TrainingOps · self-hosted · Innotel Labs
OnTrak is one repository for the IT support operation: a browser-based training platform that grades work against deliberately broken machines, a service desk that runs the real tickets and carries an insurer-grade evidence trail through incident response — and, after both, the identity and intrusion protection they share. Every part is self-hosted, every privileged act is audited, and the record that survives is one an auditor can verify.
# OnTrak Tix — the service desk
git clone https://github.com/innotelinc/OnTrak.git && cd OnTrak/ontrak-tix
npm install && npm run setup && npm run dev # http://localhost:3000
# OnTrak IT Support Training
npm install && npm run docker:db && npm run setup && npm run dev
The answers that decide whether the platform is usable on a real desk.
| Problem | OnTrak answer |
|---|---|
| Practice ranges are built for a demo, not for a class — and every rebuild is another day of work. | Simulations are authored once as versioned templates with checkable objectives; a student gets a fresh clone per attempt and the same grader every time. |
| "Did they fix it?" graded by hand does not scale, and two instructors grade differently. | Objectives are evaluated against live system state on the server. Any correct fix passes — including the ones the author did not think of — and the score is recomputed server-side, never trusted from the browser. |
| A single-desk helpdesk breaks the moment it serves a second client: work runs together and SLAs stop meaning anything. | Clients, contacts, per-client SLAs and per-client rate cards, with a scope that shows an agent only the clients they are assigned to — and work that names no client stays visible to the whole desk. |
| An incident that becomes a claim, an audit or a lawsuit needs a record that was not assembled after the fact. | Incident evidence is written under object lock, notification wording is recorded as it was actually sent, and the assurance packet is signed — so the story cannot be edited later, by anyone. |
| Billing rebuilt from a timesheet is a dispute waiting to happen. | Hours are priced by a snapshot stored on the entry itself, invoices are stamped once and cannot be issued twice, and a credit note is the only path back. |
| Training, ticketing and security tooling each invent their own identity and evidence layer. | One identity layer, one evidence format, one audit chain: the training record and the incident packet an insurer reads are built from the same signed, tamper-evident shape. |
Products added one at a time. Each stands alone, each has its own landing page, and together they close the loop.
A browser-based, automatically-graded training platform for IT support: Linux, Windows and Office simulations that read live system state, plus the course, attempt and certificate machinery around them.
An MSP-grade service desk: tickets, SLAs, queues, canned responses, time and billing, incident response with objection-locked evidence, playbooks, war-room comms and a signed assurance packet.
The identity provider and intrusion prevention platform for the family: OIDC/SAML and SCIM for the products, plus detection and containment with an approval gate on anything that acts.
The browser console for a coding agent: the tool calls stream in as they are decided, the file being written renders live beside a diff of what is changing, and a command or a large overwrite waits for a click.
../ escapes are refusedexport turns a workspace into a build request the factory manufacturesThe hands-on half of the same training: the scenarios above, run on real machines rather than in a browser. A session is a Linux container or a Windows guest stood up on demand, graded from its live state, and torn down when the work is handed in.
lab.ontrak.innotel.us, in front of its own gatewayThe centralized front door: one sign-in, then the products a role belongs in. Routes by role and authorizes nothing — every product re-checks the caller itself.
Network package and container update monitoring with approval workflows. Also owns the family's local account table for LAN deployments.
Every Innotel Labs product — one job per platform, platform services consumed by business functions.
Single identity source for the entire Innotel Platform Stack — OIDC/OAuth2/SAML/SSO, MFA, SCIM provisioning, RBAC, and organizations. Every platform trusts the same identity.
Landing pageHashiCorp Vault KV v2 — the canonical secrets store. All secrets carry vault:// references, never committed to repos. Secret rotation and auditing included.
Certificate lifecycle, ACME automation, PKI, and DNS with one wildcard cert per platform zone. All public hosts front the same Cerulean instance.
Landing pageObject storage, backups, snapshots, and object-lock (WORM) retention with legal hold. Per-tenant scoping via Vault paths.
Landing pageBilling, subscriptions, and entitlements. Checkout → webhook → Authentik paid_users group → access granted. Credit notes the only remedy.
Public HTTP/S routing, TLS termination at the edge, and proxy host provisioning. Wildcard certs from Cerulean, CNAMEs from shared BIND.
Landing pageStreaming, media libraries, user profiles, and watch history. Free media auto-fetched; licensed media stays with the operator.
Landing pageVoIP, SIP, SMS, PBX, and PWA mobile client. SIP PBX with trunking, SMS gateway, and call routing with IVR.
Landing pageIMAP/SMTP mail server, CalDAV calendars, CardDAV contacts, and mail security with spam filtering and DMARC/DKIM/SPF.
Landing pageDocument signing, agreements, templates, audit trails, and legal holds. Sole signer of course certificates for the ecosystem.
Landing pageVoice AI agents, call screening, AI receptionists, speech processing, and telephony automation. Built on Zeus SIP foundation.
Landing pageLeaderboards, reputation scoring, achievements, and cross-product ranking tables. Reputation can gate feature access across platforms.
Landing pageEphemeral P2P transfer via WebRTC data channels — room codes, QR pairing, Zings (text snippets), relay fallback. Condition-keyed tracking (not alert-id keyed).
Landing pageCourse catalog, enrollment, assessments, AI interactive classrooms, and completion records. Emits evidence forwarded to Signara for signed certificates.
Landing pageGitea repository hosting, CI/CD pipelines, issue/boards, package registry, and AI app builder via OmniRoute gateway.
Landing pageMulti-tenant builder tenancy with per-user OmniRoute gateway keys, quota/usage enforcement, and spend tracking via Magnate integration.
Landing pageIssue-to-PR automation with five factory workflows (prime, implement, validate, regress, triage), validation and safety, and operational visibility.
Landing pageVideo ingestion, transcoding, catalog, and streaming delivery (HLS/DASH). Live streaming and AI video analysis.
Landing pageThe desk is the part most teams feel first, and the part with the most to get wrong.
Inbox, saved views and SLA flags are all computed after the client scope is applied, so an agent cannot be shown a figure that includes a client they cannot open. Acting as a client is a permission, a reason on the record and one expiring window.
An SLA policy belongs to a client, a queue or the desk, and one resolver answers most-specific-first — reporting which rung won. Writing a promise is validated before it is in force and refused while tickets are still measured against it.
Artifacts land under object lock, retention has a clock the desk cannot wind back early, notification wording is kept as sent, and the packet is signed. A scheduled sweep purges what the window has closed and records what it purged.
Time is logged where the work is, priced by the client's rate card or the desk default with the rate snapshotted onto the entry, and exported as invoice-ready lines. Issuing an invoice freezes the entries it covers; a credit note is the remedy.
The desk-wide report and every client's scorecard come from one function, with a row for work that names no client — so the parts add up to the whole, and the first row is the one somebody can act on.
Sign-in, role changes, exports, purges, invoices, surveys and act-as windows are append-only, hash-chained audit events. If it mattered, it is in the record — and the record can be verified.
Practice that is graded by the machine, not by a mark scheme.
Linux shell, Windows desktop and Office applications each implement the same driver contract, so a scenario author writes objectives once and the grader runs them the same way everywhere.
A solve is a change on the simulated machine — a service started, a permission fixed, a file recovered — and the score is recomputed on the server from that state, whatever the browser claims.
Passing an attempt issues a completion record with a printed certificate and a verifiable export packet, so the training outlives the session that produced it.
The one surface in the family that shows an agent's work rather than its output.
Every tool call is on screen as it is decided, and the file being written is rendered character by character next to a live diff against the on-disk baseline — so the review happens while the change is still being made.
Commands and writes over a line threshold stop and wait for a click. Denying ends the turn cleanly rather than leaving it stalled, and the workspace it cannot leave is one directory.
export assembles a build request from the workspace — file index, stack, entry point, the test command that actually exists — with no second model call, so a session that produced something worth shipping becomes factory input.
OnTrak Genie has its own landing page at ontrak-genie, and its role in the stack is written down in docs/stack.md.
OnTrak is a business platform in the Innotel Platform Stack — it consumes the shared services.
Sign-in is Authentik through Cerulean, with a local credential fallback so each app still deploys on its own. Roles and permissions are re-checked on the server for every privileged action.
Runtime secrets resolve from Cerulean Vault. Public hosts and the wildcard certificate come from Cerulean; nothing in the repo holds a key, a certificate or a real address.
Attachment and evidence bytes sit behind a storage port — local disk for a single node, an object-locked bucket for a desk that has to prove a record was never edited.
Boundaries — what OnTrak owns, consumes and deliberately does not own — are written down in docs/stack.md.
Current layout across the 7 OnTrak family products and milestone trajectory.
In-browser Linux, Windows 11, and Office simulators, WCAG AA accessibility sweep, instructor analytics, and real container/VM execution through ontrak-lab/.
Multi-client MSP desk, SLA resolution hierarchy, rate-card snapshotted billing, object-locked incident evidence, and signed assurance packets.
Unified capability health probes across Portal, Sync, Genie, and Lab; Sentinel S4 active containment with safe-list & blast-radius enforcement.