Installing icom Router Management with Docker

Preface

This guide covers the installation of the iRM in Version 2026.05.0 running in docker. The guide is split into two parts; The basic setup of the application and securing the application with TLS or mTLS.

System Requirements

Application Server

Optional: Dedicated Database Server for Larger Environments

Prerequisites before Installation

Getting up and running

sudo mkdir /opt/insys-irm
sudo tar -xzf insys-irm-2026_05_0.tar.gz -C /opt/insys-irm
sudo chown -R <USER>:<GROUP> /opt/insys-irm

Configuring the icom Router Management

To configure your application login into icom Router Management using the default accounts credentials.

Username: default
Password: secret

Please note!

Please change the password of the default account by navigating to Administration ⇒ My User Profile. Default credentials in production environments pose a security risk.

With these settings, the icom Router Management is in a basic functional state. Systems running in a controlled environment with no external network communication may be operated this way. If your application server does have an external network connection and is reachable from outside, please continue with the next chapter.

Securing the application

In order to harden the application, a few configurations should be done. The application offers the possibility to change the login flow to one using OIDC and implementing the Oauth2 Protocol, as well as being reachable via TLS and using mTLS for the device connections.

Here is an overview over the different network modes and their usage:

Please note!

When switching to https-mtls later, every device already connected previously, has to be added again or fitted with valid certificates!

TLS

Domains

Systems that can be accessed through a domain (e.g. irm.mycompany.com) need an additional domain, that leads to the same IP address. The following setup is needed:

• Domain 1 (Your servers domain name): irm.mycompany.com

• Domain 2 (Additional domain for authentication): auth.irm.mycompany.com

Both domains route to the same place, which is your application server. The reverse proxy (traefik) will internally route the requests to their respective place.

Certificates

Depending on which network mode you want iRM to operate in, different certificates and their keys are required. For https, both domains of your application server need to be present in the server certificate in the SAN field. Please contact the instance providing your certificates, or refer to the documentation of the used product.

Server certificate extensions example:

X509v3 Basic Constraints critical:

CA:FALSE

X509v3 Subject Key Identifier:

...

X509v3 Authority Key Identifier:

...

X509v3 Key Usage:

Digital Signature, Non Repudiation, Key Encipherment, Key Agreement

X509v3 Extended Key Usage:

TLS Web Server Authentication

X509v3 Subject Alternative Name:

URI:irm.mycompany.com, URI:auth.irm.mycompany.com

For added mTLS, a certificate authority with certificate signing capabilities and the respective key are needed.

Certificate authority extensions example:

X509v3 Basic Constraints critical:

CA:TRUE, pathlen:1

X509v3 Key Usage critical:

Digital Signature, Key Encipherment, Certificate Sign, CRL Sign

Installing the certificates

Stop the application before making changes to it:

./stop.sh

To supply the certificates to the application, the certificates need to be present in the certs folder with a specific name.
For https the following certs are required:

You should now have some or all of the certificates mentioned above in the certs folder.

Setting the network mode

Now that the certificates have been placed in the correct directory, we can tell the application in which network mode we want it to run. To do that, edit the .env file and set the network mode to one of the three possible values mentioned above:

sudo vim .env

Starting the application

To start the application execute ./start.sh again and follow the instructions. Check the traefik logs for error messages regarding certificates. To do that, either stay in attached mode and scroll through the logs, or execute the command docker logs irm-traefik. Should there be no errors, the certificates were accepted by the reverse proxy and should be used.

Configuring TLS

HTTPS

Navigate to Certificate Management ⇒ Certificates, upload your server certificate, select it and use it as server certificate via the Action button.

HTTPS with added mTLS

Navigate to the Administration => System settings page to adapt the following values:

This value tells the frontend to rely on OIDC and talk to the running OIDC server for authentication and authorization. After changing this value you will be logged out. The application may show unexpected behaviour in the login because of the login flow switch. In that case clear the browser cache and start a new browser session.