What SeqDesk doesn’t do (yet)

SeqDesk is opinionated and small on purpose. Several features that adjacent tools ship are deliberately absent, still on the roadmap, or only partly covered. This page is the honest list, so you can plan around it — and so you stop hunting for an admin toggle that does not exist.

Read this page before you commit to SeqDesk for a facility, not after. Most of the gaps below have a workaround, but a few of them (SSO in particular) are architectural decisions you need to be comfortable with.

If something here blocks you, open an issue at hzi-bifo/SeqDesk  — the issue tracker is what drives prioritisation.

Deployment posture

SeqDesk assumes a trusted network. It is designed for an institutional intranet or a VPN, not the open internet. There is no login rate limiting or account lockout, no per-user API tokens, no SSO, and the server binds to 0.0.0.0 unless you set SEQDESK_BIND_HOST. If the service must be reachable from outside, put it behind a reverse proxy that terminates TLS and enforces authentication of its own.

Authentication and access control

• No OAuth, SAML or OIDC. Authentication is the NextAuth credentials provider against the local User table: email plus a bcrypt-hashed password, with a JWT session. There is no Google, Microsoft, GitHub or institutional login. If your facility requires SSO, run SeqDesk behind an identity-aware proxy (Cloudflare Access, Pomerium, oauth2-proxy) and keep the credentials login for break-glass access.
• No per-user API tokens. All API access uses the same session cookie the UI uses. There is no personal-access-token screen and no long-lived bearer token for scripts. Automation typically logs in with curl and reuses the session cookie, or runs as a dedicated admin service account.
• Only two roles. RESEARCHER and FACILITY_ADMIN, stored as a plain string on User.role. There is no read-only auditor role, no per-study ACL, and no way to grant a researcher partial admin rights. The only softener is department sharing, which widens a researcher’s order list to their whole department — and it applies to sequencing orders only, never to studies.
• No self-service password reset. There is no “forgot password” link and no password-reset email, because there is no reliable outbound mail (see below). Recovery is operator-driven: run seqdesk reset-password <email> against the install directory, or update the hash directly in the database.

Notifications

• No self-hosted SMTP. SeqDesk does not run or configure a mail server, and there is no SMTP host/port setting. What exists instead is an optional, admin-gated hosted email relay: enable the Email Notifications module, configure a relay token, and a small set of transactional messages is sent through the SeqDesk relay. Coverage is five events only — sequencing order submitted, order status changed, samples marked sent, ticket created, ticket reply. The module is off by default, and with it off no outbound mail is sent at all.
• In-app notifications are separate and always on. The notification bell is driven by InAppNotification rows and fires for order creation, order updates, pipeline status changes, and application updates. It does not need the relay. For researcher-to-facility conversation, the in-app Support & Messages ticket system is the intended channel.
• No outbound webhooks. There is no “POST to a URL when X happens” mechanism. External systems must poll the relevant API endpoint or read the database. SeqDesk does expose one inbound webhook — the Nextflow weblog endpoint pipelines call to report progress — but that is internal plumbing, not a general event fan-out.

Search and bulk operations

• No global search. Each list page (orders, samples, studies, runs) has its own filters and sorting, but there is no cross-entity search box. A researcher hunting for “the order that contained sample S42” filters the orders list rather than typing into a search field.
• Sample import is Excel, not CSV. The sample table offers Excel Template (download a workbook shaped to your configured per-sample fields) and Upload Excel (.xlsx / .xls only). There is no CSV upload and no clipboard/TSV paste path.
• Bulk sample edits are limited by order status. Both the wizard and the standalone sample table can import hundreds of rows at once, but only while the order is DRAFT. After submission the samples API answers Cannot modify samples after order submission, and only facility-only per-sample fields remain editable, and only for admins. There is no supported way to bulk-add samples to a submitted order.

Data export

• Individual files download fine: reads, assemblies, QC reports and pipeline artifacts, through the in-app browser and /api/files/download.
• There is no “export this study as one archive” button. No zip of a study, no bundled metadata export, no bulk download of an order’s deliverables. For an offline copy, take a database snapshot alongside your storage backup, or script the downloads against the API.

Demo mode is a sandbox, not a mirror

Demo mode disables anything that touches real infrastructure. In a demo session the API returns 403 for file downloads and previews, the assemblies list, pipeline creation and launch, output resolution, run deletion, marking a run as final, and publishing a sequencing delivery. This is deliberate and is not configurable per instance. Everything metadata-shaped — form configuration, MIxS validation, study workflows, browsing orders — behaves exactly like the real application.

Things that look configurable but are not

• The module set is compiled in. Admins toggle the nine shipped modules on and off, but adding a tenth requires code. Sequencing Technology cannot be turned off at all. The closest extension point that does not need a fork is Adding Pipelines.
• Branding is mostly seeded, not editable. SiteSettings carries primaryColor, secondaryColor, logoUrl, faviconUrl and helpText, but there is no admin form for them; they are seeded with defaults. Facility identity comes from site.name and site.contactEmail in settings.json.
• The telemetry payload is fixed. You can disable telemetry entirely or point it at a different endpoint, but there is no per-field opt-out. See Operational Telemetry.
• The demo workspace TTL is baked into the build. Six hours, refreshed on activity. Changing it means rebuilding.

Unfinished surfaces

• Cross-order run pooling — a single physical sequencing run spanning samples from several sequencing orders — is not built. SequencingRun hangs off exactly one order.
• There is no top-level “Sequencing Runs” management page. Runs are reached through the order that owns them.
• The Workbench surface is experimental. The codebase contains a second application surface (SEQDESK_APP_SURFACE=workbench) with its own workspaces, datasets and import jobs. The installer does not expose it, and this documentation does not cover it. Treat it as unsupported.

What to do instead