Install Padas Motion

This page is the single-host procedure: install Padas UI, the console, under /opt/padas/ui, then the Motion Engine (console: Cores; tree: core/) from the nested package Motion ships. Motion does not install or enroll the engine for you.

Host, ports, and the artifact name are on Requirements. After this page, run a sample pipeline. To add engines on other Linux hosts, see Next steps.

1. Install Motion

Motion file structure

With the installation make sure /opt/padas/ui and /opt/padas/packages exist. Nested files under packages/ match the Motion format (RPM nests RPM, DEB nests DEB, tarball nests tgz).

RPM (production)

sudo rpm -ivh ./padas-motion-<version>-linux-x86_64.rpm

The package lays down /opt/padas/ui/, /opt/padas/packages/, and padas-ui.service. It creates the padas user when needed and enables the console unit. It does not start the console and does not install the nested engine.

DEB (production)

sudo dpkg -i ./padas-motion-<version>-linux-x86_64.deb

Same layout as RPM; nested packages are .deb.

Tarball

sudo mkdir -p /opt/padas
sudo tar -xzf padas-motion-<version>-linux-x86_64.tgz -C /opt/padas

Some archives nest twice (padas-motion-…/padas-motion-…/). Move contents until /opt/padas/ui/ and /opt/padas/packages/ sit directly under PADAS_HOME. Then sudo chown -R padas:padas /opt/padas (create the padas user first if the tarball did not).

Verify

test -x "$PADAS_HOME/ui/bin/padas"
ls "$PADAS_HOME/packages"/padas-core-*

2. Start the console

Accept the license, then run under systemd (RPM/DEB). Foreground is fine for a lab.

sudo -u padas "$PADAS_HOME/ui/bin/padas" start --accept-license

Stop the foreground process (Ctrl+C) after license acceptance if you will use systemd:

sudo systemctl daemon-reload
sudo systemctl enable --now padas-ui.service
sudo systemctl status padas-ui.service

Tarball installs have no packaged unit until you copy one from ui/examples/. Keep the foreground (or --daemon) process running instead.

Open https://<host>:9000. First boot mints the install CA and a console TLS leaf; accept the browser warning (or trust the install CA PEM). Create the first administrator if the console asks.

3. Install the Motion Engine

Install the engine only from packages/padas-core-*, using the same format as Motion. Do not install Lookup for this path. Lookup is optional and not required for the sample TCP pipeline. After the sample runs, enable lookup enrichment.

RPM Motion:

sudo rpm -ivh "$PADAS_HOME/packages"/padas-core-*.rpm

DEB Motion:

sudo dpkg -i "$PADAS_HOME/packages"/padas-core-*.deb

Tarball Motion:

sudo tar -xzf "$PADAS_HOME/packages"/padas-core-*.tgz -C "$PADAS_HOME"

Do not use tar --strip-components=1 on the nested archive (the root must stay core/). Fix ownership if needed, then verify:

sudo chown -R padas:padas "$PADAS_HOME/core"
test -x "$PADAS_HOME/core/bin/padas"

4. Enroll the engine

Register the engine in the console first, then enroll from its binary on this host. Required CLI flags are --ui-url and --code only.

1. In the console, open Services → Cores (/cores).
2. Create — enter Core Name, Host, and Port. The console creates a matching service client (client_id = core id).
3. On the row (Enroll status Pending): Enroll code. A toast shows the copyable CLI (~15 minute TTL, single-use). Do not reuse a code after a failed or successful exchange.

"$PADAS_HOME/core/bin/padas" enroll \
  --ui-url https://<host>:9000 \
  --code <enrollment-uuid>

Optional TLS Verification

Optional: pin enroll HTTPS with --ca-file "$PADAS_HOME/ui/data/security/install-ca.crt".

Path	Purpose
$PADAS_HOME/core/data/security/<client_id>.client.secret	OAuth client secret (mode 0600)
$PADAS_HOME/core/etc/certs/install-ca.crt	Trust the console AS / JWKS (when returned)
$PADAS_HOME/core/etc/padas.toml	Auth client/server/cache blocks patched

Enroll does not create engine api.crt / api.key. The CLI prints PADAS:INFO: Enrolled client_id=… on success. In the console, the row Enroll status becomes Enrolled.

5. Start the engine

Accept the engine license if this is the first start, then use systemd (RPM/DEB) or keep the binary in the foreground.

sudo -u padas "$PADAS_HOME/core/bin/padas" start --accept-license

Stop the foreground process (Ctrl+C) after license acceptance if you will use systemd:

sudo systemctl daemon-reload
sudo systemctl enable --now padas-core.service
sudo systemctl status padas-core.service

Tarball: keep "$PADAS_HOME/core/bin/padas" start, or copy core/examples/padas-core.service into systemd yourself.

Start mints the engine TLS leaf and begins S2S token fetch using enrolled config.

curl --insecure https://127.0.0.1:8999/api/v1/status

Done when

Check	Expect
Motion	ui/ and packages/ under /opt/padas
Padas UI	https://<host>:9000 responds; install CA exists
Engine installed	core/bin/padas exists
Enroll	*.client.secret, engine install-ca.crt, auth blocks in padas.toml
Engine running	GET /api/v1/status over HTTPS 8999 succeeds

Then: Run a sample pipeline (Lookup still skipped).

Motion also ships Lookup under packages/; skip it on this path. After the sample pipeline: Enable lookup enrichment. Remote engines: Next steps.

Troubleshooting

Symptom	Likely cause	Fix
no matches found: packages/padas-core-*	Wrong directory	cd until ui/ and packages/ are in the current PADAS_HOME
invalid enrollment code	Expired, reused, or typo	New code from Services → Cores (Enroll code / Rotate & enroll code)
unrecognized subcommand enroll	Old engine package	Reinstall Motion / nested padas-core-* with enroll support
unrecognized option --service	Deprecated CLI flag	Use only --ui-url and --code
Enroll TLS error with --ca-file	Wrong PEM	Point at UI install-ca.crt, or omit --ca-file