Skip to content
Norsk

Server install — overview

End-to-end install of norsk-ctl as a daemon on a fresh Ubuntu LTS, Debian, or Oracle Linux box — Docker Engine, the norsk-ctl binary, a systemd unit, and the reverse proxy, all in one shot. It leaves you with the daemon running and the UI served; you launch your first instance from there.

Section titled “Recommended box”
OSUbuntu 22.04 / 24.04 / 26.04 LTS, Debian 12, or Oracle Linux 9
CPU8 vCPU (Norsk is CPU-hungry)
RAM16 GB
Disk50 GB+ (recordings + Docker image pulls add up)

Sizing is a recommendation, not a hard limit — Norsk runs on less, but a real workload will want at least this. The scripts target Ubuntu LTS, Debian 12, and Oracle Linux 9; otherwise it works on bare metal or any cloud VM (EC2, GCE, etc.).

Ports

Section titled “Ports”

Open 22 (SSH) and 443 (proxy / HTTPS) inbound; keep 8333 localhost-only; add port 80 only while issuing a certbot certificate, and any ingest ports your pipelines listen on. Full breakdown, plus how to change the proxy port: Ports & host detection.

Install

Section titled “Install”

Copy your license onto the box, then run the installer in --server mode. One command fetches the binary, installs Docker (only if docker compose is missing), creates a systemd service, and configures TLS. The license is staged under /etc/norsk-ctl/licenses/ keeping its filename (the installer prints the exact path); you supply it when registering a product (norsk-ctl product add --license-file /etc/norsk-ctl/licenses/license.json) — there is no daemon-global license:

Terminal window
scp /path/to/license.json ubuntu@<public-ip>:/tmp/license.json
ssh ubuntu@<public-ip>


curl -fsSL https://s3.eu-west-1.amazonaws.com/norsk.video/norsk-ctl/install.sh -o install.sh
read -rs -p 'Admin password: ' NORSK_ADMIN_PASSWORD; echo
export NORSK_ADMIN_PASSWORD
sudo --preserve-env=NORSK_ADMIN_PASSWORD bash install.sh \
  --server --license /tmp/license.json --ip auto

read -rs keeps the password out of your shell history and off the screen. For automated installs you’d pull it from a secrets manager (Vault, AWS Secrets Manager, etc.) into the same env var; the proxy auth layer itself can also be replaced by an SSO integration as part of a production setup.

Then open https://<host> and sign in as admin. Browsers show a one-time “not trusted” warning — it’s a self-signed cert, but real TLS, so login works. Takes ~3–5 min (mostly the apt-based Docker Engine install). The large Studio and Media images aren’t pulled during install — they’re fetched on your first instance launch, or up front with --pull-images (below).

A few things worth knowing:

  • --ip auto detects the box’s public IP and puts it in the cert. Pass --public-host <name> to set it explicitly (use the exact host you’ll type into the browser).
  • The installer always prints its plan and asks you to confirm before touching the box. Type y at the [y/N]: prompt; add --yes to skip it in automation. --print by itself shows the plan and exits without doing anything.
  • The password comes from NORSK_ADMIN_PASSWORD so it’s not a flag in your shell history — leave it unset and the installer prompts (hidden).
  • --pull-images pre-pulls the default Studio, Media, and proxy images during install, so your first instance launch is fast instead of waiting on a multi-GB download. Off by default because those images are large; without it they’re pulled lazily on first use. A failed pull only warns — the daemon is already up.

Changing the defaults

Section titled “Changing the defaults”

Network mode and cert source are independent choices — add flags to the install command.

Network mode:

ModeFlagUI reachable at
Docker (default)(none)https://<host>
Hybrid--network-mode hybridhttps://<host> (same UI path; media on the host network)

Both modes front Studio with the same proxy and reach the UI identically — not a security difference. Hybrid only moves the media container onto the host network for kernel-direct, lowest-latency ingest. See Network Modes.

Certificate source — self-signed is the default:

  • self-signed (no domain) — openssl mints a cert; one-time browser warning, real TLS. Uses --ip auto / --public-host so the cert covers the address you reach it at.
  • certbot (you have a public DNS name) — add --cert-source certbot --domain norsk.example.com --cert-email ops@example.com. Serves on :443 by default. Needs port 80 reachable during issuance.
  • user (bring your own) — add --cert-source user --cert-path … --key-path ….

There is no plain-HTTP option: a server must serve TLS, or the login cookie is silently dropped for anyone connecting over a public address.

Picking a cert source

Section titled “Picking a cert source”
Have a domain pointing at the box?Want browsers to trust it with no warning?Cert source
YesYescertbot — automatic Let’s Encrypt cert
YesBringing your own certuser — supply cert + key
NoA one-time click-through warning is fineself-signed (default) — with --ip auto
NoYes, but only on devices you controluser — mkcert on your laptop, scp the .pem files
NoYes, on any deviceGet a domain — there’s no shortcut here

For the trusted-on-your-own-devices case (option c with mkcert):

Terminal window
# On your Mac, with mkcert + its CA already installed:
mkcert <box-public-ip>
scp <box-public-ip>.pem      ubuntu@<box>:/tmp/cert.pem
scp <box-public-ip>-key.pem  ubuntu@<box>:/tmp/key.pem
# Then on the box: --cert-source user --cert-path /tmp/cert.pem --key-path /tmp/key.pem

Not on Ubuntu or Debian?

Section titled “Not on Ubuntu or Debian?”

--server targets Ubuntu 22.04 / 24.04 / 26.04 LTS, Debian 12, or Oracle Linux 9. On any other distro you have two options:

  • Read the full Install script (or run install.sh --print) as a checklist and translate it to your distro’s conventions.
  • Follow the Local install process (the wizard plus the worked Examples) to install the CLI in local mode, provide your own Docker, and run norsk-ctl init.

Or get in touch and we’ll help.

Next steps

Section titled “Next steps”

After install completes, the daemon is up and the proxy is serving — but no product is registered yet, so there’s nothing to launch. Sign in as the admin user you set at install time, then register a product (norsk-ctl product add --image …) to import a product template you can launch. See Register a product for the exact command, or Automated install to script the whole thing.