Prerequisites¶
Recommended setup
A fresh Debian 13 in a dedicated VM just for Vesana. This is a recommendation only: Vesana runs just as well on Ubuntu or RHEL and alongside other services on the same server — a dedicated, fresh VM simply makes updates, backups and troubleshooting easier because nothing else competes for Docker, ports 80/443 or RAM.
Hardware¶
| What | Minimum | Recommended | With AI (local Ollama) |
|---|---|---|---|
| Operating system | Linux (Debian 12+, Ubuntu 22.04+, RHEL 9+) | Debian 13 | Debian 13 |
| Architecture | amd64 | amd64 | amd64 + optional NVIDIA GPU |
| RAM | 1 GB | 2 GB; 4 GB at ~50 hosts | + 4–48 GB depending on model |
| CPU | 1 core | 2 cores at ~50 hosts | 4+ cores |
| Disk | 10 GB | 50 GB SSD (for log retention) | + 20 GB for models |
Rule of thumb
Small environments (a few dozen hosts) run well on 1 GB RAM. About +500 MB per 100 additional hosts, and eventually an extra CPU core. Logs and long retention windows mostly drive disk usage.
Under 1 GB RAM
1 GB is the minimum. Below that the server starts swapping — Vesana often still runs, but noticeably slower and with occasional timeouts under load.
The setup wizard's four sizing profiles (Small/Medium/Large/XL) help you pick the right worker/database configuration once the instance is running: see Resources → Performance.
Software¶
- Docker Engine ≥ 24.0
- Docker Compose ≥ 2.20 (V2, built in)
- openssl and curl (installed by the setup script wherever
apt,dnf/yum,zypperorapkis available — otherwise install them by hand first)
Check:
If Docker is missing — the setup script installs it via get.docker.com. Manually:
Network¶
Inbound to the Vesana server¶
| Port | Purpose | Source |
|---|---|---|
| 80 (TCP) | HTTP → redirect to 443; only needed for the certificate validation “HTTP via port 80” (Admin → System → Certificate), otherwise optional | Internet (for HTTP-01) / LAN |
| 443 (TCP) | Frontend, API, receiver, agent config | Agents, collectors, browsers, mobile |
| 8443 (TCP) | Agent gateway — machine endpoints only | only when switched on; agents, collectors |
| 8444 (TCP) | own admin port of the split container | only in the split wizard's port mode |
80 and 443 can be moved if another service uses them — the installer asks for that (see Install).
Outbound from the Vesana server¶
| Target | Purpose | Required |
|---|---|---|
Docker registry (ghcr.io) |
Image pull on install and update | Yes |
license.vesana.org |
Update check, compose file on updates, license, instance pulse, feedback, support bundle | Recommended |
| ACME CA (e.g. Let's Encrypt) and your DNS provider's API | Certificate from Vesana (TLS / certificate) | Optional |
fcm.googleapis.com, updates.push.services.mozilla.com, *.push.apple.com |
Deliver push messages to devices (each browser's own push service) | Optional (only when push is used) |
api.anthropic.com |
AI provider Anthropic | Optional |
| SMTP server | Email notifications | Optional |
| NTP pool | Time sync (license validation needs correct clock) | Required |
DNS¶
A domain pointing to the server is recommended, if only so agents/collectors and browsers have a stable address. On first start the server generates a self-signed certificate so it can serve HTTPS right away. Your browser warns about it; the install commands for agents and collectors carry this certificate's fingerprint and do not need verification turned off. You set up a publicly trusted certificate (Let's Encrypt, your own ACME CA or an upload) afterwards under Admin → System → Certificate: see Self-hosting → SSL/TLS.
What Vesana does NOT need¶
- No inbound port on monitored machines — the data stream is outbound HTTPS 443 from agent/collector to server.
- No VPN between server and customer network — the collector lives in the customer network and phones home.
- No external database — Postgres + Redis run inside the compose stack.
- No monitoring data leaves the instance — measurements, device and tenant names, check configurations and logs never go outbound. What goes out on its own is the update check and the daily instance pulse against
license.vesana.org(can be switched off), plus whatever you explicitly send (support bundle, feedback).
Next¶
If prerequisites check out, continue with the installation.