Chalk is the open-source K-12 IT stack: device tracking, help desk, rostering, SSO, and Workspace sync in one binary. Self-host it free, or we host it.
docker compose up -d
docker compose logs chalk | grep "Admin password"Then open http://localhost:8080. One container, SQLite on a volume, no external services — background jobs run in-process, so there is no Redis and no worker to deploy.
Everything Chalk keeps lives in one directory (/var/lib/chalk): the database,
the master encryption key, the SAML keypair and chalk.toml. Back up that
directory and you have backed up the install — including the key every stored
credential is sealed with, without which the database cannot be read.
District IT runs on a pile of disconnected tools, and the data that ties them together — who your students are, what class they're in, what device they carry — lives in your SIS. Chalk pulls that roster once and reuses it everywhere: identity, provisioning, vendor data feeds, your asset inventory, and your ticket queue.
You own the data and the infrastructure. It's a single static binary with a SQLite database, licensed AGPL-3.0, with no per-student fees and no seat counting. Chalk works with PowerSchool, Infinite Campus, Skyward, and any SIS that supports OneRoster CSV or API exports.
Don't want to run it yourself? We offer a hosted Chalk — see usechalk.xyz/pricing. Self-hosting stays free forever.
Devices — a mixed-fleet inventory built on your roster
- Google Admin ChromeOS sync with students already attached, matched by roster email
- Microsoft Intune (Windows) and Jamf Pro (iPad) connectors, so the whole fleet lives in one inventory
- Write-back to Google: OU moves, disable/re-enable/deprovision, and pushing Chalk's assignment and asset tag into
annotatedUser/annotatedAssetId— every write goes through a diff preview an operator approves first - Circulation desk: check-out/check-in with due dates and agreement acknowledgement, a loaner pool, and family email notifications
- Repairs with costs, a fees/fines ledger (assessment and waive/settle records only — Chalk never touches payment cards), lost/stolen with police-report capture
- Barcode/QR: scan lookup, printable QR label sheets, and a scan-to-reconcile physical audit mode — all keyboard-wedge, no special hardware
- CSV import/export through the same diff preview, fleet reports, per-device history
The Intune, Jamf, and Entra connectors are new and validated against mocked APIs so far — field reports from real tenants are very welcome.
Helpdesk — a real ticket queue that emails people
- Technician queue with assignment, priority/category, tags, and saved views
- First-response and resolution SLAs, routing/auto-assignment rules, canned responses
- Staff portal with magic-link sign-in, inbound email, outbound reply/resolve notifications, CSAT
- Knowledge base (console and public portal), ticket analytics, device↔ticket links, read-only REST API
Identity & rostering
- SIS connectors: PowerSchool, Infinite Campus, Skyward — plus OneRoster CSV/API for everything else
- SAML 2.0 / OIDC identity provider with a launcher portal, QR badge and picture-password login for young students
- Clever- and ClassLink-shaped OAuth 2.0 compatibility endpoints, plus migration importers for both
- OneRoster 1.1 REST API with
filter,sort/orderBy, andfieldsquery parameters - Provisioning: Google Workspace users/OUs, Active Directory via LDAP, and Entra ID (Azure AD) via the Graph API
- Webhooks for real-time data-change events
Platform
- Admin console with per-person accounts (admin / technician / read-only) and honest audit attribution
- Session auth, CSRF protection, AES-256-GCM encryption at rest, audit logging
- One static binary, SQLite, in-process background jobs — no Redis, no worker fleet
- Operating System — Linux or macOS (Windows supported for development)
- SQLite — Version 3.35 or later
- Network Access — Connectivity to your SIS instance (PowerSchool, Infinite Campus, or Skyward)
Download the latest binary for your platform:
| Platform | Download |
|---|---|
| Linux (x86_64) | chalk-x86_64-unknown-linux-gnu |
| macOS (Apple Silicon) | chalk-aarch64-apple-darwin |
| macOS (Intel) | chalk-x86_64-apple-darwin |
| Windows (x86_64) | chalk-x86_64-pc-windows-msvc.exe |
Linux / macOS one-liner:
curl -fsSL https://github.com/usechalk/chalk/releases/latest/download/chalk-$(uname -m)-$(case "$(uname -s)" in Linux*) echo unknown-linux-gnu;; Darwin*) echo apple-darwin;; esac) -o chalk && chmod +x chalk && sudo mv chalk /usr/local/bin/After installing, run chalk update to stay current with future releases.
# Initialize
chalk init --data-dir /var/lib/chalk --provider powerschool
# Configure your SIS credentials in chalk.toml, then sync
chalk sync --config /var/lib/chalk/chalk.toml
# Start the admin console
chalk serve --config /var/lib/chalk/chalk.toml --port 8080See chalk.example.toml for a fully commented configuration template.
git clone https://github.com/usechalk/chalk.git
cd chalk
cargo build --release
# Binary at target/release/chalkRequires Rust stable and SQLite3. See CONTRIBUTING.md for development setup.
- Getting Started — Installation, initialization, and first sync
- Configuration — TOML configuration reference
- Architecture — System design and crate overview
- Identity Provider — SAML SSO, QR badges, and picture passwords
- Google Workspace Sync — User provisioning and OU management
- OneRoster API — REST API for OneRoster 1.1 data access
- Migration: Clever — Importing a Clever export bundle
- Migration: ClassLink — Importing a ClassLink export bundle
- Clever-Compatible SSO — Clever-shaped OAuth 2.0 compatibility endpoints
- ClassLink-Compatible SSO — ClassLink-shaped OAuth 2.0 compatibility endpoints
- Active Directory Sync — LDAP user provisioning and OU management
- SSO Partner Guide — Integrating apps via SAML 2.0 and OIDC
- SSO School Setup — Configuring SSO for your school
- Webhooks — Real-time event notifications for data changes
- Security — Authentication, encryption, and security hardening
- Deployment — Production deployment with reverse proxy and systemd
| Command | Description |
|---|---|
chalk init |
Initialize data directory and database |
chalk sync |
Run SIS data sync |
chalk serve |
Start admin console web server |
chalk status |
Show instance status |
chalk update |
Self-update to the latest release |
chalk update --check |
Check for updates without installing |
chalk import |
Import OneRoster CSV data |
chalk export |
Export data to OneRoster CSV |
chalk migrate |
Import a Clever or ClassLink export bundle |
chalk google-sync |
Run Google Workspace sync |
chalk ad-sync |
Sync roster data to Active Directory via LDAP |
chalk entra-sync |
Provision roster users into Entra ID (Azure AD) |
chalk devices |
ChromeOS device inventory: sync, change sets, push |
chalk mdm sync |
Pull the Intune / Jamf fleets into the inventory |
chalk jobs |
Inspect the background job queue, re-arm failures |
chalk console-users |
Manage per-person console accounts |
chalk passwords |
Generate default passwords for users |
chalk webhook |
Webhook operator subcommands |
See CONTRIBUTING.md.
Chalk is licensed under the GNU Affero General Public License v3.0.