Many organizations still need a service desk that runs on their own infrastructure.
They may have strict data-protection requirements, existing directory services, internal workflows, or simply want to remain in control of their system and data.
That is why we created Qisutu: a fully open-source, self-hosted service desk for ticketing, IT service management, and process automation.
Qisutu 1.0.3 is the current stable release and is ready for production use.
What Qisutu provides Qisutu combines the core components needed to operate a professional service desk: Agent and customer portals Ticket creation through the web interface and email Queue-based ticket processing Automation and configurable workflows Knowledge base and multilingual FAQ articles Configurable CMDB Reports and statistics REST API Custom customer and public web forms Time tracking with billable and non-billable entries CSV imports for customers, contacts, and agents Two-factor authentication using TOTP LDAP and Active Directory integration Microsoft 365 and Google Workspace email integration using OAuth2 A module manager and a versioned API for add-ons The system currently includes eleven complete interface languages: German English French Italian Brazilian Portuguese European Portuguese Spanish Dutch Polish Czech Turkish Built for self-hosting Qisutu runs entirely on infrastructure controlled by the organization using it.
Ticket data, customer information, attachments, credentials, and configuration remain on the operator's own server.
The software is based on: Perl and CGI MariaDB or MySQL Template Toolkit Apache A browser-based user interface The installation script prepares the required packages, Perl modules, Apache configuration, systemd services, database configuration, and web installer.
Multiple Qisutu instances can run independently on the same server.
This makes it possible to maintain separate production and test environments without mixing their databases, services, or configuration.
Email without legacy authentication Incoming and outgoing email can be connected in three ways: Standard IMAP and SMTP Microsoft 365 using OAuth2 and XOAUTH2 Google Workspace or Gmail using OAuth2 and XOAUTH2 Access tokens, refresh tokens, client secrets, and mail credentials are stored encrypted.
Qisutu automatically refreshes expired OAuth2 access tokens and records technical IMAP, SMTP, and token activity in its communication log.
Extensible without modifying the core Qisutu includes its own module manager.
Administrators can install, update, and remove add-ons as regular ZIP packages through the administration interface.
Modules use a readable manifest and can provide their own administration pages, configuration screens, REST routes, permissions, event handlers, and user-interface extensions.
The versioned internal module API allows add-ons to declare the Qisutu API version and capabilities they require.
This helps keep customer-specific functionality separate from the core system.
Security features Qisutu includes several security mechanisms directly in the core: Session-bound CSRF protection Separate bearer-token authentication for the REST API Secure and HttpOnly session cookies Encryption of stored credentials and OAuth2 tokens TOTP-based two-factor authentication One-time recovery codes Configurable mandatory 2FA for administrators, agents, and customers LDAPS and StartTLS support with certificate validation Security headers against MIME sniffing and unwanted embedding The QR code used for two-factor authentication is generated locally in the browser.
The TOTP secret is not sent to an external QR-code service.
Open source and ready to explore Qisutu is licensed under the GNU Affero General Public License 3.0 or later.
The complete source code, installation instructions, API documentation, module documentation, changelog, security policy, and contribution guidelines are publicly available.
Project website: https://qisutu.de/ GitHub repository: https://github.co