Offline and Air Gapped Installs - edmozley/freeitsm GitHub Wiki
Offline and Air-Gapped Installs
As of 2.2.0, FreeITSM loads no JavaScript or CSS from the internet. Every third-party library it uses ships inside the application, so a server with no outbound access renders and behaves exactly like one that is connected.
This matters if you run FreeITSM on an isolated network, behind a proxy that blocks public CDNs, or simply do not want your users' browsers making requests to somebody else's server on every page load.
What changed
Several features used to pull their libraries from a public CDN at page load. On a connected server you would never notice; on an isolated one the feature quietly did nothing.
The symptom that found it: Save to PDF on Morning Checks worked only when the server had internet access. The button was there, the click did nothing, and nothing in the interface said why.
Everything is now served from assets/js/vendor/ and assets/css/vendor/:
| Library | Used by |
|---|---|
| jsPDF (+ AutoTable) | PDF export — Morning Checks, Knowledge, form submissions, asset labels |
| html2pdf, html2canvas | page-to-PDF export |
| Chart.js | dashboards and trend charts |
| jsQR | scanning asset QR labels with a camera |
| Prism (+ 9 language components, 2 stylesheets) | syntax highlighting in the System Wiki |
TinyMCE, the rich-text editor, was already local.
Checking it yourself
The honest test is not reading the page source — it is blocking the CDN and seeing whether anything breaks. In Chrome:
chrome --host-resolver-rules="MAP cdnjs.cloudflare.com 0.0.0.0, MAP cdn.jsdelivr.net 0.0.0.0"
Then exercise the features in the table above. A page that has quietly fallen back to a CDN will show failed requests in the console; one that has not will behave normally.
Grepping for one library's name is not sufficient, and this is worth saying because it is how the original sweep missed things: searching for jspdf could never have found html2pdf, which is a different PDF library on the same page. Search for the CDN hostnames, not for the library you happen to be thinking of.
One known exception, which does not affect you
The bundled TinyMCE includes an emoticons plugin whose default configuration fetches emoji images from a CDN. FreeITSM never enables that plugin — the editor is configured with advlist, autolink, lists, link, table, wordcount, fullscreen — so the code is present but never runs. It is noted here so that a security scan flagging the string in plugins/emoticons/plugin.min.js has an answer.
Licensing
Redistributing these libraries is permitted, but only if each one's copyright and permission notice travels with the code. Where a library's notice is not already inside its minified file, it ships beside it as a .LICENSE file in the same folder — jsQR.LICENSE, prism.LICENSE, html2pdf.LICENSE, jspdf.plugin.autotable.LICENSE.
Most are MIT; jsQR is Apache 2.0. FreeITSM itself is MIT.
Still needs network access
Being offline-capable in the browser does not make the whole product self-contained. These reach outward by design, and simply stay unused if you do not configure them:
- Outbound email (SMTP) and inbound mail collection (IMAP / Microsoft Graph / Gmail)
- AI providers — Anthropic, OpenAI, Azure OpenAI
- Calendar and contact sync — Microsoft Graph, CalDAV, CardDAV
- Single sign-on — OIDC / SAML providers
- Apache Tika, if you want the text inside PDFs and Office documents to be searchable (this can be run on your own network)
- Update checks against GitHub