System Requirements
QUBIQ ships as one installer per operating system, carrying a self-contained application and its own private Python runtime. There is no database server, message broker, web server — or Python — to install alongside it.
Supported platforms
| OS | Architectures | Notes |
|---|---|---|
| Windows 10/11, Server 2019+ | x64 | Encryption keys are protected by the operating system. |
| Linux (glibc or musl) | x64, arm64 | Runs on Debian/Ubuntu, RHEL/Rocky, Alpine, and on ARM SBCs. |
| macOS 12+ | x64, Apple Silicon | Primarily a development/engineering-workstation target. |
Nothing else has to be installed on the target machine: no runtime to provision, no database engine, no compiler toolchain.
Changed in 1.0.6 A Windows arm64 build exists and is produced on request; it is not part of a release, and nobody has yet run a gateway on a Windows ARM machine for long enough for us to support one. An ARM64 Windows laptop installs and runs the x64 build under emulation today, which works and is what the installer ships.
An earlier revision of this page listed arm64 beside x64 on the Windows row as though it were a download. Ask us if you need the native build.
Hardware sizing
Sizing is driven mainly by tag count, historian write rate and concurrent LiveView sessions.
| Deployment | Tags | CPU | RAM | Disk |
|---|---|---|---|---|
| Evaluation / single machine | < 500 | 2 cores | 2 GB | 5 GB |
| Small plant | 500 – 5,000 | 4 cores | 4–8 GB | 50 GB + history |
| Site | 5,000 – 50,000 | 8+ cores | 16 GB+ | 250 GB + history |
Notes:
- Disk is dominated by history. The configuration database itself stays small — time-series volume lives in QuestDB. Size that separately from the retention policy.
- RAM scales with subscriptions, not with total tags. A namespace of 50,000 tags with 2,000 actively subscribed behaves like a 2,000-tag system.
- The supervisor runs one OS process per service, so more cores translate directly into parallelism across protocol workers, the engine and the historian.
Prerequisites
There are no software prerequisites to install QUBIQ. The installer brings everything the
platform itself needs, including a private, version-pinned Python runtime — you do not install
Python, create a virtual environment, or run pip install.
The embedded message bus, the configuration database, the web server and the full-text search index
are all built in.
Two external data stores are needed before a production deployment is complete. Neither blocks installation; QUBIQ runs without them and tells you what is missing.
| Store | Needed for | Notes |
|---|---|---|
| QuestDB 9.4.0 or later 1.0.8 | The historian | Configured as a QuestDB connection. Without one, live values still work — nothing is retained. |
| An external SQL database | The audit journal | Postgres, MySQL or SQL Server. Deliberately never the app's own database, so a compromise of QUBIQ cannot rewrite its own history. |
The historian relies on QuestDB 9.4.0 features to build a full bucket grid per tag in one query. A store older than 9.4.0 is refused when you designate it as the historian, and the message names the version found. A store that is already designated keeps recording if it is older, but raises a critical alert until QuestDB is upgraded, so an upgrade notice never turns into lost data. A build whose version cannot be read — QuestDB Enterprise numbering, for example — is allowed with a warning. → Historian
Network ports
| Port | Service | Exposure |
|---|---|---|
| 8182 | CoreServer — HTTP API, web UI, WebSocket upgrade | The one port operators and engineers connect to. |
| 8183 | RealtimeGateway — telemetry WebSocket fan-out | Reachable by browsers; proxy alongside 8182. |
| 8090 | RestGateway — REST ingress/egress for third-party systems | The Windows installer opens it in the firewall; it is the intended door for machine access. Remove the rule for a locked-down install. |
| 8091 | ScriptingGateway | Internal, loopback only. |
| 162/udp | SNMP trap listener | Opt-in, off by default. |
The internal message bus binds to loopback on a random port and is never exposed. Individual services do not open ports of their own — cross-service traffic never leaves the machine.
On Windows the installer adds firewall rules for 8182 and 8090; on Linux and macOS, open them in the
host firewall if it has one. Change the defaults afterwards with PORT, REALTIME_PORT, REST_GATEWAY_PORT and
SCRIPTING_GATEWAY_PORT — see Environment variables.
Port 8090 carries API keys over the network. Enable TLS or terminate it at a reverse proxy before issuing keys.
Outbound
QUBIQ initiates connections to whatever you configure: OPC-UA servers (typically 4840), MQTT
brokers (1883/8883), Modbus TCP devices (502), SNMP agents (161/udp), your databases, and
QuestDB — 8812 (PostgreSQL wire, for queries) and 9000 (HTTP, for writes).
1.0.8 A new QuestDB connection writes over HTTP on 9000,
which reports a refused row instead of dropping it; an existing connection pinned to port 9009
keeps the older TCP transport until you change it.
Browser support
The Platform and LiveView target current Chrome, Edge, Firefox and Safari. The Designer canvas, 3D viewer and charting are GPU-accelerated — an operator panel PC with hardware compositing disabled will work but will feel slow with large screens.
Where data is stored
The installer pins the data directory with QUBIQ_DATA_DIR, so a service account with no user
profile still finds it.
| OS | Application | Data directory |
|---|---|---|
| Windows | C:\Program Files\QUBIQ | C:\ProgramData\QUBIQ |
| Linux | /opt/qubiq | /var/lib/qubiq |
| macOS | /usr/local/qubiq | /Library/Application Support/QUBIQ |
QUBIQ installs machine-wide on every platform, as a service — see Installation. The data directory sits deliberately outside the install tree, so an upgrade or an uninstall cannot take it with them.
Inside the data directory:
.env JWT_SECRET and ENCRYPTION_KEY — generated on first boot
projects/ per-project view, script and asset trees
user-databases/ sandbox for user-created SQLite connections
python-packages/ admin-installed Python modules for the script sandbox
mibs/ uploaded SNMP vendor MIBs
log/ rotated diagnostic reports
The directory also holds the configuration database and the machine-bound key that protects it.
The installer locks the directory down — a restrictive DACL on Windows, owner-only on Unix — because
it holds the configuration database, .env and every connection credential.
The configuration database is encrypted with a key bound to that machine. Copying the folder alone is not enough — you must carry the key with it, or use Backup & Restore, which re-encrypts under the target's key.