Installation
Install
TreeAlarm VMS runs two ways: with Docker on Linux, or with a native installer on Windows. Both
give the same web interface on port 5134.
Downloads
| Download | What it is |
|---|---|
| ta_vms-setup-x64.exe | Windows installer, no Docker needed |
| ta_vms-x64.msi | The same installation as a bare MSI, for Group Policy or Intune |
| ta_vms-docker.zip | The Docker Compose stack, if you would rather not clone the repository |
Everything else, including older versions: releases.
Docker on Linux
The deployment repository pulls prebuilt images from Docker Hub. You do not need a source checkout to run the product.
Requirements
- Linux host with Docker Engine and Docker Compose v2
- Ports listed below available
- Disk space for the archive — recording fills whatever you give it
Run it
git clone https://github.com/treealarm/ta_install
cd ta_install
# edit .env — see the next section
docker compose --env-file .env up -d
Or unzip ta_vms-docker.zip, cd ta_vms, and run the same docker compose command.
The first start takes a while as images are pulled. When it settles, open:
http://<host>:5134
Settings you must change
Everything lives in .env. The stack ships with working defaults so it starts unattended; do not
expose it before replacing them.
| Variable | Default | Why it matters |
|---|---|---|
KEYCLOAK_ADMIN_PASSWORD | admin | Change it. Keycloak’s own administrator password, set on first start |
VMS_MEDIAMTX_PUBLISH_PASS | change_me_publish | Change it. Leave the default and anyone can publish to your media server |
VMS_MEDIAMTX_READ_PASS | change_me_read | Change it. Leave the default and anyone can pull any camera stream directly |
VMS_WHEP_SESSION_KEY | — | Seals the WHEP session tokens handed to browsers; must decode to 32 bytes, generate with openssl rand -base64 32 |
POSTGRES_PASSWORD | postgres | Change it in two places: .env and init_files/dapr_components/statestore.yaml |
RABBITMQ_DEFAULT_PASS | vms | Change it in two places: .env and init_files/dapr_components/orderpubsub.yaml |
WEB_VMS_PORT | 5134 | Change if the port is taken |
The database and broker passwords must match their copies in the Dapr component files; db-init
checks them on every start and stops the stack if they diverge.
Login and users
The stack runs its own Keycloak. The first sign-in is admin / admin; change that password in the
web interface. Add users at http://<host>:8013 — new users, password resets, the administrator
role. Keycloak’s own console is at http://127.0.0.1:8180, with the administrator password from
.env.
Ports
| Port | Purpose |
|---|---|
5134/tcp | Web interface and REST API |
8554/tcp | RTSP |
8889/tcp | WebRTC signalling (WHEP) |
8189/udp | WebRTC media. This one goes straight to the browser — if it is blocked, live video will not play |
8013/tcp | User administration (mt_admin) |
127.0.0.1:5432 | PostgreSQL, loopback only |
127.0.0.1:15672 | RabbitMQ management, loopback only |
127.0.0.1:8180 | Keycloak, loopback only |
Adding the first camera
Nothing is pre-configured. A default storage volume, a default media router and three recording profiles are created automatically on first boot — the rest is up to you.
Open the web interface and add a camera either through ONVIF discovery or by entering an RTSP URL. To turn on detection: Admin → Analytics, add a watch for the camera and stream and pick the classes. Arming is not required for that — arming controls recording on alarm, not whether the system looks at the picture.
Stopping
docker compose --env-file .env down
Recordings, detection crops and the database live under ./data on the host and survive this.
Adding -v wipes them.
Hardware acceleration
Archive re-compression and live HEVC→H.264 transcoding both run on an integrated GPU when there is
one. Neither requires it — the CPU path works — but the live transcode measured 43% less CPU per
stream on VA-API, and that is the largest sustained cost in the recorder. It needs /dev/dri
passed into the container; the deployment repository ships docker-compose.gpu.yml.example for
exactly that.
Windows
The Windows installer needs no Docker and runs the services as native Windows services. It supports Windows 10 1809 / Server 2019 or later, x64. Run it as an administrator; it installs the VC++, .NET and ASP.NET Core runtimes it needs. The MSI is for Group Policy or Intune on machines that already have those runtimes.
The first sign-in is admin / admin; users are added at http://<this machine>:8013. The
database, recordings and configuration live in C:\ProgramData\TreeAlarm\VMS and survive upgrades
and uninstalls. The analytics worker is not part of the Windows build; use the Docker deployment
if you need it. The release notes list what else the Windows build leaves out.
Windows installer and release notes →
Licensing and source
The VMS is MIT-licensed; its source, issues and feature requests are at ta_vms. The analytics worker is video_a, AGPL-3.0, because the bundled YOLO26 detectors are AGPL-3.0; the face detector (OMZ face-detection-0205) is Apache-2.0. The Docker images bundle third-party software under its own licences, among it FFmpeg with GPL-licensed encoders.
Source and tools
- ta_vms — the VMS source (MIT)
- video_a — the analytics worker (AGPL-3.0)
- OnvifSim — an ONVIF camera simulator for testing without hardware
- OnvifLib — the ONVIF client library the services use
- roi_transcode — the hardware video encoding library
📩 Stuck? Contact us