Install Padas Motion

This page is the single-host procedure: install Padas UI, the console, under /opt/padas/ui, then the Motion Engine (console: Cores; tree: core/) from the nested package Motion ships. Motion does not install or enroll the engine for you.

Host, ports, and the artifact name are on Requirements. After this page, run a sample pipeline. To add engines on other Linux hosts, see Next steps.

1. Install Motion

Motion file structure

With the installation make sure /opt/padas/ui and /opt/padas/packages exist. Nested files under packages/ match the Motion format (RPM nests RPM, DEB nests DEB, tarball nests tgz).

RPM (production)

sudo rpm -ivh ./padas-motion-<version>-linux-x86_64.rpm

The package lays down /opt/padas/ui/, /opt/padas/packages/, and padas-ui.service. It creates the padas user when needed and enables the console unit. It does not start the console and does not install the nested engine.

DEB (production)

sudo dpkg -i ./padas-motion-<version>-linux-x86_64.deb

Same layout as RPM; nested packages are .deb.

Tarball

sudo mkdir -p /opt/padas
sudo tar -xzf padas-motion-<version>-linux-x86_64.tgz -C /opt/padas

Some archives nest twice (padas-motion-…/padas-motion-…/). Move contents until /opt/padas/ui/ and /opt/padas/packages/ sit directly under PADAS_HOME. Then sudo chown -R padas:padas /opt/padas (create the padas user first if the tarball did not).

Verify

test -x "$PADAS_HOME/ui/bin/padas"
ls "$PADAS_HOME/packages"/padas-core-*

2. Start the console

Accept the license, then run under systemd (RPM/DEB). Foreground is fine for a lab.

sudo -u padas "$PADAS_HOME/ui/bin/padas" start --accept-license

Stop the foreground process (Ctrl+C) after license acceptance if you will use systemd:

sudo systemctl daemon-reload
sudo systemctl enable --now padas-ui.service
sudo systemctl status padas-ui.service

Tarball installs have no packaged unit until you copy one from ui/examples/. Keep the foreground (or --daemon) process running instead.

Open https://<host>:9000. First boot mints the install CA and a console TLS leaf; accept the browser warning (or trust the install CA PEM). Create the first administrator if the console asks.

3. Install the Motion Engine

Install the engine only from packages/padas-core-*, using the same format as Motion. Do not install Lookup for this path.

RPM Motion:

sudo rpm -ivh "$PADAS_HOME/packages"/padas-core-*.rpm

DEB Motion:

sudo dpkg -i "$PADAS_HOME/packages"/padas-core-*.deb

Tarball Motion:

sudo tar -xzf "$PADAS_HOME/packages"/padas-core-*.tgz -C "$PADAS_HOME"

Do not use tar --strip-components=1 on the nested archive (the root must stay core/). Fix ownership if needed, then verify:

sudo chown -R padas:padas "$PADAS_HOME/core"
test -x "$PADAS_HOME/core/bin/padas"

4. Enroll the engine

Issue a code in the console, then enroll from its binary on this host. Required flags are --ui-url and --code only.

1. In the console, open Service clients (Settings → Service clients).
2. Create — Service type = core. Set Client id.
3. Row action Enroll code — UUID, 15 minute TTL, single-use. Do not reuse a code after a failed or successful exchange.

"$PADAS_HOME/core/bin/padas" enroll \
  --ui-url https://<host>:9000 \
  --code <enrollment-uuid>

Optional TLS Verification

Optional: pin enroll HTTPS with --ca-file "$PADAS_HOME/ui/data/security/install-ca.crt".

Path	Purpose
$PADAS_HOME/core/data/security/<client_id>.client.secret	OAuth client secret (mode 0600)
$PADAS_HOME/core/etc/certs/install-ca.crt	Trust the console AS / JWKS (when returned)
$PADAS_HOME/core/etc/padas.toml	Auth client/server/cache blocks patched

Enroll does not create engine api.crt / api.key. The CLI prints PADAS:INFO: Enrolled client_id=… on success.

5. Start the engine

Accept the engine license if this is the first start, then use systemd (RPM/DEB) or keep the binary in the foreground.

sudo -u padas "$PADAS_HOME/core/bin/padas" start --accept-license

Stop the foreground process (Ctrl+C) after license acceptance if you will use systemd:

sudo systemctl daemon-reload
sudo systemctl enable --now padas-core.service
sudo systemctl status padas-core.service

Tarball: keep "$PADAS_HOME/core/bin/padas" start, or copy core/examples/padas-core.service into systemd yourself.

Start mints the engine TLS leaf and begins S2S token fetch using enrolled config.

curl --insecure https://127.0.0.1:8999/api/v1/status

Done when

Check	Expect
Motion	ui/ and packages/ under /opt/padas
Padas UI	https://<host>:9000 responds; install CA exists
Engine installed	core/bin/padas exists
Enroll	*.client.secret, engine install-ca.crt, auth blocks in padas.toml
Engine running	GET /api/v1/status over HTTPS 8999 succeeds

Then: Run a sample pipeline.

Motion also ships Lookup under packages/; skip it on this path. Remote engines and Lookup: Next steps.

Troubleshooting

Symptom	Likely cause	Fix
no matches found: packages/padas-core-*	Wrong directory	cd until ui/ and packages/ are in the current PADAS_HOME
invalid enrollment code	Expired, reused, or typo	New code from Service clients
unrecognized subcommand enroll	Old engine package	Reinstall Motion / nested padas-core-* with enroll support
unrecognized option --service	Deprecated CLI flag	Use only --ui-url and --code
Enroll TLS error with --ca-file	Wrong PEM	Point at UI install-ca.crt, or omit --ca-file