Installation
Install with Docker
The deployment repository pulls prebuilt images from Docker Hub. You do not need a source checkout to run the product.
Requirements
- Linux host with Docker Engine and Docker Compose v2
- Ports listed below available
- Disk space for the archive — recording fills whatever you give it
Run it
git clone https://github.com/treealarm/ta_install
cd ta_install
# edit .env — see the next section
docker compose --env-file .env up -d
The first start takes a while as images are pulled. When it settles, open:
http://<host>:5134
Settings you must change
Everything lives in .env.
| Variable | Default | Why it matters |
|---|---|---|
VMS_MEDIAMTX_PUBLISH_PASS | change_me_publish | Change it. Leave the default and anyone can publish to your media server |
VMS_MEDIAMTX_READ_PASS | change_me_read | Change it. Leave the default and anyone can pull any camera stream directly |
POSTGRES_PASSWORD | postgres | Change it |
VMS_STORAGE_BASE_PATH | /data/media_storage | Point this at the volume where recordings should live |
WEB_VMS_PORT | 5134 | Change if the port is taken |
pgAdmin ships with [email protected] / admin123 — change those or drop the service if you do not
need it.
Ports
| Port | Purpose |
|---|---|
5134/tcp | Web interface and REST API |
8554/tcp | RTSP |
8889/tcp | WebRTC signalling |
8189/udp | WebRTC media. This one goes straight to the browser — if it is blocked, live video will not play |
5432/tcp | PostgreSQL |
5050/tcp | pgAdmin |
50051/tcp | Recorder gRPC |
50005/tcp | Dapr placement |
Adding the first camera
Nothing is pre-configured. A default storage volume, a default media router and three recording profiles are created automatically on first boot — the rest is up to you.
Open the web interface and add a camera either through ONVIF discovery or by entering an RTSP URL. To turn on detection: Admin → Analytics, add a watch for the camera and stream and pick the classes. Arming is not required for that — arming controls recording on alarm, not whether the system looks at the picture.
Authentication
By default KEYCLOAK_URL is empty — there is no login screen and the interface is open to anyone
who can reach it. Fill it in to enable single sign-on, roles and per-camera permissions.
Keycloak is not part of this deployment. There is no Keycloak service in the compose file; you
need to run one yourself and point KEYCLOAK_URL, KEYCLOAK_REALM_NAME and KEYCLOAK_CLIENT_ID
at it.
Stopping
docker compose --env-file .env down
Recordings, detection crops and the database live under ./data on the host and survive this.
Adding -v wipes them.
Hardware acceleration
Archive re-compression and live HEVC→H.264 transcoding both run on an integrated GPU when there is
one. Neither requires it — the CPU path works — but the live transcode measured 43% less CPU per
stream on VA-API, and that is the largest sustained cost in the recorder. It needs /dev/dri
passed into the container; the deployment repository ships docker-compose.gpu.yml.example for
exactly that.
Licensing note on the bundled detector
The analytics image ships with a YOLO11 export for person and vehicle detection. Ultralytics YOLO11 is licensed under AGPL-3.0, and that has not been reconciled with AGPL’s network-use clause for distributed deployments. If that matters for your rollout, either clear the licensing or substitute a permissively licensed detector. The face detector (OMZ face-detection-0205) is Apache-2.0.
📩 Stuck, or need the source? Contact us