Licensing

Vision runs only under a Cesbo license. A fresh install is locked until an administrator activates it. The license is not bound to an IP address, hostname, machine ID, or hardware: one serial covers one activated device.

How to get a license

Vision needs two things from Cesbo: a license and a Cesbo Alta server to manage. Licenses are managed in your Cesbo profile at app.cesbo.com by members of the company that owns the license. To use one, open Settings → License → Activate in Vision and choose it on the Cesbo page (see Activation).

What one license covers

One serial covers one activated device: one Vision host. It is not bound to an IP address, hostname, machine ID, or hardware.
Members of the company that owns the license activate, replace, and remove devices in the Cesbo profile.
Moving Vision to new hardware means activating the new host and replacing the old device on the Cesbo page. See Removing or replacing a device.
Do not copy one license.txt to a second host: both would hold the same device slot.

What “locked” means

While the license does not allow it:

every API call answers 403 LICENSE_REQUIRED, except sign-in and the license endpoints;
users who may read settings are sent to Settings → License; everyone else sees a License required page;
the web UI, /healthz, /readyz, and /metrics stay up, and background workers keep running;
open video sessions run out their tokens.

Vision unlocks by itself after the next successful check.

The 30-minute grace after a start (see Offline operation) covers an unreachable license server only — not a missing license.

Activation

Only a user who may change settings can activate.

Open Settings → License and click Activate.
Open the link and sign in to your Cesbo profile as a member of the company that owns the license.
Check that the hostname on the page is this device’s, then choose the license. If the license has no free slot, pick the device to replace. It is removed only when this device receives the license, and stops at its next check after that.
Vision receives the license on its own, writes license.txt, and checks it at once.

The link expires after 10 minutes. A failed or expired activation can be started again with Start again or removed with Dismiss; Cancel drops a pending one. A cancelled, failed, or expired activation removes no device, even if a device to replace was already picked on the Cesbo page.

Manual path: put `license.txt` in place

When activation cannot reach app.cesbo.com, or support sends you the file, download license.txt for the device from your Cesbo profile and write it into the existing file, keeping its owner and mode (vision:vision, 0600):

sudo tee /etc/vision/license.txt < license.txt >/dev/null
sudo ls -l /etc/vision/license.txt     # -rw------- vision vision

Then click Settings → License → Re-check now.

tee keeps the file the service may write. Do not replace it with mv or cp as root — a root-owned file blocks the next activation (vision doctor names the fix: sudo chown vision:vision /etc/vision/license.txt).

Removing or replacing a device

Any member of the owning company can:

remove a device: in the Cesbo profile, open the license and use Manage device;
replace a device: activate the new host from its Settings → License and pick the old device on the Cesbo page. The old device is removed when the new one receives the license.

A removed device shows License not found or revoked after its next check and locks. Vision has no remove button of its own. Activating a host that already has a license replaces its local serial; the previous activation stays live in your Cesbo profile until you remove it there.

The license file

The serial is stored in /etc/vision/license.txt, next to config.yaml, owner vision, mode 0600. vision install creates it empty ({}) and never overwrites it; the service unit lets the service write that one file while the rest of /etc/vision stays read-only. Activation rewrites l and keeps every other key:

{
  "l": "<serial>",
  "s": "https://ls.example/"
}

l is the serial, 40 lowercase hex characters. It is a secret: Vision shows and logs only its first 14 characters, the public ID.
s is optional: a single license server that replaces the Cesbo ones (test stands, support cases). An s that is empty or not a string is ignored.

vision backup carries the file with the secrets.

Checks

Each check asks the license servers (ls1–ls3.cesbo.com) in random order until one grants the license. A refusal, or an answer that fails verification, counts only when no server grants it.

After a grant, Vision checks again in 24 hours, or at the license’s expiry date if that is sooner, so a renewal is picked up at once.
After a refusal (expired, removed, or replaced) or an answer that fails verification, it checks every hour.
Re-check now checks at once (at most once every 10 seconds).

The license servers refuse a request whose time differs from theirs by more than 5 minutes. The License page then shows code 40003. Enable NTP on the host (timedatectl set-ntp true), then click Re-check now.

Code	Meaning
`40000`	License not found, revoked, or this device was removed or replaced — activate again
`40002`	License expired — renew it in your Cesbo profile
`40003`	Host clock off by more than 5 minutes — enable NTP
`40004`	The license server could not read the request — retried every minute; contact Cesbo support if it stays
`40006`	The license server cannot answer right now — retried every minute
`40100`	No license file, or it holds no serial — activate
`40110`	`s` in `license.txt` is not a usable URL — fix or remove it
`40111`	Cannot connect to the license servers (network, TLS, proxy, timeout)
`40112`	The answer did not come from a license server (a proxy, a captive portal, or a wrong `s`) — retried every minute
`40120`–`40135`	A license server answer failed verification — retried every minute; check the host clock and any proxy that rewrites HTTPS
`40140`	A license server answer failed signature verification — locked; check for a proxy that rewrites HTTPS

When a license expires

When the license expires, or its device is removed or replaced, the license servers refuse the check (40002 expired, 40000 removed or replaced) and Vision locks as described in What “locked” means. It then checks every hour, so it unlocks by itself once the license is renewed in your Cesbo profile; Re-check now does it at once. In the last 7 days before expiry a banner above every page tells users who can read settings.

Offline operation

Vision retries every minute when the license servers cannot be reached.

Within 30 minutes of a start, it keeps running without any answer.
After a successful check, it keeps running for up to 30 days without one. During the last 7 days the License page and a banner above every page show until when.
The 30-day window lives in memory only: restarting the service starts over with the 30-minute grace.

Network

Vision needs outbound HTTPS (443) to:

ls1.cesbo.com, ls2.cesbo.com, ls3.cesbo.com — the checks (at least one);
app.cesbo.com — activation only.

Behind a proxy, set HTTPS_PROXY in /etc/vision/vision.env and run sudo vision restart. The proxy must not intercept TLS: a rewritten answer fails verification.

Your data

Recordings stay on your Alta servers. Vision keeps its own database and application data on its host, under /var/lib/vision/.
Licensing needs outbound HTTPS only to the hosts listed under Network.
During activation the Cesbo page shows the hostname of the device being activated.

Checking from the shell

vision status shows the license file’s public ID, or not activated. The live state and expiry are on Settings → License.
vision doctor checks the file (exists, owner vision, mode 0600, granted to the service by the unit) and whether the license servers and app.cesbo.com answer. An unreachable server is a warning, not a failure.
journalctl -u vision and Logs (component license) record every state change.