Automated install

For unattended provisioning — CI, Ansible/Terraform, cloud-init — the --server installer runs with no prompts. Everything the interactive install asks for becomes a flag or an environment variable.

What you need

• Root or passwordless sudo on the target box (Ubuntu 22.04 / 24.04 / 26.04 LTS, Debian 12, or Oracle Linux 9).
• A license file already on the box (e.g. scp’d to /tmp/license.json). It must be the V2 format — a signed JSON envelope naming the products it entitles. Older V1 licenses are no longer accepted and must be reissued; contact Norsk support for a replacement. The installer checks the format during preflight, before it changes anything on the box, so a V1 file aborts the run up front instead of failing at the final registration step.
• An admin password, ≥8 characters with at least one digit, from your secrets manager — passed as NORSK_ADMIN_PASSWORD so it never lands in a flag or your shell history.

Install norsk-ctl, unattended

export NORSK_ADMIN_PASSWORD="$(vault read -field=pw secret/norsk)"   # or your secrets store

curl -fsSL https://s3.eu-west-1.amazonaws.com/norsk.video/norsk-ctl/install.sh \
  | sudo --preserve-env=NORSK_ADMIN_PASSWORD bash -s -- \
      --server --license /tmp/license.json --ip auto --yes

• --yes skips the confirmation prompt — required non-interactively; without it the installer aborts for lack of a TTY.
• --ip auto puts the box’s detected public IP in the self-signed cert; use --public-host <name> for an explicit hostname, or --cert-source certbot --domain … --cert-email … for a trusted cert.
• --print (in place of --yes) prints the plan and exits without touching the box — a dry run your pipeline can diff.
• NORSK_ADMIN_PASSWORD is validated (≥8 chars, ≥1 digit); a weak value aborts before any changes are made.

Full flag list: Install overview and the Install script reference.

Re-runs are safe

The installer is idempotent — Docker, the service user, and the systemd unit are created only if missing. Re-running to change a flag (or after a partial failure) converges rather than duplicating.

Then register a product

install.sh --server leaves the daemon running but with no product registered — register Studio to get something to launch. See Register a product for the exact product add --image command (pinned image, license path).

One shot: install + Studio together

The per-product bootstrap collapses both steps into one line — install norsk-ctl and register Studio:

curl -fsSL https://s3.eu-west-1.amazonaws.com/norsk.video/norsk-ctl/install/studio.sh \
  | sudo bash -s -- --license /tmp/license.json --admin-password "$ADMIN_PW" --public-host auto

--public-host names the address clients reach the box on — it goes into the TLS certificate’s SAN and prefixes every advertised instance URL. Pass the DNS name explicitly when you have one; auto probes for the public IP, which is right for a cloud box and wrong behind NAT (it reports the outbound address, not the one clients use). Omit it entirely only for a localhost-only install.

Registration does not launch anything: the box is left with Studio registered and nothing running. Add --launch-examples if you want the sample-workflow instance started as part of the install.

With a trusted certificate

The bootstrap takes the same TLS flags as install.sh, so a box with a DNS name can be installed, certificated and registered in one line:

curl -fsSL https://s3.eu-west-1.amazonaws.com/norsk.video/norsk-ctl/install/studio.sh \
  | sudo --preserve-env=NORSK_ADMIN_PASSWORD bash -s -- \
      --license /tmp/license.json \
      --cert-source certbot --domain norsk.example.com --cert-email ops@example.com

Certbot issues the certificate over an HTTP-01 challenge, so norsk.example.com must already resolve to this box and port 80 must be free and reachable from the internet. --domain doubles as --public-host — pass --public-host as well only if clients reach the box under a different name than the certificate is issued for. To install your own certificate instead, use --cert-source user --cert-path <pem> --key-path <pem>; the default, with neither flag, is a self-signed certificate.

Admin password

The bootstrap takes the admin password from --admin-password, falling back to NORSK_ADMIN_PASSWORD — the same environment variable install.sh uses.

Cloud marketplace

On a cloud image where the provider supplies the license, swap the license flag for --marketplace-provider gcp (or aws) — the daemon reads the license from instance metadata instead of a file. Building the marketplace image itself is a vendor step, not covered here.