# Install Blink on your own server This page is for customers who run Blink on their own hardware. If you use Blink in the cloud, IZT runs the server and you can skip to [Create an enrollment key](/install/enrollment-keys/). The Blink server ships as a single container image. The console your technicians use and the join page your customers see are built into it, so there is no separate web server to set up. ## What you need - A **dedicated server** that meets the [server requirements](#server-requirements), with a **persistent volume** for the server's data folder (`/data` inside the container). - The **database** the server stores its data in. Contact [IZT](https://izt.app) for the server image and the database requirements. - A **DNS name** for the server, for example `blink.example.com`. - Your **license activation code** from IZT, or the license file if the server cannot reach the internet. ## Server requirements Blink needs a server of its own: a physical machine or a virtual machine running **Debian 13**, 64-bit (x64), with nothing else running on it. IZT installs Docker on it. | | Minimum | Recommended | |---|---|---| | Technicians | Up to 10 | Up to 50 | | CPU | 2 vCPU (x64) | 4 vCPU (x64) | | Memory | 4 GB | 8 GB | | Disk (SSD) | 64 GB, plus recording storage | 128 GB, plus recording storage | More than 50 technicians? Contact [IZT](https://izt.app) to size the server with you. - Use SSD storage. Blink keeps its database, recordings and session logs on this disk. - If your plan includes **Session recording**, add disk space for recordings on top of the figures above. See [Plan storage for recordings](#plan-storage-for-recordings). - Give the server a fixed IP address, and a public one (or a port forward from one) so customers can reach it from anywhere. See [Open the ports](#open-the-ports). ### Plan storage for recordings Blink records every screen a technician watches, one recording per monitor, when your plan includes **Session recording** (part of Blink Pro). How much space a recording takes depends on what is on the screen: | What is on the screen | About | |---|---| | Typical office work: settings, documents, email | 0.2 GB per hour | | **Planning figure**, for a mix of sessions | **1 GB per hour** | | Full-screen video or fast-moving graphics on a high-resolution monitor | Up to 5 GB per hour | These figures are per monitor watched. Sound adds about 10 MB per hour, and terminal transcripts take next to nothing. To estimate, multiply the hours your technicians spend watching screens by 1 GB, and by the number of days you keep recordings. For example: 5 technicians, each watching screens for 2 hours a day, 22 working days a month, is about 220 GB a month. Keeping recordings for 90 days needs about 660 GB of recording storage. You set how long recordings are kept, and the most space they may use, with the `-recording-retention-days` and `-recording-quota-mb` options under [Server options](#server-options). By default, Blink keeps recordings forever, so set at least one of them, or watch the disk. See [Recording storage and log levels](/configure/recordings-and-logs/#how-long-recordings-are-kept). ## Choose the DNS name first Pick the name before you activate the license, and keep it. The license names the hostname, and every Access agent and support tool your server hands out is built to connect to `wss:///ws/agent`. Point the name at the server's public address. If you want a free Let's Encrypt certificate, the name must resolve to this server from the internet. ## Open the ports These are the server's default ports. Publish every one of them from the container and allow them through the host and network firewalls. | Port | Protocol | Used for | |---|---|---| | 443 (container port 8443) | TCP | The console, the join page, agent connections, and relayed media over HTTPS. Let's Encrypt also checks the certificate here. | | 8071 | TCP and UDP | Session media (screen, audio, input) | | 3478 | TCP and UDP | Relay for sessions that cannot connect directly | | 2565 | UDP | Relay | | 49152 to 51199 | UDP | Relay sockets, one per relayed connection | :::caution[Publish the relay range explicitly] The image does not list the 49152 to 51199 UDP range, so `docker run -P` and tools that read the image's ports leave it closed. Without it, relayed sessions connect but show no picture. Publish the range with `-p 49152-51199:49152-51199/udp`. ::: If the HTTPS port your users reach is not 443 (for example, a proxy or port forward in front of the server), tell the server with `-public-https-port`. Let's Encrypt always connects on port 443, so forward TCP 443 to the server if you use it. ### Outbound access for online activation To activate and renew the license online (see [Activate your license](/get-started/activate-your-license/)), the server must reach these hosts: | Host | Port | Used for | |---|---|---| | `license.blink.izt.app` | 443/TCP | License activation and renewal | | `build.blink.izt.app` | 443/TCP | License activation and renewal, agent downloads and updates | Without them, activate offline with a license file instead. ## Server options The container's arguments are the server's options. The ones most installations set: | Option | What it does | |---|---| | `-agent-url wss://blink.example.com/ws/agent` | This server's agent address. Set it to `wss:///ws/agent`. Agents are always built with the licensed name; if this option is missing or names another host, **Instance** › **License** shows a warning. | | `-public-https-port 443` | The port users reach the HTTPS listener on, when it differs from the container port. | | `-public-ip 203.0.113.10` | The public IP address to advertise for media, when the server sits behind a one-to-one NAT. | | `-recording-retention-days 90` | Delete finished recordings older than this many days. Default: keep them forever. | | `-recording-quota-mb 500000` | Delete the oldest finished recordings once recordings and terminal transcripts use more than this many MiB. Default: no limit. | A typical start looks like this. Replace the image and database placeholders with what IZT gave you. ```sh docker run -d --name blink --stop-timeout 45 \ -v blink-data:/data \ \ -p 443:8443 -p 8071:8071 -p 8071:8071/udp \ -p 3478:3478 -p 3478:3478/udp -p 2565:2565/udp \ -p 49152-51199:49152-51199/udp \ \ -agent-url wss://blink.example.com/ws/agent -public-https-port 443 ``` - `--stop-timeout 45` gives the server 45 seconds to stop cleanly: it pauses live sessions and finishes recordings before it exits. - The container checks its own health. `docker ps` shows it as `healthy` once the server process is up. ## Where your data lives Blink keeps its data in two places. Back up both: see [Back up and restore the server](/install/back-up-and-restore/). - **The database:** accounts, organizations, settings, devices, session history and logs, recordings, and uploaded certificates. Every secret in it is encrypted. - **The data folder** (`/data`, on the volume): the database key that unlocks those secrets (in `/data/secrets`), and a cache of the agent builds the server hands out. :::danger[Keep the data volume] Always mount a named volume at `/data`. Without the database key in it, a copy of the database cannot be used. If you run the container without `-v`, Docker keeps the folder in an anonymous volume that `docker rm -v` deletes. ::: ## First-time setup The first time the server starts with an empty database, it prints a **setup token** to its log and its console: ```text Blink first-time setup: open /setup and enter the setup token ``` 1. Open `https:///setup` in a browser. If your certificate is not set up yet, the browser warns about the built-in certificate; that is expected the first time. 2. Fill in **First name**, **Last name**, **Email**, a **Password** of at least 8 characters, **Confirm password**, and your **Organization** (your company or team). 3. Paste the **Setup token** from the server log (`docker logs blink`) and select **Create owner account**. 4. Set up two-factor sign-in: add the **Setup key** to an authenticator app, enter the **6-digit code** and select **Verify and enable**. 5. Save the recovery codes that appear, then select **I've saved them, continue**. 6. Create the **recovery kit** (see below). Setup is finished only when the kit is confirmed. The owner account you create gets every permission on the server and in your first organization. Once setup is finished, `/setup` sends you to the sign-in page. ### Create the recovery kit The recovery kit is two files locked with a passphrase you choose: - **Recovery key** (`blink-recovery--.json`): replaces the server's identity if it is ever lost or stolen. - **Database key backup** (`blink-kek--.json`): the backup of the key that protects every secret in the database. You need it to restore a database backup on new hardware. 1. Enter a **Passphrase** of at least 12 characters, confirm it, and select **Create recovery kit**. 2. **Download** both files, then select **I've saved both, continue**. 3. Prove the database key backup opens: select **Open the saved file** and enter the passphrase, or **Type its checksum**, then select **Continue**. 4. Do the same for the recovery file and select **Finish setup**. :::danger[Nobody can recover the passphrase] Blink keeps neither file, and nobody, IZT included, can recover the passphrase. Store the files offline, away from your database backups, and keep the passphrase somewhere else, such as your password manager. Without them, a lost server means reinstalling every Access agent. ::: ## Activate the license Sign in to the console and open **Instance** › **License**. Activate online with the activation code IZT sent you, or use the offline exchange if the server does not reach the internet. Use the DNS name you chose above as the hostname. The steps are in [Activate your license](/get-started/activate-your-license/), and renewal is covered in [Check and renew your license](/configure/license/). Once the license is active, the server fetches the agent builds for your instance. You can see them under **Instance** › **License** › **Agent builds**. ## Next steps 1. [Set up certificates](/install/certificates/) so browsers trust your Blink address. 2. [Back up the server](/install/back-up-and-restore/). 3. [Create an enrollment key](/install/enrollment-keys/) and [install the Access agent](/install/access-agent-windows/).