What HiFi Print is
HiFi Print is a self-hosted print management platform for IT teams in healthcare, education, and professional services. It replaces GPO printer deployment and Windows print servers with a central server that pushes drivers, creates printer queues directly on endpoints, and keeps them reconciled.
The server ships as a Linux appliance (OVA) — an Ubuntu Server 24.04 VM running the application and PostgreSQL under Docker Compose, configured by a console wizard on first boot. Windows endpoints run a lightweight agent that connects over mutually-authenticated TLS. There is no cloud service, no telemetry, and no runtime dependency on our infrastructure; air-gapped deployments are supported, including signed offline updates.
Architecture
One appliance, N agents, no cloud. Drivers live on the endpoint and print jobs go direct to the printer.
┌─────────────────────────────────────┐
│ Admin Browser │
│ Single-page admin console │
└────────────┬────────────────────────┘
│ HTTPS
┌────────────▼────────────────────────┐
│ HiFi Print Appliance (OVA) │
│ Ubuntu 24.04 · Docker Compose │
│ FastAPI · PostgreSQL 16 │
│ Internal CA · mTLS · LDAP │
└────────────┬────────────────────────┘
│ WSS (mTLS)
┌────────┴────────┐
▼ ▼
┌────────┐ ┌────────┐
│ Agent │ │ Agent │ ... N endpoints
│Win 10/11│ │Win 10/11│
└────────┘ └────────┘Appliance
Ubuntu Server 24.04 VM running the FastAPI application and PostgreSQL 16 under Docker Compose. Serves the admin console and the agent WebSocket endpoint.
Agent
Lightweight service installed on each managed Windows endpoint. Connects over mutually-authenticated TLS, installs drivers, creates printer queues, and reports status.
Tray icon
Optional system tray process showing connection status, installed printers, and active install tasks for the local user.
Environment requirements
- Server: a hypervisor that can import an OVA — VMware, Hyper-V, Proxmox, or VirtualBox.
- Agent: Windows 10 or Windows 11. Works on workgroup and domain machines.
- Network: outbound WSS from agent to appliance. No inbound ports required on endpoints.
- Directory: optional Active Directory / LDAP for sign-in and group-to-role mapping.
- Internet: not required. Air-gapped deployments are supported with signed offline updates.
Security model
- Agent private keys never leave the endpoint — only the CSR is sent to the appliance at enrollment.
- The internal CA issues a certificate to each agent, and certificates can be revoked from the console.
- Two-factor authentication (TOTP, RFC 6238) for console accounts.
- AD / LDAP sign-in with group-to-role mapping, plus an optional lockdown mode that denies unmapped directory users.
- Custom TLS certificate upload for the console, with automatic agent trust-bundle refresh. Agent mTLS stays on the internal CA.
- Role-based access control, built-in admin protection, and audit logging of admin actions.
- Signed offline updates (RSA-4096) with automatic rollback, and nightly backups of the database and data volume.
Document library
Deployment guides, architecture notes, and release notes are published here. Markdown documents can be read in the browser; everything is free to download.