Vesta — License & Lifecycle Guide (for customers)

Audience: the administrator who installs and operates Vesta on your own GPU hardware. This guide walks the whole life of a Vesta license — activate → install → validate → update → renew → expire/renew again — and every command you run is on your box. Shareable; contains no secrets.

Looking for a specific task? The Situation Guide is the short version — every situation (install · re-install · update · renew · hardware change · download trouble) as a copy-pasteable command list. This guide is the detail behind it.

Vesta is air-gapped: it never contacts the internet at runtime, has no telemetry, and "phones home" to no one. Your license is a small signed file that Vesta verifies entirely offline on your own machine. See §10 Privacy & air-gap.

1. How a Vesta license works

A Vesta license is a signed file (license.json) that carries three things Vesta checks every time it starts:

Vesta verifies the signature with a key built into the product — no server, no internet. There is nothing to "activate online." Your only job is to hand us a fingerprint of your machine once, and drop the license file we return onto the box.

Updates are free within your term. While your license is valid you may run any Vesta release — see §6 Updating Vesta.

2. The lifecycle at a glance

3. Step 1 — Fingerprint your machine

Your Vesta license is locked to one machine, so before we can issue it we need that machine's hardware ID. Reading it is the very first thing you do — before any download, and before Vesta is installed.

Getting the helper

We email you a download link for vesta-fingerprint.sh. That link is the only thing you need at this stage — no license, no bundles, no account. It is time-limited (normally 48 hours; ask for a fresh one if it lapses). On the machine that will run Vesta:

# 1. Download the helper (keep the quotes — the link contains special characters)
curl -fsSL "<the link we sent you>" -o vesta-fingerprint.sh

# 2. Make it runnable
chmod +x vesta-fingerprint.sh

# 3. Run it
./vesta-fingerprint.sh

It is a short shell script that installs nothing, downloads nothing, and makes no network connection — it reads one hardware identifier locally and prints it. You are welcome to open it in an editor first; it is a few dozen lines.

What you'll see

On an NVIDIA GPU server:

GPU_UUID=GPU-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
MACHINE_ID=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

On an Apple Silicon Mac:

HARDWARE_ID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
SERIAL=XXXXXXXXXX

If you'd rather not run a script

The helper is a convenience, not a requirement — it just wraps a single OS command. Run the one matching your machine and send us the result:

# NVIDIA GPU server (the NVIDIA driver's own tool, already installed)
nvidia-smi --query-gpu=uuid --format=csv,noheader

# Apple Silicon Mac (built into macOS)
ioreg -rd1 -c IOPlatformExpertDevice | awk -F'"' '/IOPlatformUUID/{print $4}'

Send it to us

Email the full output to Ingenium AI Solutions. We mint a license locked to that exact machine and send it back with your download links (§4).

More than one GPU? Run the helper on the machine you'll dedicate to Vesta and tell us which GPU it is — the license binds to the one reported first.

Nothing secret leaves your machine. A GPU UUID is not a secret or a credential; it is the equivalent of a serial number, and it is all we need. See §10.

4. Step 2 — Install & activate

Ingenium AI Solutions sends you download links (each valid for a limited time — download promptly; ask for fresh links if one expires). Vesta ships as separate parts — the application, the supporting services, and the AI models — so that updates only have to move the parts that actually changed:

1. Deploy kit — vesta-deploy-kit-<edition>-<version>.tar.gz: a small tarball with everything you run — docker-compose.yml, install.sh, update.sh, vesta-fingerprint.sh, vesta-download.sh, .env.example
2. Bundle links — one link per part. The application bundle (vesta-app-<edition>-<version>.tar.gz) ships with every release; the supporting services (vesta-base-…) and AI models (vesta-models-…) bundles are large and change rarely, so you'll only get their links on a first install or when they actually change. Each bundle is checksum-verified for you as it downloads.
3. license.json — your machine-locked license

Setup needs internet; running does not. Installation downloads your bundles and fetches the container runtime + the local model engine, so the install machine must have internet access during setup. Afterward, Vesta runs fully offline — it never contacts the internet at runtime, and none of your data ever leaves the machine (see §10).

Before you start — machine prerequisites

Have these in place before downloading. install.sh checks them and stops with a clear message if something is missing, but it is far quicker to sort them out first.

The downloader checks free disk before it starts, so it refuses up front rather than failing you at 90% of a large transfer.

Your deploy directory

Extract the deploy kit — that folder is your deploy directory. Run every command in this guide from inside it. Your license.json goes in a license/ sub-folder here; that exact location is where Vesta looks for it (mounted read-only into the containers). After install it looks like this:

vesta/                        ← extracted deploy kit (cd here first)
├── README.md                 ← start here
├── RELEASE-NOTES.md          ← what changed in this release
├── install.sh                ← §4 step 5
├── update.sh                 ← §6, for later releases
├── vesta-download.sh         ← §4 step 3 (the downloader)
├── vesta-fingerprint.sh      ← §7/§8, for renewal or a hardware change
├── vesta-reset-admin.sh      ← §9, if you're locked out
├── support-bundle.sh         ← §9, redacted diagnostics for us
├── docker-compose.yml        ← configuration — you never edit these
├── .env.example
├── vesta-app-…tar.gz         ← the bundles you download in step 3
├── vesta-base-…tar.gz        ←   (supporting services + AI models arrive on a
├── vesta-models-…tar.gz      ←    first install, or when they actually change)
└── license/
    └── license.json          ← put your license file HERE (step 4)

(The kit also carries checksums and a few helper files the scripts use internally — leave them alone.)

You never edit configuration. install.sh writes the .env for you — it generates all secrets, detects the version/edition from the images you loaded, and creates your first administrator (printing the temporary password at the end). There are no variables to set.

Then, from inside the deploy directory:

# 1. Download the DEPLOY KIT (small — a few hundred KB). Plain curl here, because the smarter
#    downloader you use in step 3 lives INSIDE this kit, so it can't fetch the kit itself:
curl -fsSL "<deploy-kit URL>" -o vesta-deploy-kit.tar.gz

# 2. Extract it and cd in. This folder is your deploy directory — run everything below from here:
mkdir -p vesta && tar xzf vesta-deploy-kit.tar.gz -C vesta && cd vesta

# 3. Download the bundles (the large parts) — parallel, resumable and checksum-verified. Pass ALL
#    the bundle links you were sent in ONE call (keep the quotes). A first install gets all three;
#    a later update is usually just the application. Safe to re-run — it resumes:
./vesta-download.sh "<application URL>" "<supporting-services URL>" "<AI-models URL>"

# 4. Download your license, straight into the folder Vesta reads it from:
mkdir -p license && curl -fsSL "<license URL>" -o license/license.json

# 5. Install — loads the bundles, generates secrets, starts the stack, seeds your first admin:
./install.sh

Why a helper? A half-finished or corrupted multi-GB download would fail docker load with a confusing error after a long wait. vesta-download.sh auto-retries with resume and verifies the SHA-256 up front, so you can't proceed with a bad file — if it's interrupted, just run it again and it continues. The download link stays valid for the whole window Ingenium AI Solutions set (up to 7 days), so a slow transfer is fine.

Controlling the download

It downloads in parallel, on purpose. A single connection can only carry about (window ÷ round-trip time), so over a long distance one stream stalls at a fraction of your real bandwidth however fast your line is. Each bundle is fetched as 8 byte-ranges at once and reassembled — the SHA-256 check proves the result is byte-identical.

While it runs you'll see a bar per stream, the file total, and an overall figure across all bundles:

   1 ██████████████████░░░░  82%      5 ███████████░░░░░░░  51%
   …
   file    ███████████████████░░░  78%  2.9/3.7 GB  214 MB/s  ETA 4m12s
   overall 2 of 3 · 9.1/21.6 GB · elapsed 6m03s

--benchmark prints single-stream vs parallel throughput. If the two are close, your own line or a corporate proxy is the limit and --parallel 1 is fine; if parallel is much faster, leave the default alone.

Running it unattended (nohup, screen, a CI job) is fine — it detects that it isn't on a terminal and prints one plain progress line every 30 seconds instead of animating, so your log stays readable. A download.log is written alongside the bundles; send it to us if you ever need support.

Safe by construction: the download is checked against a SHA-256 that ships inside your deploy kit, and if we ever republish a bundle under the same name, any partial data you already have is discarded rather than mixed with the new file.

install.sh brings up the stack and creates your first administrator account. Vesta will not start without a valid license for this machine — that's expected: if ./license/license.json is missing, install.sh tells you so and stops. Add the file and re-run it. When the stack is healthy, open the portal at the address install.sh prints.

5. Step 3 — Check & validate your license

Sign in to the portal as an administrator and open License (in the admin navigation). You'll see:

• Licensed to — your organization name
• Edition (SKU) and class (trial / production)
• Expires and days remaining
• GPU-locked — confirms it's tied to this machine
• Status banner — green when all is well; amber when renewal is approaching or you're in the grace period

That page is the source of truth for "is my license healthy and when does it expire."

If the license is missing or invalid, Vesta fails closed — the application refuses to start rather than run unlicensed. Re-check that ./license/license.json is the file we sent for this machine, then restart:

docker compose restart api worker

Sending diagnostics to support? Generate a redacted support bundle — it captures version, edition, license status and health, and contains no secrets: bash ./support-bundle.sh

6. Updating Vesta (new releases)

Versioning is by date. A Vesta version is its release date — YYYY.MM.DD, e.g. 2026.7.21. A higher date is a newer build. (You'll occasionally see a trailing number like 2026.7.21.1 — that's a same-day follow-up build.)

Updates are free while your license is valid — no new license needed, and your existing license file keeps working. When a release ships we send you a fresh deploy kit link plus the bundle link(s) that actually changed — usually just the application (a few GB); the supporting-services and AI-models parts change rarely, so most updates don't move them at all.

Run all of this from your existing deploy directory:

# 1. Refresh the deploy kit in place. Each kit is specific to one release, so this is what
#    brings the new checksums, scripts and release notes. Your .env and license/ are NOT in
#    the kit and are left untouched:
curl -fsSL "<deploy-kit URL>" -o vesta-deploy-kit.tar.gz && tar xzf vesta-deploy-kit.tar.gz -C .

# 2. Download the bundle link(s) you were sent:
./vesta-download.sh "<application URL>"          # + supporting-services / AI-models, if sent

# 3. Apply the update:
./update.sh                                      # finds and loads the bundle(s) you downloaded

Do step 1 first. The checksums that verify your download live inside the deploy kit and are specific to that release, so a new bundle checked against an old kit is refused with "no kit checksum matches…". Refreshing the kit is what keeps them in step. If you see that message, you almost certainly skipped step 1 — or you're using a link from a different release.

update.sh is data-safe. It loads the new images and restarts the containers, while your data — documents, knowledge graph, database, models, and your license — lives in persistent storage that is left untouched. Database upgrades run automatically on start. Your license keeps working; it's tied to your GPU and term, not to a particular version.

⚠ Never run docker compose down -v. The -v flag deletes your data volumes. Normal updates and restarts never use it, and neither does update.sh. (Taking a backup before a major update is still good practice.)

7. Grace period & expiry

Vesta warns you well ahead of expiry and gives you a cushion:

Your data is never touched by expiry. Nothing is deleted, and the moment you drop in a renewed license and restart, service resumes exactly where it was.

How to renew

Renew before the grace period ends:

1. Confirm this machine's fingerprint (it hasn't changed unless you swapped the GPU): bash ./vesta-fingerprint.sh
2. Send it (or your existing License ID from the portal) to Ingenium AI Solutions and request a renewal.
3. We send a fresh license.json. Replace the old file and restart — no reinstall, no data migration: bash cp /path/to/new-license.json ./license/license.json docker compose restart api worker
4. Re-open the License page to confirm the new expiry date.

Honest note on offline enforcement. Because Vesta never contacts the internet, an expired license cannot be revoked or extended remotely — it simply stops the application at the end of the grace period, and a renewed file starts it again. Renew a few days early to avoid any interruption.

8. Moving to a new machine (GPU swap or failure)

A license is locked to one GPU. If you replace the GPU, move to a new server, or recover from hardware failure, the license must be re-bound to the new GPU:

1. Run ./vesta-fingerprint.sh on the new machine.
2. Send us the new GPU_UUID and your existing License ID, and tell us it's a hardware change.
3. We issue a re-bound license.json for the new GPU. Drop it in and restart: bash cp /path/to/new-license.json ./license/license.json docker compose restart api worker

Your data volumes move with your data directory — copy/restore them to the new host as part of your normal server migration, then apply the re-bound license.

9. Troubleshooting / FAQ

10. Privacy & air-gap

• No internet at runtime. Vesta runs fully offline. Nothing about your documents, users, or usage ever leaves your server.
• No telemetry, no phone-home. The license is verified locally with a key built into the product. There is no license server to reach and no callback.
• Your data stays yours. All content lives in storage on your machine; updates and renewals never move or read it off-box.

11. Quick command reference

# Fingerprint this machine (FIRST STEP — we send you a link to this helper)
curl -fsSL "<fingerprint-helper link>" -o vesta-fingerprint.sh && chmod +x vesta-fingerprint.sh
./vesta-fingerprint.sh                      # email us the output; later, it's already in your kit

# First install (5 links: deploy kit · application · supporting services · AI models · license)
curl -fsSL "<deploy-kit link>" -o vesta-deploy-kit.tar.gz
mkdir -p vesta && tar xzf vesta-deploy-kit.tar.gz -C vesta && cd vesta
./vesta-download.sh "<link>" ["<link>" …]   # all the bundle links you were sent, in one call
mkdir -p license && curl -fsSL "<license link>" -o license/license.json
./install.sh                                # loads the bundles + starts the stack

# Apply a renewed or re-bound license (no reinstall)
cp new-license.json ./license/license.json
docker compose restart api worker

# Update to a new release (data-safe — never `down -v`)
./vesta-download.sh "<link>" ["<link>" …]   # the link(s) you were sent (often just the application)
./update.sh                                 # auto-discovers the bundle(s) you downloaded

# Health / diagnostics for support (redacted, no secrets)
./support-bundle.sh

Questions or a renewal request? Contact Ingenium AI Solutions. Keep your License ID (shown on the portal's License page) handy — it's the fastest way to locate your record.