Open-source service desk Qisutu hits 1.0.3 with self-hosted ITSM feature set

The developers of Qisutu, an open-source service desk aimed at organisations that must run software on their own infrastructure, have released version 1.0.3, which they describe as the current stable release and ready for production use. According to the project's announcement on dev.to, the software is licensed under the GNU Affero General Public License 3.0 or later, with the complete source code, installation instructions, API and module documentation, changelog, security policy and contribution guidelines published openly.

What the release covers

Qisutu bundles the components usually expected of a professional service desk: separate agent and customer portals, ticket intake through both the web interface and email, queue-based ticket processing, configurable workflows and automation, a knowledge base with multilingual FAQ articles, a configurable CMDB, reports and statistics, and a REST API. Time tracking distinguishes billable from non-billable entries, CSV imports handle customers, contacts and agents, and administrators can build custom customer-facing and public web forms.

Directory integration is built in, with support for LDAP and Active Directory, and the interface ships in eleven languages: German, English, French, Italian, Brazilian Portuguese, European Portuguese, Spanish, Dutch, Polish, Czech and Turkish.

A conventional stack, deliberately self-hosted

Unlike newer tools built on JavaScript runtimes or containerised microservices, Qisutu runs on Perl and CGI with MariaDB or MySQL, the Template Toolkit templating system, Apache, and a browser-based interface. An installation script prepares the required packages, Perl modules, Apache configuration, systemd services, database setup and a web installer. Multiple Qisutu instances can run independently on the same server, the announcement notes, so production and test environments can coexist without sharing databases, services or configuration.

Email with OAuth2, not just passwords

Email connectivity works three ways: standard IMAP and SMTP, Microsoft 365 via OAuth2 and XOAUTH2, and Google Workspace or Gmail via OAuth2 and XOAUTH2 — a useful option given how tightly both providers now restrict password-based mail access. Access tokens, refresh tokens, client secrets and mail credentials are stored encrypted, expired OAuth2 access tokens are refreshed automatically, and IMAP, SMTP and token activity is recorded in a communication log.

Add-ons without touching the core

Qisutu ships with its own module manager. Administrators install, update and remove add-ons as ordinary ZIP packages through the administration interface. Modules use a readable manifest and can contribute their own administration pages, configuration screens, REST routes, permissions, event handlers and user-interface extensions. A versioned internal module API lets add-ons declare which Qisutu API version and capabilities they require, an approach the developers say keeps customer-specific functionality separate from the core system.

Security features listed in the announcement include session-bound CSRF protection, separate bearer-token authentication for the REST API, secure and HttpOnly session cookies, encrypted storage of credentials and OAuth2 tokens, TOTP-based two-factor authentication with one-time recovery codes, and configurable mandatory 2FA for administrators, agents and customers. LDAP connections support LDAPS and StartTLS with certificate validation, and security headers guard against MIME sniffing and unwanted embedding. Notably, the QR code used to enrol 2FA is generated locally in the browser, so the TOTP secret is never handed to an external QR-code service.

Why it matters

Much of the service desk market is served by SaaS products, which is convenient but means ticket data, customer information and attachments live in someone else's cloud. For organisations with strict data-protection obligations, existing directory services or internal workflows they cannot reshape, a capable self-hosted alternative is the whole point — and that is precisely the gap Qisutu targets. The AGPL licence also means anyone offering the software as a hosted service must publish their modifications.

Two caveats are worth weighing. The claims come from the project's own announcement on dev.to rather than independent coverage or review, so real-world maturity at scale is unproven. And the Perl and CGI stack, while proven and straightforward to host on existing infrastructure, will read as dated to teams standardised on containers — a matter of taste, but one that affects hiring and long-term maintenance. For teams that simply want a service desk they fully control, version 1.0.3 nonetheless looks like a complete and security-conscious starting point.