Server requirements

What a MaxTrax site needs to run. This page is for whoever installs and looks after the servers. MaxTrax runs on your own Windows server with IIS, or on Azure App Service, and keeps its data in Microsoft SQL Server.

The short answer

• One web server and one SQL Server database per site. A site is one MaxTrax address with its own database. Projects that need a hard boundary between them (for example under separate NDAs) each get their own site and database. See Projects, roles and shared data.
• Size the web server by memory, not CPU. One or a few projects: 2 CPU cores and 8 GB of memory. Many users, large imports and weekly reports: 4 cores and 16 GB.
• Installing is a .zip file. Extract it into the site folder, set the database connection string, and start the site. MaxTrax creates its own tables and starting data. See Install and upgrade.
• Email needs your SMTP server. Without one, MaxTrax sends no email.
• Open only what is needed: HTTPS from users to the web server, SQL Server from the web server to the database, and outbound mail. Users never reach SQL Server.

Windows server with IIS

• Operating system: Windows Server 2022 or later, 64-bit. .NET Framework 4.8.1 does not run on Windows Server 2019 or earlier.
• Web server: IIS 10 or later with ASP.NET 4.8 and the WebSocket Protocol role service. URL Rewrite is optional, for redirecting http to https in IIS.
• .NET: .NET Framework 4.8.1. The application pool runs 64-bit (Enable 32-Bit Applications set to False) with the Integrated pipeline.
• Application pool: one pool, with its own identity, for each site. Set Idle Time-out to 0 and Start Mode to AlwaysRunning (with Preload Enabled on the site), because scheduled reports, subscriptions and Excel imports run inside the site. Recycle outside working hours.
• Folder rights: the pool identity needs Read & Execute on the site folder and Modify on App_Data only. One site's identity must not reach another site's folder.

SQL Server

• A supported SQL Server release (2019 or later recommended), Standard or Enterprise edition, or Azure SQL Database.
• One database per site. Never share a database between sites.
• One login per site, with rights in its own database only: read, write, and create and alter objects (db_datareader, db_datawriter and db_ddladmin). MaxTrax creates and updates its own tables at start-up. Never give it sysadmin or any server-level role.
• Encrypt the connection: put Encrypt=True in the connection string, and give the SQL Server a certificate the web server trusts.
• Start the SQL Server instance at 2 CPU cores and 16 GB of memory for MaxTrax, and add memory as more site databases get busy.

How big

• Web server: 2 cores and 8 GB for one or a few projects. 4 cores and 16 GB at production scale. Memory sets the size: the MaxTrax process idles at 1 to 1.5 GB, but a heavy report or a large Excel load can take it to between 7 and 14 GB within minutes, while CPU stays low.
• Disk on the web server: 10 GB for the application files, plus room for logs.
• Database: the audit trail and stored documents (PDFs and photos) are most of it. Plan 50 GB of data volume for a new project and 100 GB for a large one, plus room for backups. A busy site that has run for several years holds about 90 GB and grows about 2 GB a month.
• One web server per site. Make it larger rather than adding servers. Two or more servers for one site need extra setup (see Server settings), and on Azure SQL they are not supported.

Browsers

The current Microsoft Edge or Google Chrome. The classic view also runs in Firefox and Safari. Internet Explorer is not supported.

Network and security

• Ports: users to the web server on 443 only. Web server to SQL Server on 1433 (or the instance's port). Web server to the mail server on 587. Nothing from users to SQL Server.
• TLS: a certificate from your own certificate authority on each site, TLS 1.2 or later. MaxTrax sets secure session cookies and a strict-transport header. It does not redirect http to https by itself: remove the http binding, or redirect in IIS or at your proxy.
• Separate each site: its own folder, application pool identity, SQL login and machineKey in Web.config. That keeps a problem in one site away from another site's data.
• Background jobs dashboard: /hangfire on each site opens only for a signed-in Corporate Administrator or System Administrator. You can also restrict that path to administrators' addresses in IIS or at your proxy.
• Single sign-on needs outbound HTTPS from the web server to the identity provider. See Single sign-on.

Azure App Service

MaxTrax runs the same way on Azure:

• App Service: a Windows App Service plan, the .NET Framework 4.8 stack, 64 Bit platform and Always On. A Premium v3 P2v3 plan (4 vCPU, 16 GB) suits production scale; a smaller plan suits one or a few projects, but leave room for memory peaks. Run one instance per site: scale up, not out.
• Azure SQL: one server, one database per site. General Purpose with 2 vCores handles a busy site.
• Secrets: Azure Key Vault, read by the app's managed identity. See Server settings.
• Email: an SMTP server the app can reach on port 587.
• Monitoring: Application Insights, if you want logs and errors in Azure.

Real-time notifications stay on one instance on Azure, because SignalR's SQL Server backplane does not work with Azure SQL.