Requirements

Requirements

This page details the system requirements for running Mantis.

Hardware Requirements

Minimum (Development/Testing)

Resource	Specification
CPU	2 cores
RAM	4 GB
Storage	20 GB
Network	100 Mbps

Recommended (Production)

Resource	Specification
CPU	4+ cores
RAM	8+ GB
Storage	50+ GB SSD
Network	1 Gbps

Tip

Use SSDs for database storage to improve query performance.

Software Requirements

Container Runtime

Software	Version	Notes
Docker	24.0+	Required for containerized deployment
Docker Compose	2.20+	For orchestrating services

Database

Software	Version	Notes
PostgreSQL	16+	Primary data store

Message Queue

Software	Version	Notes
RabbitMQ	3.12+	Optional — enables push-based dispatch; Mandible falls back to polling when disabled. When used, TLS is required (a CA certificate must be configured)

Cache

Software	Version	Notes
Redis	7.0+	Required (same as PostgreSQL) — auth token revocation (fails closed), sessions, cluster coordination

Network Requirements

Ports

Port	Service	Protocol	Direction / source	Required
5173	Lens UI	HTTPS	From operators/browsers	Yes
3000	Mandible REST API	HTTP/HTTPS	From operators/Lens	Yes
50051	Thorax gRPC	gRPC/TLS	From Tarsus (poll mode)	Yes
50052	Mandible internal gRPC	gRPC/TLS	From Thorax and every Tarsus agent (registration/heartbeat)	Yes
9342	Tarsus listen-mode inbound	gRPC/TLS	Dialled by Thorax (listen mode)	Yes (listen mode)
9090	Thorax metrics/health/relay	HTTP	From monitoring / relay	Yes
9091	Mandible metrics	HTTP	From monitoring (MANDIBLE_METRICS_BIND_ADDR)	Yes
5432	PostgreSQL	TCP	Internal (Mandible)	Internal
5671	RabbitMQ	AMQPS	Internal	Internal
6379	Redis	TCP	Internal (clustering)	Internal

Note

Mandible (port 3000) supports direct HTTPS termination when server.tls.cert_path and server.tls.key_path are configured, or plain HTTP when running behind a reverse proxy (nginx, Caddy). TLS is not enabled by default.

Firewall Rules

Caution

Expose Lens (5173) and Mandible’s REST API (3000) to operators. Critically, Mandible’s internal gRPC port (50052) must be reachable from Thorax and from every Tarsus agent — it is the registration/heartbeat hub, so blocking it stops all agent registration and heartbeats. Thorax gRPC (50051) must be reachable from poll-mode agents, and each agent’s listen port (9342) must be reachable from Thorax in listen mode. Database, queue, and cache (5432/5671/ 6379) stay internal.

TLS Certificates

Mantis requires TLS certificates for:

• Server certificates - For Lens, Mandible, and Thorax
• Client certificates - For Tarsus agents (mTLS)
• CA certificate - For signing and verification

See TLS Certificates for certificate setup.

Browser Support

The Lens UI supports:

• Chrome 90+
• Firefox 88+
• Safari 14+
• Edge 90+

Next Steps

• Docker Compose - Install using Docker
• Kubernetes - Install on Kubernetes