On-Premise Installation
Deploy Lokawatch on your own infrastructure with one script. Before starting, make sure you have completed the Server Preparation checklist and have your registry username and password (sent separately by your account manager).
This deployment method is self-service — you don't need to wait for a scheduled remote session. Reach out to your account manager any time if you'd like help.
1. Clone the Deployment Repository
Your account manager will provide you with the Git repository URL — this is a small, dedicated deployment repository, not our application source code. Clone it on the server:
git clone REPO_URL_PROVIDED_BY_ACCOUNT_MANAGER lokawatch-deploy cd lokawatch-deploy 2. Run the Installer
One command handles everything from here:
./lokawatch.sh install It walks you through everything, asking only what it can't figure out on its own:
- Installs Docker automatically if it isn't already present — nothing to do by hand.
- Asks how the server will be reached, then configures HTTPS accordingly:
| Choice | When to use | What happens |
|---|---|---|
| Public domain | Server is reachable from the internet, DNS already points at it | Automatic, auto-renewing Let's Encrypt certificate |
| Internal IP / hostname | Server stays on your internal network only, e.g. https://192.168.1.50 | A self-signed certificate is generated for you. Browsers show a one-time warning — add a security exception, same as any internal enterprise tool |
| Plain HTTP | You already terminate HTTPS yourself (e.g. Cloudflare Tunnel, your own reverse proxy) | No certificate is generated — front the server however you prefer |
It then generates the database password and signing key for you (no openssl commands to run by hand), logs in to the image registry (prompts for the username and password you were given if you're not already logged in), pulls the images, starts everything, and prepares the database.
Already have Lokawatch running from an earlier installation? Run the same command. It detects the existing deployment automatically, backs up your database and camera evidence images, migrates you onto this install method, and restores everything — no manual cleanup needed on your part.
3. Access the Dashboard
The installer prints the dashboard URL when it finishes — your domain over HTTPS, your server's IP over HTTPS (internal mode), or its IP over plain HTTP, depending on what you chose in step 2.
Log in with admin@lokawatch.com / admin123 on a fresh install (this is printed at the end too) — change this password immediately.
Day-to-Day Commands
Everything after the initial install goes through the same script, run from infrastructure/on-premise/:
| Command | What it does |
|---|---|
./lokawatch.sh update [version] | Pull a newer version and redeploy. Backs up the database automatically first. Your data is preserved. Leave off the version to re-pull whatever's currently pinned. |
./lokawatch.sh redeploy | Recreate all containers from the current configuration (e.g. after editing .env). Data preserved, no new images pulled. |
./lokawatch.sh restart <service> | Restart a single service, e.g. ./lokawatch.sh restart backend-api. |
./lokawatch.sh status | Container health and a quick API check. |
./lokawatch.sh logs [service] | Tail logs — all services, or one by name. |
./lokawatch.sh reset | Destructive. Wipes all data and starts completely fresh. Requires typing RESET to confirm; backs up first regardless. |
To pick up newer deployment files (not just a newer app version), pull the repo first:
git pull ./lokawatch.sh update GPU Support
If your server has an NVIDIA GPU with the Container Toolkit installed, prefix any command with GPU=1:
GPU=1 ./lokawatch.sh install CPU works fine for pilot camera counts either way — a GPU helps at scale and speeds up LLM summaries.
Need dashboard and backend split across two servers? The standard installer runs everything co-located on one host. Contact your account manager to discuss a split deployment.
Troubleshooting
Check service logs
./lokawatch.sh logs ./lokawatch.sh logs backend-api Restart a service
./lokawatch.sh restart backend-api Health check
./lokawatch.sh status Browser warns about the certificate (internal-network installs)
Expected if you chose the internal IP/hostname option — the certificate is self-signed, not issued by a public certificate authority, since there's no public domain to issue one for. Click through the "Advanced" / "Proceed" warning once and add a security exception, the same as you would for any internal enterprise tool.
Let's Encrypt certificate failed
If you chose the public domain option and the certificate didn't issue:
- Confirm DNS for your domain already points at this server's IP before running the installer — Let's Encrypt verifies this over the internet.
- Ensure ports 80 and 443 are open in both UFW and your VPS provider's firewall panel (many providers block traffic before it reaches your server).
- If you're behind Cloudflare's proxy (orange cloud) rather than a direct A record, use the internal-network / self-signed option instead — Cloudflare terminates TLS at its edge, so your origin doesn't need a publicly-issued certificate.
Cloudflare timeout (522)
If using a Cloudflare Tunnel and Cloudflare shows "522 Connection Timed Out":
- Confirm the tunnel is running and connected on the server.
- Check
./lokawatch.sh status— the dashboard/backend containers should be healthy.
Containers restart in a loop
Check ./lokawatch.sh logs for specific error messages. Common causes:
- PostgreSQL not ready yet — the other services retry automatically.
- Health checks failing — check the dependent service is actually running.
- Out of memory — verify your server meets the minimum requirements (8 GB RAM).
Something looks wrong after a migration or update
Every update, reset, and automatic migration takes a backup first, saved under infrastructure/on-premise/backups/ on the server (a database dump plus a copy of your evidence images). Nothing there is deleted automatically — if something looks off, the previous state is still on disk.