Ingotron 0.9.7: Robot Vault

Ingotron is a self-hosted appliance for collecting, reviewing, and exporting robot recordings. Robot Vault stores the original MCAP data, builds searchable episodes and derived media, and creates signed dataset manifests. Version 0.9.7 packages the application, a bundled identity provider, TLS, robot enrollment, backups, and upgrades behind one appliance CLI.

Release status: 0.9.7 is a corrective alpha release for a single Linux host and trusted robot networks. Read Security and current limitations before putting customer data on it.

Know what runs where

An Ingotron deployment has one server and one agent on each robot. Do not install the full appliance on every robot.

Use a stable server hostname or IP address that the browser and every robot can resolve and reach. Allow these connections:

Only the server needs Docker. Do not expose PostgreSQL, MinIO, Redis, internal Keycloak listeners, metrics, or the Docker API to the robot network.

Set up the server or host PC

Install the appliance on one Linux x86-64 server. This server hosts the admin interface. The signed installer checks for Docker Engine 24 or newer, Docker Compose 2.20 or newer, OpenSSL 3, tar, and curl. On a supported clean host with an active systemd manager (systemctl is-system-running reports running or degraded), it installs Docker and the Compose plugin automatically:

curl -fsSL https://get.ingotron.com/install | sudo sh

If Docker is managed by your organisation, disable that package step explicitly and install Docker Engine 24+ with the Compose v2 plugin before running:

curl -fsSL https://get.ingotron.com/install | sudo INGOTRON_INSTALL_DOCKER=0 sh

The historical INGOTRON_INSTALL_DOCKER=1 form remains supported. Automatic installation fails closed on distributions outside the supported Debian, Ubuntu, RHEL, CentOS, Rocky, Alma, and Fedora families.

On RHEL-family and Fedora hosts, SELinux Enforcing is currently refused by the installer and upgrade path until Ingotron ships its packaged SELinux policy. Do not disable SELinux to bypass this check; use a supported host or wait for the policy package.

The installer checks the update-channel signature, release manifest, bundle, and artifact digests. It installs versioned files under /opt/ingotron/releases, stores appliance state under /opt/ingotron/state, and installs the ingotron command in /usr/local/bin.

When installation finishes, it prints the admin URL, its certificate fingerprint, and a one-time claim code. Open the URL, check that the fingerprint matches, enter the code, and set the first administrator password. To claim the appliance from the server terminal instead, run sudo ingotron claim. The browser can run on the server or another trusted computer that can reach it.

Do not clone this repository and run install.sh for a 0.9.7 appliance. Do not invoke the shipped Compose files directly. The CLI supplies the required ordered overlays, project identity, secrets, TLS material, and state paths.

Test the server with sample data

To test the full pipeline with sample data:

sudo ingotron status
sudo ingotron demo

The command prints a link to the sample episodes. Processing continues in the background, so some media may take a moment to appear.

Set up each robot computer

Repeat this section for every robot. Do not run the appliance installer on a robot. The robot agent currently supports Linux x86-64 with systemd, OpenSSL 3, curl, tar, and the minimum glibc version listed in the signed agent manifest. The robot needs sudo, working DNS, a synchronized clock, and access to the server on TCP 8003 and 50051.

On the server admin interface:

1. Open the appliance URL printed by the installer and sign in. The direct Robots URL is normally https://<server-hostname-or-IP>:8003/ui/robots.
2. Select Add robot, enter its details, and enter the recording directory on that robot. The default is /data/robot_data.
3. Generate a one-time enrollment code (15-minute default lifetime) and copy the complete install command. Keep it private and use it only on the intended robot.

On the robot computer, run the command displayed by the admin interface. It has this form:

curl -fsSL https://get.ingotron.com/robot | sudo sh -s -- \
  --vault https://<server-hostname-or-IP>:8003 --code 'ign1...' --root '/data/robot_data'

The displayed command uses sudo because it installs and manages a systemd service on the robot. Browser actions do not use sudo.

The robot installer verifies the CA pin carried by the code before exchanging it for that robot's bearer credential. Rebuilt hardware and CA rotation require a fresh Re-enroll command from the Robots page.

The generated --root value tells the agent which directory to watch for completed .mcap files. After adding a file, return to Robots to confirm the robot is enrolled and online, then open Intake to confirm that the recording reached the server.

Configure the appliance in the UI

Open Admin at https://<server-hostname-or-IP>:8003/ui/admin to view the four appliance settings exposed by 0.9.7. Only Health-check timeout and Time-index cache size are editable. Change them, select Review changes, check the proposed restart, then select Apply reviewed plan. The page confirms the result after any query-service restart and reloads current values when another operation changed them. Allow raw media exports and Keep garbage collection in dry-run mode are displayed but host/release-controlled; they cannot be changed from the UI.

Common admin commands

sudo ingotron status
sudo ingotron logs query
sudo ingotron backup
sudo ingotron upgrade
sudo ingotron version

Run sudo ingotron <command> --help for exact options. Important recovery commands include claim-token, recover-admin, set-address, tls, restore, rollback, and uninstall.

Documentation

• User guide: claim, sign-in, UI, robots, recordings, datasets, and common problems
• Operations: backup and restore, upgrades, rollback, adoption, reattachment, address and certificate changes, and removal
• Configuration reference: owned settings, paths, ports, and supported overrides
• Security: trust boundaries, credentials, release verification, hardening, and limitations
• Release notes and changelog
• Third-party notices, the generated source dependency inventory, and software license

Upgrade or adopt

Upgrade an installed appliance through the signed channel:

sudo ingotron upgrade --show-config-changes

The supported upgrade range for 0.9.7 is >=0.9.0 <0.9.7. The CLI creates a backup by default and refuses incompatible paths. If an upgrade is interrupted, run sudo ingotron upgrade --resume.

For a legacy 0.9.0 checkout installation, use the explicit adoption path from that host instead of installing over it:

curl -fsSL https://get.ingotron.com/install | sudo INGOTRON_ADOPT=1 sh

Adoption preserves the detected configuration, data volumes, signing key, and robots, and grants the legacy fleet-wide ingest token a 30-day migration grace period. Move robots to per-robot enrollment during that window.

Upgrade/adoption preflight also reports any completed legacy uploads that lack source-side digest proof. They stay excluded until a root operator records an explicit decision with sudo ingotron integrity list and one of supersede, quarantine, or attest; see the operations guide before using attestation.

See the operations guide before upgrading, restoring, changing the appliance address, rotating the CA, or purging an installation.

Support

For product and private security reports, contact hello@ingotron.com. Do not send claim codes, robot credentials, passwords, signing keys, or backup files in email.