Install Vision on Linux

Vision ships as a single Linux binary with the web UI and database embedded. The binary installs itself as a systemd service.

Requirements

• Linux x86-64 (Ubuntu 20.04+, Debian 11+, RHEL 8+, or any modern distro)
• 512 MB RAM minimum
• root access (for the one-time install)
• ffmpeg and ffprobe on the host — needed to probe cameras and export clips
• One or more reachable Cesbo Alta servers
• Outbound HTTPS to ls1–ls3.cesbo.com and app.cesbo.com for the license

Install

1. Run the installer

   curl -fsSL https://vision.cesbo.com/install.sh | sh

   The installer downloads the latest stable Linux x86-64 build, installs the binary to /usr/local/bin/, and runs vision install. If you are not running as root, it uses sudo for the privileged steps.

That’s it. The installer prints the URL to open (LAN address first) and the generated admin login.

Install a specific build

Builds are published at https://cdn.cesbo.com/vision/builds/vision-<tag>, with the tag’s leading v dropped — for example, release v261105 is the file vision-261105.

sudo curl -Lo /usr/local/bin/vision https://cdn.cesbo.com/vision/builds/vision-<tag>
sudo chmod +x /usr/local/bin/vision
sudo vision install

What vision install does

The installer is idempotent — re-running it after downloading a newer binary updates the service while keeping your config and data.

• Creates a dedicated vision system user (no login).
• Generates the encryption key, JWT secret, and a random admin password into /etc/vision/vision.env.
• Writes a production config to /etc/vision/config.yaml.
• Creates an empty /etc/vision/license.txt for the license and never overwrites it.
• Stores the database and application data under /var/lib/vision/. Camera recordings stay on Alta.
• Installs and starts the vision.service systemd unit.
• Prints the access URL and admin credentials (shown once).

Path	Purpose
/usr/local/bin/vision	The binary
/etc/vision/config.yaml	Configuration
/etc/vision/vision.env	Secrets (keys, admin password)
/etc/vision/license.txt	License serial, written by the activation
/var/lib/vision/	Database and application data
/etc/systemd/system/vision.service	Service unit

Before exporting clips or screenshots, select a default destination under Settings → Storages → Clips & Screenshots. Export files are not included in routine vision backup archives.

First login

Open the URL printed by the installer (by default the server listens on port 3303):

http://your-server-ip:3303

The installer writes http.secure_cookies: false, so login works over plain http://. Once HTTPS is in front (reverse proxy), set it to true and run sudo vision restart.

Caution

Open Vision by its LAN address or public name, not localhost — through localhost, live HLS video is refused later.

Log in with the admin email and password shown by the installer. The first screen is Settings → License: Vision stays locked until it is activated. The email is always admin@localhost; the password is generated. Both are also stored in /etc/vision/vision.env.

Note

ADMIN_EMAIL and ADMIN_PASSWORD in /etc/vision/vision.env seed the first admin account only while the user table is empty. Editing them after the first start has no effect on the existing account — change the password from the UI instead. If you’re locked out entirely and can’t open the UI, recover the admin password from the host — see Recover a forgotten password.

Next steps

1. Activate the license — Settings → License → Activate. A fresh install is locked until you do.
2. Add your Alta server — Settings → Connections → Add Server. Until then, vision status reports Not ready: no Alta server yet.
3. Add cameras.
4. Set an output storage for clips and screenshots under Settings → Storages.

http.allowed_origins is pre-filled with the detected LAN addresses. Edit it in /etc/vision/config.yaml only when users reach Vision through a proxy or a public name, then run sudo vision restart.

Manage the service

sudo vision status           # unit state, readiness, data sizes
sudo vision restart          # validates the config, then restarts
sudo vision logs -f          # follow logs (no root needed)
vision version               # print version
sudo vision uninstall        # remove (add --purge to also delete data + user)

The service restarts automatically on failure (systemd Restart=on-failure). These are thin wrappers around systemctl/journalctl — see the CLI Reference for the full command set, including vision doctor for offline diagnostics and vision backup/vision restore for backups.

Updating

To update to the latest stable build, re-run the installer — it downloads the latest binary, extracts it, and re-runs vision install, keeping your config and database:

curl -fsSL https://vision.cesbo.com/install.sh | sh

To do the same by hand, https://cdn.cesbo.com/vision/latest/vision-linux-x86_64.tar.gz serves a gzipped tarball containing the vision binary:

curl -L https://cdn.cesbo.com/vision/latest/vision-linux-x86_64.tar.gz | tar -xz
sudo ./vision install

install restarts the service whenever the running process is older than the binary on disk.