Open-source service desk Qisutu reaches stable 1.0.2 with OAuth2 mail support

A new self-hosted service desk hits the front page

A new open-source ticketing and service desk called Qisutu reached Hacker News's front page on 26 August 2026. According to the project's GitHub documentation, Qisutu 1.0.2 is a stable release cleared for productive use, and the project is no longer in its development phase; interfaces and database structures now evolve through regular release maintenance.

A complete service desk in one package

Qisutu runs on Perl/CGI with MariaDB or MySQL as its database, Template Toolkit for rendering and a browser-based interface. The feature list reads like a compact ITSM suite: separate agent and customer portals, email processing, directory login, automation, a knowledge base, a CMDB, reporting and a REST API.

Version 1.0.2 ships with eleven fully translated interface languages: German, English, French, Italian, Brazilian Portuguese, European Portuguese, Spanish, Dutch, Polish, Czech and Turkish.

Deployment built around isolated instances

Installation follows a conventional root workflow: download a tarball, extract it under /opt, create a dedicated user and run install.sh. The script detects the operating system, installs the required packages and Perl modules, and configures an Apache integration, systemd services, a web path and a database configuration for each Qisutu instance.

Because every instance gets its own directory, services and database configuration, production and test systems can run in parallel on the same server. A six-step web installer then creates the database, its user, the table structure from schema.sql, seed data from insert.sql and the first administrator account; a randomly generated database password is written into the instance configuration.

Updates run through an integrated updater that identifies the instance, stops only its daemon and pauses mail retrieval while copying managed program files into the existing installation. Instance files, Apache and systemd configurations are left untouched, an optional database dump can be taken, and the schema plus accumulated data migrations are checked and applied as needed.

A deliberate add-on module architecture

Since version 0.0.78, Qisutu has included a module manager for ordinary ZIP files containing a readable qisutu-module. manifest. Administrators install, update and remove modules from the admin area, while the Qisutu daemon performs the actual file operations separately from the web process.

With 1.0.2, the core also exposes a versioned internal module API 1.0 covering reusable module services, core events delivered through the daemon, isolated REST routes with their own API permissions and controlled UI extension points. Existing modules without an API declaration remain compatible, and a module can declare the API version it requires, prompting a regular core update before installation rather than customised core variants. The core deliberately ships without bundled modules; add-ons are developed as standalone projects and published as ZIP files with fully readable source.

Revision-safe time tracking

Agents can optionally log working time in hours and minutes when creating tickets, writing articles or making changes, distinguishing billable from non-billable time and tagging entries with activity types maintained in the admin area. Bookings are immutable: they are never edited or deleted. A correction cancels the original entry with a mandatory reason and creates a linked replacement booking, and correction rights are assigned only to the admin group. Time data never appears in customer-facing areas.

Email with modern OAuth2 flows

Incoming mail accounts are managed in a single admin menu offering three connection types: standard IMAP with username and password, Microsoft 365 via OAuth2/XOAUTH2, and Google Workspace or Gmail via OAuth2/XOAUTH2. Microsoft and Google accounts are redirected to the provider after saving; the OAuth2 callback is verified with a short-lived, single-use state value, tokens are stored, and the account is activated only after a successful IMAP test. Expired access tokens refresh automatically via the refresh token.

Each instance's daemon polls configured mailboxes every five minutes, so no additional cron job is needed. Outgoing mail mirrors the same three account types, with Microsoft accounts using the Office SMTP.Send scope and Google accounts the Gmail SMTP scope over XOAUTH2.

Why it matters

Most teams default to SaaS helpdesks, but demand for self-hosted alternatives persists wherever data control, licensing costs or locked-down environments matter. Qisutu bundles the core of an IT service desk — tickets, knowledge base, CMDB, automation, REST API — into a single installable package, with a module API that invites extension without forking the core. The Perl/CGI stack is a rarity among new tooling, which may narrow the pool of contributors but also signals independence from mainstream web frameworks. At version 1.0.x the project is young, and teams evaluating it should weigh that maturity against the appeal of a full-featured service desk they can run entirely on their own hardware.