Install Blink on your own server

This page is for customers who run Blink on their own hardware. If you use Blink in the cloud, IZT runs the server and you can skip to Create an enrollment key.

The Blink server ships as a single container image. The console your technicians use and the join page your customers see are built into it, so there is no separate web server to set up.

What you need

• A dedicated server that meets the server requirements, with a persistent volume for the server’s data folder (/data inside the container).
• The database the server stores its data in. Contact IZT for the server image and the database requirements.
• A DNS name for the server, for example blink.example.com.
• Your license activation code from IZT, or the license file if the server cannot reach the internet.

Server requirements

Blink needs a server of its own: a physical machine or a virtual machine running Debian 13, 64-bit (x64), with nothing else running on it. IZT installs Docker on it.

	Minimum	Recommended
Technicians	Up to 10	Up to 50
CPU	2 vCPU (x64)	4 vCPU (x64)
Memory	4 GB	8 GB
Disk (SSD)	64 GB, plus recording storage	128 GB, plus recording storage

More than 50 technicians? Contact IZT to size the server with you.

• Use SSD storage. Blink keeps its database, recordings and session logs on this disk.
• If your plan includes Session recording, add disk space for recordings on top of the figures above. See Plan storage for recordings.
• Give the server a fixed IP address, and a public one (or a port forward from one) so customers can reach it from anywhere. See Open the ports.

Plan storage for recordings

Blink records every screen a technician watches, one recording per monitor, when your plan includes Session recording (part of Blink Pro). How much space a recording takes depends on what is on the screen:

What is on the screen	About
Typical office work: settings, documents, email	0.2 GB per hour
Planning figure, for a mix of sessions	1 GB per hour
Full-screen video or fast-moving graphics on a high-resolution monitor	Up to 5 GB per hour

These figures are per monitor watched. Sound adds about 10 MB per hour, and terminal transcripts take next to nothing.

To estimate, multiply the hours your technicians spend watching screens by 1 GB, and by the number of days you keep recordings. For example: 5 technicians, each watching screens for 2 hours a day, 22 working days a month, is about 220 GB a month. Keeping recordings for 90 days needs about 660 GB of recording storage.

You set how long recordings are kept, and the most space they may use, with the -recording-retention-days and -recording-quota-mb options under Server options. By default, Blink keeps recordings forever, so set at least one of them, or watch the disk. See Recording storage and log levels.

Choose the DNS name first

Pick the name before you activate the license, and keep it. The license names the hostname, and every Access agent and support tool your server hands out is built to connect to wss://<that name>/ws/agent.

Point the name at the server’s public address. If you want a free Let’s Encrypt certificate, the name must resolve to this server from the internet.

Open the ports

These are the server’s default ports. Publish every one of them from the container and allow them through the host and network firewalls.

Port	Protocol	Used for
443 (container port 8443)	TCP	The console, the join page, agent connections, and relayed media over HTTPS. Let’s Encrypt also checks the certificate here.
8071	TCP and UDP	Session media (screen, audio, input)
3478	TCP and UDP	Relay for sessions that cannot connect directly
2565	UDP	Relay
49152 to 51199	UDP	Relay sockets, one per relayed connection

Publish the relay range explicitly

The image does not list the 49152 to 51199 UDP range, so docker run -P and tools that read the image’s ports leave it closed. Without it, relayed sessions connect but show no picture. Publish the range with -p 49152-51199:49152-51199/udp.

If the HTTPS port your users reach is not 443 (for example, a proxy or port forward in front of the server), tell the server with -public-https-port. Let’s Encrypt always connects on port 443, so forward TCP 443 to the server if you use it.

Outbound access for online activation

To activate and renew the license online (see Activate your license), the server must reach these hosts:

Host	Port	Used for
license.blink.izt.app	443/TCP	License activation and renewal
build.blink.izt.app	443/TCP	License activation and renewal, agent downloads and updates

Without them, activate offline with a license file instead.

Server options

The container’s arguments are the server’s options. The ones most installations set:

Option	What it does
-agent-url wss://blink.example.com/ws/agent	This server’s agent address. Set it to wss://<your licensed DNS name>/ws/agent. Agents are always built with the licensed name; if this option is missing or names another host, Instance › License shows a warning.
-public-https-port 443	The port users reach the HTTPS listener on, when it differs from the container port.
-public-ip 203.0.113.10	The public IP address to advertise for media, when the server sits behind a one-to-one NAT.
-recording-retention-days 90	Delete finished recordings older than this many days. Default: keep them forever.
-recording-quota-mb 500000	Delete the oldest finished recordings once recordings and terminal transcripts use more than this many MiB. Default: no limit.

A typical start looks like this. Replace the image and database placeholders with what IZT gave you.

docker run -d --name blink --stop-timeout 45 \
  -v blink-data:/data \
  <database settings from IZT> \
  -p 443:8443 -p 8071:8071 -p 8071:8071/udp \
  -p 3478:3478 -p 3478:3478/udp -p 2565:2565/udp \
  -p 49152-51199:49152-51199/udp \
  <blink-server-image> \
  -agent-url wss://blink.example.com/ws/agent -public-https-port 443

• --stop-timeout 45 gives the server 45 seconds to stop cleanly: it pauses live sessions and finishes recordings before it exits.
• The container checks its own health. docker ps shows it as healthy once the server process is up.

Where your data lives

Blink keeps its data in two places. Back up both: see Back up and restore the server.

• The database: accounts, organizations, settings, devices, session history and logs, recordings, and uploaded certificates. Every secret in it is encrypted.
• The data folder (/data, on the volume): the database key that unlocks those secrets (in /data/secrets), and a cache of the agent builds the server hands out.

Keep the data volume

Always mount a named volume at /data. Without the database key in it, a copy of the database cannot be used. If you run the container without -v, Docker keeps the folder in an anonymous volume that docker rm -v deletes.

First-time setup

The first time the server starts with an empty database, it prints a setup token to its log and its console:

  Blink first-time setup: open /setup and enter the setup token

      <token>

1. Open https://<your DNS name>/setup in a browser. If your certificate is not set up yet, the browser warns about the built-in certificate; that is expected the first time.
2. Fill in First name, Last name, Email, a Password of at least 8 characters, Confirm password, and your Organization (your company or team).
3. Paste the Setup token from the server log (docker logs blink) and select Create owner account.
4. Set up two-factor sign-in: add the Setup key to an authenticator app, enter the 6-digit code and select Verify and enable.
5. Save the recovery codes that appear, then select I’ve saved them, continue.
6. Create the recovery kit (see below). Setup is finished only when the kit is confirmed.

The owner account you create gets every permission on the server and in your first organization. Once setup is finished, /setup sends you to the sign-in page.

Create the recovery kit

The recovery kit is two files locked with a passphrase you choose:

• Recovery key (blink-recovery-<instance>-<date>.json): replaces the server’s identity if it is ever lost or stolen.
• Database key backup (blink-kek-<instance>-<date>.json): the backup of the key that protects every secret in the database. You need it to restore a database backup on new hardware.

1. Enter a Passphrase of at least 12 characters, confirm it, and select Create recovery kit.
2. Download both files, then select I’ve saved both, continue.
3. Prove the database key backup opens: select Open the saved file and enter the passphrase, or Type its checksum, then select Continue.
4. Do the same for the recovery file and select Finish setup.

Nobody can recover the passphrase

Blink keeps neither file, and nobody, IZT included, can recover the passphrase. Store the files offline, away from your database backups, and keep the passphrase somewhere else, such as your password manager. Without them, a lost server means reinstalling every Access agent.

Activate the license

Sign in to the console and open Instance › License. Activate online with the activation code IZT sent you, or use the offline exchange if the server does not reach the internet. Use the DNS name you chose above as the hostname. The steps are in Activate your license, and renewal is covered in Check and renew your license.

Once the license is active, the server fetches the agent builds for your instance. You can see them under Instance › License › Agent builds.

Next steps

1. Set up certificates so browsers trust your Blink address.
2. Back up the server.
3. Create an enrollment key and install the Access agent.