Setup & installation

Install

Presto ships as an Ubuntu .deb (with a hardened systemd unit) and a Windows MSI (with a native Windows Service). The binary is prestod, the service name is prestod, and it auto-starts on install. It prints nothing until you allow an origin, so auto-start is safe.

	Linux	Windows
Config	/etc/presto/presto.toml	C:\ProgramData\Presto\presto.toml
Data dir	/var/lib/presto	C:\ProgramData\Presto
Logs	/var/log/presto/	(set file in config)
Runs as	presto user (groups presto, lp)	Windows Service

caution

On Windows the service discards stderr — set a log file in the config so you have a durable log.

Ports

Port	Purpose
31075	Admin UI + WebSocket API + REST (loopback).
9101	Prometheus metrics — only when metrics_listen is set.

Port 9100 is the printer's JetDirect port (a TCP transport target), not a Presto listener.

TLS & the local CA

By default (tls = "auto") Presto generates a per-machine Presto Root CA and trusts it into the OS certificate stores at install, then serves an auto-rotating leaf for localhost / 127.0.0.1. That's what lets wss://127.0.0.1:31075 connect without a browser warning.

• If the CA isn't trusted, the client falls back to ws://127.0.0.1 — loopback is treated as a secure context by Chrome, Edge, and Firefox.
• tls = "manual" uses your own tls_cert / tls_key; tls = "off" disables TLS.

note

Chrome 142+ may prompt for Local Network Access. For a fleet, pre-grant it with the LocalNetworkAccessAllowedForUrls browser policy.

First run

Open https://127.0.0.1:31075 and complete the wizard:

1. Set the admin password (hashed with argon2id; seed it via PRESTO_ADMIN_PASSWORD for silent installs). An admin bearer token is generated and stored 0600 on first run.
2. Add your web origins — deny-by-default; nothing prints until an origin is listed.
3. Register your first printer and test print.

Origins & pairing

Web apps are gated by an origin allow-list (glob patterns like https://*.intrasys.com.sg); a request from any other origin is rejected. Beyond that, an origin is paired:

• approve (attended) — an admin approves a pending origin, and the client stores a per-origin bearer token.
• pre-shared — provision tokens ahead of time for unattended fleets.
• open — development only.

Configuration file

The config is TOML (config/presto.example.toml is the reference). Main sections: [server] (listen, TLS), [security] (origins, pairing), [[printer]] (declarative printer definitions), and [rfid] (auto-reprint and calibration behavior).