RivetMSP

A fork of ITFlow with extended MSP workflow features built by Foley IT.

Upstream Project · Docs · Architecture · API Reference · Releases · Report Bug · 📱 Android App

---

This is a fork. It tracks the upstream itflow-org/itflow and merges updates regularly. All original credit goes to the ITFlow contributors. MSP-specific additions are maintained here by Foley IT / TractorHacker.

---

About

RivetMSP is a hardened, feature-extended build of ITFlow — the free and open-source IT documentation, ticketing, and accounting platform for managed service providers.

This fork adds real-world MSP dispatch and scheduling workflows that go beyond the upstream project, while staying in sync with upstream security patches and improvements.

We also built a native Android app from scratch to go alongside this fork — giving technicians full mobile access to tickets, assets, clients, worksheets, and more. Check it out at TheTractorHacker/rivetmsp-mobile.

New to this codebase? docs/ARCHITECTURE.md covers the admin/agent/client/guest portal structure, auth & permission model, data model, module toggles, and integrations. docs/API.md is the narrative companion to the REST API.

---

📱 Android App

A native Android companion app is available at TheTractorHacker/rivetmsp-mobile.

Built with Kotlin + Jetpack Compose + Material 3. Features include:

• Dashboard with open ticket counts, recent activity, and alerts
• Full ticket management — view, reply, change status, assign, add charges
• Asset browsing and detail view with barcode/QR scanner
• Client list with contacts, locations, and credentials
• Worksheet viewing and response entry
• Global search across tickets, clients, and assets
• Push notifications for new tickets and assignments

Requires your RivetMSP server running v2.4.12+ with the REST API enabled.

---

What's Added in This Fork

Webhooks

Send events to the tools you already run, without writing glue code.

• 24 ready-made platforms: n8n, Node-RED, Activepieces, Windmill, Huginn, Zapier, Make, Pipedream and IFTTT (automation); Slack, Microsoft Teams, Discord, Mattermost, Rocket.Chat, Matrix (hookshot and client API) and Telegram (chat); ntfy, Gotify and Apprise (notifications); Home Assistant; and generic JSON, form and custom-template webhooks. Each has a step-by-step guide in Administration > Webhooks > Guides.
• 113 events in 14 groups (tickets, SLA and escalations, approvals and service catalog, workflows and lifecycle, problems and changes, assets, clients, billing, security and sign-in, audit and compliance, backups and system, automation and jobs, integrations, training), 96 of them emitted today and 17 planned. A searchable event picker with group wildcards (ticket.*) and quick chips ("Critical only", "SLA problems", "Security & sign-in").
• 13 payload formats (JSON, form, Slack blocks and attachments, Teams, Discord, ntfy, Gotify, Telegram, Matrix, Apprise and a custom template with {{placeholders}} and safe filters), bearer, basic, custom-header and signed authentication, and POST or PUT.
• Signed and safe by default: HMAC signatures with a signed timestamp, verification snippets in Node, Python, PHP, Bash and an n8n Code node, retries after 1, 5, 30 and 120 minutes, secrets stored encrypted, and public addresses only unless an admin lists an internal network.
• A four-step guided setup with a live address check, Send test and Preview payload, a delivery log with View payload, and a tabbed Edit page.

Event rules

• A When, If, Then builder under Administration > Event rules: pick any of the 113 events in 14 groups, add conditions, and choose an action (create a ticket, send a webhook, notify technicians). Each rule shows a plain-English summary, a test drawer that dry-runs it without side effects, run history, and there are 10 ready-made recipes.

Ticket Automation

• Rule-based automation engine — create rules that run automatically on every cron cycle
• Conditions: ticket age, idle time since last reply, priority, status, assigned user, or ticket category (On-Site, Remote, Project, etc.)
• Actions: set priority, assign to user, set status, add internal note, notify assignee, close ticket, or automatically attach a worksheet template
• Smart dropdowns in the rule builder — category and worksheet selects populate from your live data

Cron Manager

• Web UI cron scheduler — change the main cron schedule (5 min / 15 min / 30 min / hourly / custom) without touching the server
• Run Now button to trigger cron immediately from the admin panel
• Shows last successful run time and all scheduled cron jobs

Ticketing

• Ticket categories with parent/group hierarchy and collapsible grouped list view
• Inline pill-style dropdowns — change Category, Assigned Tech, Priority, and Status directly from the ticket list without opening the ticket
• Syncro-style appointments — end time, duration picker (30 min – 8 hr), Remote/Onsite toggle, appointment notes, and live preview
• Ticket reply draft autosave — localStorage autosave with Restore/Discard banner so replies survive accidental navigation

Worksheets

• Unfinalize button — unlock a finalized worksheet to edit it again (unavailable on client-signed worksheets)
• Worksheet template drag-and-drop field reordering
• Worksheet percent counter — accurately counts all field types
• Automation-attached worksheets — rules can auto-attach a worksheet template when a ticket matches a condition

Calendar & Scheduling

• Outlook Calendar push sync — each technician connects their Microsoft account once; scheduled tickets automatically create, update, and cancel events in their personal Outlook calendar via Microsoft Graph API
• iCal subscription feed — per-user webcal:// URL for subscribing scheduled tickets into Outlook Classic, Apple Calendar, or Google Calendar
• Per-tech calendar colors — each technician picks a color shown on the RivetMSP dispatch calendar

Contracts & SLA

• SLA tracking on contracts — define response/resolution hours per priority tier
• Contract billing frequency — Monthly, Quarterly, Annual, or Other
• Live SLA hint on ticket add — shows expected response/resolution time when a contract is selected

REST API (for Mobile App)

• Full REST API layer under /api/v1/ powering the Android app
• Endpoints: tickets, clients, assets, contacts, locations, credentials, worksheets, charges, appointments, search, reports
• Token-based auth with rate limiting, token expiry, and payload size limits
• Full reference: docs/API.md (narrative guide) · live OpenAPI spec · in-app searchable reference at Settings → API Docs (/api/v1/docs on your own instance)

Security Fixes (beyond upstream)

• Fixed authorization bypass on ticket charge handlers (client access not enforced)
• Fixed XSS in outtake/worksheet signature storage
• Fixed SQL injection in contract name logAction call

---

Keeping Up With Upstream

This fork merges upstream changes periodically:

git fetch origin        # origin = itflow-org/itflow
git merge origin/master
git push fork master    # fork = TheTractorHacker/RivetMSP

Getting Started

Two supported ways to get a running instance, depending on what you're doing:

Option 1 — Docker Compose (fastest way to try it)

git clone https://github.com/TheTractorHacker/RivetMSP.git
cd RivetMSP
cp .env.example .env    # edit DB_PASSWORD/DB_ROOT_PASSWORD, and DOCKER_UID/DOCKER_GID (run `id -u`/`id -g`)
docker compose up -d --build

Then visit http://localhost:8080/ (or whatever APP_PORT you set in .env) — it redirects straight to the same browser-based /setup/ wizard a manual install would use. When it asks for a database host, enter db and the credentials from your .env.

This runs nginx + PHP-FPM + MariaDB + Redis in containers, with the app code bind-mounted from this checkout so config.php/uploads//backups/ all persist on the host and git pull + docker compose up -d --build is the update path. It's deliberately not hardened the way deploy/install.sh is (no fail2ban/ufw equivalent, no TLS termination) — put a real reverse proxy in front of it for anything beyond local evaluation.

Standing this container up from an existing deploy/backup.sh backup instead of a fresh install: drop the backup file and its passphrase file under ./restore/ (bind-mounted read-only into the container), set RESTORE_FROM/RESTORE_PASSPHRASE_FILE in .env to point at them, then docker compose up -d --build — see the comments in .env.example and deploy/README.md.

Option 2 — bare-metal install (recommended for a production instance)

The deployment tooling in deploy/ provisions a whole box from scratch:

git clone https://github.com/TheTractorHacker/RivetMSP.git
cd RivetMSP
sudo deploy/install.sh --domain=itflow.example.com

It provisions nginx, PHP 8.4, MariaDB, and Redis; sets up TLS; applies security hardening; and runs the app's own first-run setup (or, with --restore-from/--restore-passphrase-file, restores an existing deploy/backup.sh backup onto the new box instead) — see deploy/README.md for the full flag reference, worked examples (including adding a second company's instance to a box that already runs one), backups, and updates. If you'd rather install manually or use the upstream one-liner, see the official docs — after installing that way, replace the files with this fork's content or clone this repo directly into your web root.

Either way, deploy/backup.sh (encrypted, scheduled) is the disaster-recovery path, with deploy/restore.sh as its counterpart for standing a fresh box back up from one of those backups — see deploy/README.md.

Releases

Release	Notes
v2.6.0	Ticket automation rules, Cron Manager UI, worksheet unfinalize, Android app
v2.5.2	Outtake forms, ticket filters, worksheet delete
v2.5.0	Worksheet/charge creation, onsite tracking, products API
v1.2.6-msp	Webhooks, Passkeys, Backup, Comet, Contract Docs
v1.2.5-msp	Outlook push sync, per-tech calendar colors, modal bug fixes
v1.2.3-msp	Categories, SLA, contracts, worksheets, inline ticket actions

See all releases for full changelogs.

License

ITFlow is distributed under the GPL License. This fork inherits the same license. See LICENSE for details.

Security

If you find a security issue in the upstream project, report it here. For issues specific to this fork, open an issue.