GOTRS 0.6.4 published the design document for the GoatKit Plugin Platform, planned for version 0.7.0 in May.

The Problem

Every organisation wants different features. Statistics dashboards. FAQ systems. Calendar integrations. Process management workflows. Building everything into core makes the application bloated and hard to maintain.

But plugins bring security concerns. Running third-party code in your ticketing system is risky. Performance matters too - a slow plugin shouldn’t degrade the whole application.

We needed extensibility without compromising security or performance.

Our Solution

Dual runtime support lets developers choose the right trade-off:

WASM Plugins using wazero provide portable, sandboxed extensions. Write once, run anywhere with strong isolation guarantees. The plugin can’t access the filesystem, network, or memory outside its sandbox. Perfect for community plugins where you can’t fully trust the code.

gRPC Plugins using HashiCorp’s go-plugin enable native Go integrations. Process isolation provides safety. Full Go capabilities provide power. Ideal for performance-critical extensions from trusted sources.

Statistics & Reporting will ship in the near future as the first WASM plugin, demonstrating the platform. FAQ, Calendar, and Process Management follow.

The Benefits

Third-party developers can extend GOTRS without touching core code. The plugin API provides stable interfaces while core evolves.

Security is built in. WASM sandboxing means community plugins run safely. gRPC process isolation means even native plugins can’t crash the host.

Performance scales. Lightweight features use WASM. Heavy processing uses gRPC. Developers choose based on their needs.

This release also restructured documentation into clear sections: architecture, deployment, development, and known issues. The AGENT_GUIDE expanded significantly for contributors.

Building a plugin system is a significant undertaking. Getting the architecture right early prevents painful migrations later.