpro" user context without root privileges; services are managed via PM2/systemd.
Generation of a self-signed certificate as a default solution (to be replaced later by a user-provided certificate)
Setup and configuration of the Apache2 VirtualHost environment for HTTPS forwarding/proxying
Setup of the OpenVPN client on the NDPro update bridge (AES-256-GCM, ECDSA secp521r1 + TLS)
Finalization, including provision of the system key for documentation purposes
Further system configuration is performed via the NDPro web interface
Network & Firewall
NDPro is designed as a central platform for local operation. Communication with AV and building technology systems takes place locally via IP-based device interfaces. All core functions—such as control, automation, user interfaces, backups, and scheduling—are fully available offline. An internet connection is required for the following services: operating system/service updates, NDPro Updater (software updates & patches), and NDC Monitoring (status reports, notifications).
DNS routing for visualizations:
Touch panels, web browsers, and mobile devices always connect to the NDPro server using a domain name. The configured DNS server must resolve this domain to the IP address of the NDPro controller.
Example: projectdomain.ndpro.app → 192.168.100.5
Production environments require valid, publicly trusted TLS certificates. These can be provided either by the operating organization or the integration partner. Automatic renewal, for example via Let’s Encrypt, is recommended. Wildcard certificates are fully supported. For initial setup, NDPro generates a self-signed certificate.
The configuration files generated by NDPro contain the configured domain. Touch panels and web browsers expect a valid TLS connection by default. Servers using self-signed certificates are rejected by many devices and browsers unless explicitly allowed.
For test environments, many manufacturers provide an option to temporarily bypass certificate validation. This option should only be used for development and testing purposes.
To ensure reliable TLS communication, the device’s date, time, time zone, and NTP synchronization must also be configured correctly. DNS resolution should be verified directly on the target device. The configured domain must resolve to the IP address of the NDPro server.
Firewall rules for internet access:
HTTPS (TCP Port 443): The controllers require HTTPS access for the secure transmission of status, operational, and error reports.
DNS (TCP/UDP Port 53 + 853): The controllers require access to an internal or external DNS server for domain name resolution (e.g., 8.8.8.8 / 8.8.4.4).
NTP/SNTP (UDP Port 123): The controllers require access to an internal or external time server (NTP) to ensure accurate timestamping of system events.
VPN (UDP Port 1201): The controllers require access to the NDPro update server to continuously receive software updates and security patches.
General: For operating system updates, TCP ports 80 and 443 should be enabled (either selectively or permanently) to allow the download of update packages from Debian repositories.
Firewall rules for local communication:
Access to NDPro – The following protocols/ports must be accessible for administration, visualization, and file access: SSH (22), HTTP (80), HTTPS (443), SMB (445).
Access from NDPro to end devices – Control operations require flexible communication paths depending on the manufacturer and protocol. Therefore, traffic originating from the NDPro controller to end devices should be permitted as ANY TCP/UDP + ICMP to ensure full functionality for all manufacturer-specific APIs, status updates, and protocol-based communication.