1. PostgreSQL
The database is the source of truth. It runs locally, on a dedicated server or with a managed provider. One schema per tenant.
Installation and commissioning.
ewws runs on your own infrastructure, without a forced cloud. This guide leads in three steps from the database via the server to the native clients and names the concrete commands.
How ewws is structured
Three components, one clear order.
ewws consists of a PostgreSQL database, the ewws server and the native clients. The installation order is binding: first the database, then the server, then the clients. All three can sit on a single device or on separate systems.
2. ewws server
The server connects to PostgreSQL and provides the programming interface through which all clients sign in. It runs as a system service and comes with a web interface for setup and operation.
3. Clients (macOS, Windows, iPhone)
The native apps connect to the server via its address. They need no database drivers and no runtime of their own.
Step 1
Provide PostgreSQL.
ewws requires PostgreSQL 16 or newer. The database is to be secured internally and backed up with a proven restore drill before the productive start.
Three operating modes
Locally on the same device, on a dedicated server in the internal network, or with a managed provider with TLS (sslmode=require). Pure test or free offerings without an operating commitment are not production-ready.
A tenant corresponds to a schema
Every tenant is its own PostgreSQL schema in the same ewws database. A single company uses public, a fiduciary office uses its own schema per customer (for example kunde_mueller). The tenant code at login is exactly this schema name.
Create the database and role
As the PostgreSQL superuser, create a database ewws and a login role ewws_app. For fiduciary or multi-tenant operation, additionally create an ewws_admin role for migrations and new schemas.
CREATE ROLE ewws_app LOGIN PASSWORD '<starkes-passwort>'; CREATE DATABASE ewws OWNER ewws_app ENCODING 'UTF8' TEMPLATE template0;
Secure access
In pg_hba.conf, only allow the concrete internal networks with scram-sha-256, never globally. Strong and separate passwords per role. A daily backup and a tested restore are mandatory before the productive start.
host ewws ewws_app 10.20.30.0/24 scram-sha-256
Step 2
Install the ewws server.
The server is installed as a native system service and connects to the database. It brings its own runtime, a separate Java installation is not necessary.
An installer per operating system
macOS: a signed package (.pkg) that sets up a system service and its own service account. Linux: a .deb with a systemd service. Windows: an .msi service. The server listens on port 8080.
sudo installer -pkg ewws-server-<version>.pkg -target /
Set up in the browser, no hand editing
On first start, the server opens a guided setup page in the browser (/setup). Database connection, the first tenant and administrator are entered, checked and saved, entirely without configuration files by hand. For automated rollouts, the same values can be set in advance as environment variables (EWWS_DB_URL, EWWS_DB_USER, EWWS_DB_PASSWORD; for managed databases sslmode=require in the URL).
EWWS_DB_URL=jdbc:postgresql://db-01.internal:5432/ewws EWWS_DB_USER=ewws_app EWWS_DB_PASSWORD=<secret> EWWS_DB_SCHEMA=public
Start and migration
After setup in the browser, the server creates the database schema automatically and is ready to operate immediately. After that it runs as a service and starts again by itself after a restart.
Health check
A call to the health endpoint confirms that the server and database work together. If it responds with status 200, the server is ready for the clients.
curl -sSf http://localhost:8080/api/v1/health
Step 3
Install the clients.
The native app is installed on every workstation and connected on first start with the server address, tenant and credentials. The server address is only shown when needed; normally it is prefilled.
macOS
A notarized app for macOS. Open from the download, place it in the Applications folder, start it. Available and in productive use.
iOS (iPhone, iPad)
A native app for iPhone and iPad. It connects to the server via HTTPS, for access on the go usually via the HTTPS edge. Available on request.
Windows
A native Windows app, delivered as an MSIX package. Available on request.
And Linux?
Linux is a server platform, not a desktop client: the ewws server runs natively on Linux (.deb/Docker), the workstations use the Mac, Windows or iOS app.
First sign-in
Commissioning and first login.
Once PostgreSQL, server and client are in place, you sign in with the admin user and set up tenant, users and roles.
Server address
In the login, enter the address of the server, for local operation for example http://localhost:8080/api/v1. The connection test confirms reachability.
Tenant and sign-in
Enter the tenant code (the PostgreSQL schema), the admin user and the password. The first password is set on first login.
Users, roles, MFA
In the product, create users and roles, activate MFA and recovery codes. Only then release productive operation.
Operation
Operate the server yourself, like the big players.
ewws comes with a complete operations console, reachable in the browser at /admin. You keep the server under control, without special knowledge, and your data stays with you.
Operations console
The server state at a glance: status, runtime, memory, tenants, server administrators, license, installed versions and logs. Restart at the push of a button. Sign-in is with an administrator account, secured like the programming interface.
open http://localhost:8080/admin
Recovery
If the database is stuck, the recovery tier stays reachable at /recovery, database-independent via a host token. Correct the connection and restart, without a command line.
open http://localhost:8080/recovery
When something is stuck
Help and next steps.
For installation questions, the FAQ helps, or you write directly to support. Server not reachable is usually a network, service or certificate topic, rarely a defect.
Frequently asked questions
Thirty of the most common questions on editions, Mac, iOS, migration, fiduciary, data sovereignty and cloud are answered there.
Two binding ways, no hotline maze.
We prefer written channels because they stay traceable and create a clean audit trail. For emergencies within business hours, the e-mail inbox is enough.