Install the Hub

What you need

• A computer with a 64-bit ARM (arm64) or Intel or AMD (amd64) processor. The installer refuses any other.
• Linux with systemd, and one of these: Debian, Ubuntu or Raspberry Pi OS (apt); Fedora, RHEL, Rocky or Alma (dnf); Arch or Manjaro (pacman); openSUSE (zypper). A distribution based on one of them is recognised from /etc/os-release.
• On Debian, Ubuntu and Raspberry Pi OS: a release whose own repositories carry ffmpeg 5 or later and libmpv2. On a release without them, apt refuses the package for unmet dependencies and the Hub is not installed.
• A terminal on the box with sudo, curl to fetch the installer, and an internet connection.
• A screen is optional. Plug one in if you want a TV wall.

Install it

1. 01Open a terminal on the box, or connect to it over SSH.
2. 02Run: curl -fsSL https://get.secureeyes.app | sudo sh
3. 03When it asks Time zone for this hub, type your zone (for example Asia/Manila) and press Enter. Press Enter alone to keep the zone shown in brackets. A zone the box does not know is refused and the current one is kept; timedatectl list-timezones lists the names.
4. 04Wait for SecureEyes Hub is installed and running. The lines after it are the Hub's first-run links, one per address, each ending in #setup= and a code. If none are printed, the Hub had not written them yet: see them with the command under Open its web page.

What the installer does

• Works out the processor, and the distribution from /etc/os-release.
• Downloads the signed release manifest and checks its signature, then checks the package's SHA-256 against it. Anything that does not match is refused before it is installed.
• Debian, Ubuntu, Raspberry Pi OS: installs the .deb with apt, which also installs ffmpeg and the libraries the TV wall needs.
• Fedora, RHEL, Rocky, Alma, Arch, Manjaro, openSUSE: installs the dependencies with dnf, pacman or zypper, including an ffmpeg that decodes H.264 and HEVC, then unpacks the tarball and runs its install script.
• Creates the sehub service user, downloads the media engine and checks it, and starts the sehub service. The service starts again by itself after a reboot.

If it stops at ffmpeg (Fedora, RHEL, Rocky, Alma, openSUSE)

The Hub needs ffmpeg 5 or later that decodes H.264 and HEVC. The installer tries the repositories the box already has. When none of them has one, it prints the steps for your system and stops before anything of the Hub is installed: RPM Fusion on Fedora; EPEL, CRB and RPM Fusion on RHEL, Rocky and Alma; Packman on openSUSE. Follow them, then run the install line again.

Open its web page

1. 01Find the address. The installer printed links like https://<box name>.local:8443/#setup=<code>. To see them again, run on the box: sudo journalctl -u sehub -n 200 | grep setup= and use the last lines it prints. Each start of the Hub makes a new code, and only the newest works.
2. 02In a browser on the same network, open https://<box name>.local:8443, or https://<IP address>:8443. Leave off the #setup part if you will set the Hub up with the app: opening the full link claims the Hub for that browser.
3. 03The browser warns that the certificate is not trusted. That is expected: the Hub uses its own certificate. Continue to the page.
4. 04Set the Hub up next: Set up a new Hub.

• Port 8443 is the Hub's web page and API, over HTTPS.
• The .local name works where your network resolves mDNS names. If it does not, use the IP address.

If the installer stops with an error

• this installer does not know this box: it does not recognise the distribution. If yours is based on one of the four families, name the family in the command, for example: curl -fsSL https://get.secureeyes.app | sudo SEHUB_DISTRO_FAMILY=rpm sh (or deb, arch, suse). That family's package manager must be installed.
• no build for ...: the Hub runs on arm64 and amd64 only.
• run as root: run the line with sudo, exactly as shown.
• openssl is needed to verify the release signature: install openssl, then run the line again.
• could not read the release: the box could not read the release feed. Check that it reaches the internet, then run the line again.
• the manifest's signature does not verify or does not match the manifest: the download is not what SecureEyes signed. Nothing was installed. Run the line again later.
• could not install, on Arch: a stale package database is the usual cause. Run sudo pacman -Syu, then run the line again.

If it installs with a warning

• SecureEyes Hub is installed. It is not running: systemd is not running here. The box has no running systemd, for example a container. On a booted box, start it with: sudo systemctl enable --now sehub
• Could not fetch the media engine. The Hub starts, but its page shows NO MEDIA ENGINE and it serves no video. Fetch the engine on the box with linux-arm64 or linux-amd64 to match the processor: cd /usr/share/secureeyes-hub && sudo ./fetch-go2rtc.sh linux-arm64 /usr/local/bin then run sudo systemctl restart sehub

Update or remove it

Running the same line again installs a newer version over the old one. The Hub keeps its identity, pairings, cameras and recordings. Update the Hub has the detail.

To remove it on Debian, Ubuntu or Raspberry Pi OS, run: sudo apt remove secureeyes-hub. On the other distributions, run: sudo /usr/local/lib/secureeyes-hub/install-payload.sh --uninstall. Either way /var/lib/sehub stays: the Hub's identity, database and recordings.