Install LGD, step by step.

The server installer also supports Debian 12 and 13. This new-installation guide uses Ubuntu Server. Stations require Ubuntu 24.04/26.04; 32-bit systems, Windows, macOS and ordinary containers are not targets of this installation command. Virtual stations also need a virtual graphics adapter.

Resolve disk or hardware faults first. Successful installation does not test SSD health or guarantee reliability. OCR and remote-display performance depend on the actual computer; check them with the real camera and normal workload.

Complete this section after installing the server and before opening LGD Admin in a normal browser. The server creates its own certificate authority. Kiosk receives its verified fingerprint from the installation code; a browser on another computer may not yet trust it.

sudo lgd certificate

1. On the administrator’s computer, download the public certificate from http://SERVER_ADDRESS/lgd-ca.crt, replacing SERVER_ADDRESS with the casino server address.
2. Before importing, compare the downloaded certificate’s entire SHA-256 fingerprint with the server console output or a value verified by the technician. Downloading over HTTP alone does not establish trust.
3. Import only this public CA certificate into the trusted root store for the operating system/browser. Never download or share the server private key.
4. Reopen https://SERVER_ADDRESS:8443 and confirm there is no certificate warning.

openssl x509 -in lgd-ca.crt -noout -fingerprint -sha256

On a computer with OpenSSL, in the folder containing the downloaded lgd-ca.crt. The complete SHA-256 fingerprint must match sudo lgd certificate on the verified server.

sudo cp lgd-ca.crt /usr/local/share/ca-certificates/lgd-casino.crt
sudo update-ca-certificates

Run on the Ubuntu client only after comparing the fingerprint. Some browsers use a separate certificate store; verify the result in the actual browser.

On Windows use certificate management and the Trusted Root Certification Authorities store according to IT policy. On macOS import the verified CA in Keychain and configure its trust. Verify the SHA-256 fingerprint before confirming; system trust may not automatically propagate to every browser.

• Install a root CA on Ubuntu ↗

curl -fsSL https://lgdefender.com/install | sudo bash -s -- --check

A valid server code is still required. It prepares download tools and fetches a verified release, but does not install LGD services. It is not a completely read-only system check.

For an installed server use sudo lgd check, sudo lgd status and sudo lgd update. Installer options --host, --no-firewall and --no-ocr are for technicians with an agreed network design; normal installation does not need them. Plan firewall changes to retain maintenance access.

If automatic connectivity is unavailable, the LGD team supplies the complete signed licence line. An authorised casino administrator enters it in the local LGD Admin → Settings → LGD Licence → New licence. Never edit its contents.

Coordinate server replacement with LGD. A clean installation creates a new ID, but restoring the database reinstates the ID stored in the backup. For licensing checks, use the actual ID shown by sudo lgd status after restoration. Then run sudo lgd sync; if it fails, send LGD the ID and exact error. The licence must be valid and synchronisation successful before operations resume.

sudo lgd backup
sudo lgd update
sudo lgd sync

Run on the server. An update can briefly interrupt operation; inform staff first. Then run sudo lgd station again.

Open Station settings or the setup wizard from the station menu. An authorised manager with kiosk-management permission verifies changes by card and PIN or username and password. Check language, keyboard, content scale, printer, server and reader.

Station settings persist across restarts. Staff login is not restored after restarting Kiosk; reader pairing remains. An on-screen keyboard can be enabled for touch stations. Test restart and sign-out when finished.

The installer leaves RVO disabled until the technician configures the operator’s production credentials. A loaded application or valid licence does not mean RVO checks are working. The operator must confirm configuration and procedures before production use.

sudo lgd rvo

1. Choose production and enter the exact IDMisto and operator details. Prepare PEM certificate and private-key files on the server.
2. Enter certificate and key paths and any passphrase. Do not email the key or put it in this guide or routine service logs.
3. Sign in as an administrator and open Reception → Settings → RVO → Test connection. Then verify an authorised operational scenario with the operator; connectivity alone does not prove a correct response for a specific identity.
4. Verify the place ID matches the licence and agree an outage procedure. Never work around an outage by disabling RVO or using a test certificate in production.

OCR only suggests field values and does not establish document authenticity. Staff check the document and person; admission requires the appropriate RVO result and the application’s other checks.

• Supplied documents marked as test templates have been replaced with operator-approved wording and a new version.
• Operator details and the privacy contact are complete. Optional consents are not required as mandatory.
• The entire flow has been tested: document → field review → separate portrait → limits and documents → signature → unused card assignment → save.
• Tapping the card of a present player offers departure or ignoring the tap, rather than a second arrival.
• Staff know card replacement and temporary loan procedures, blocking and visitor records.

The technician deploys approved templates into the directory configured by RECEPTION_DOCUMENT_TEMPLATES. Configure RECEPTION_OPERATOR_NAME, RECEPTION_OPERATOR_ID, RECEPTION_OPERATOR_ADDRESS and RECEPTION_PRIVACY_CONTACT on the server. Previously signed documents retain their original wording. The casino supplies legal and operational approval; installation does not replace it.

sudo install -d -m 0750 -o root -g lgd /etc/lgd/documents /etc/lgd/notices

1. Prepare approved YAML files following /opt/lgd/current/config/reception/documents and /opt/lgd/current/config/reception/notices. Preserve required keys and types, including key, kind and required for registration documents, and assign a new unique version.
2. Place approved registration files in /etc/lgd/documents and notices in /etc/lgd/notices. The lgd group must be able to read them; recommended ownership is root:lgd with file mode 0640. Do not leave empty folders or an incomplete document set.
3. Use sudoedit to edit /etc/lgd/lgd.env. Set RECEPTION_DOCUMENT_TEMPLATES=/etc/lgd/documents and RECEPTION_NOTICE_TEMPLATES=/etc/lgd/notices. Complete the operator details listed above in the same file and check RECEPTION_TIME_ZONE. Do not change existing secret keys.
4. Restart LGD during a maintenance window and open registration and relevant notices. Check complete wording, populated operator details, required choices and the new version. Keep an independent backup of custom templates.

sudoedit /etc/lgd/lgd.env

The file also contains secrets. Edit only agreed entries and never publish the full contents. Write values containing spaces using systemd EnvironmentFile syntax.

sudo lgd restart
sudo lgd status

1. In Cashier settings create cash desks, currencies and chip sets/denominations. A new desk starts empty; initial cash and chips are recorded as transfers from the vault.
2. For live games configure games and tables according to actual authorisation and operations. Verify exchange rates, operational-day start, approval thresholds and cashier rules.
3. Complete reporting details, designate AML responsibilities and ensure required sanctions sources are reachable. The operator approves parameters; the installer must not guess them.
4. Test shift opening, vault transfer, money-in and payout, second-person approval, reversal, reconciliation and printing. Do not use real financial transactions as uncontrolled tests.
5. Test the payment terminal and gaming-machine provider separately. Recording a card payment does not mean it is charged automatically; a test ticket does not prove integration with real gaming machines.

1. Verify LGD Kiosk starts after a restart and username/password sign-in works. Sign out to return to the sign-in screen, then connect the reader to this station’s USB port.
2. Use a reader compatible with your cards in USB HID keyboard mode. It must send the UID quickly and finish with Enter or Tab. The same cards must produce the same UID format on every reader.
3. On the helper computer, open LGD Admin → Readers and create a record for the station and a pairing code. This code has 8 characters, is valid for 15 minutes and can be used once.
4. On the Kiosk sign-in screen choose Set up reader and enter the code. In a normal browser use the computer/reader pairing action.
5. To assign a staff card, connect the USB reader to the helper computer running LGD Admin. In the employee’s details select Add card, scan an unassigned card and confirm Assign card. Set a personal PIN on the account.
6. Reconnect the reader to the station’s USB port. Scan the assigned card on the station’s sign-in screen: the cardholder and a focused PIN field should appear. Enter the PIN and confirm with Enter. Then test a player card and an unassigned card.
7. Restart Kiosk and repeat the test. Replacing the computer or clearing the browser profile may require pairing again; revoke unused old pairings in Admin.

1. Connect the camera and capture the entire document sharply without glare or blur. Use a stable stand and even lighting. Identity/residence cards have two sides; a passport uses its identity page.
2. Read the document in registration and review suggested fields and any conflicts. Fill missing values; never accept an incorrect value for speed.
3. Take a separate player portrait. A document image is not the profile portrait. Check the portrait display when subsequently admitting by card.
4. Test the complete registration flow with staff and verify the correct details, portrait and documents are saved.

OCR processes images locally on the casino server and removes temporary document images after processing. Approved fields, portraits and signed documents follow the normal storage and retention rules. Manual entry remains available if OCR cannot be used.

sudo lgd ocr

Afterwards check OCR status in Reception settings and read an appropriate test document.

The signature field supports finger, pen or mouse input. Test the specific device with Linux and LGD before buying or handover. A dedicated signature pad needing a proprietary driver or SDK may not behave as ordinary input; automatic compatibility is not guaranteed.

• The player can see and read the complete document before signing.
• Pen/touch operates on the correct display, strokes are aligned and the signature can be cleared and repeated.
• The saved document in Player detail → Documents has the correct version and readable signature and can be printed.

1. Configure the printer in Linux with its driver and test system printing first. Kiosk does not install every possible printer driver automatically.
2. Select the printer in Station settings and run a test print. Check paper size, margins, accented characters, signature lines and any silent-print configuration.
3. Print the actual document types: registration document, cashier receipt and shift report. Narrow thermal paper may not replace A4 for all reports.
4. Test the ticket scanner with the actual gaming provider’s input flow. For the payment terminal test success, decline and reconciliation between recorded amounts and terminal totals according to operating procedures.

sudo apt update
sudo apt install -y cups
sudo systemctl enable --now cups
lpstat -p -d

This prepares printing; still add the actual printer with a supported driver. An empty list means none is configured yet.

A technician configures the printer before starting Kiosk or through maintenance access, following its model instructions. CUPS has local administration at localhost:631; Kiosk is restricted to LGD pages and does not open that administration. Port 631 need not be exposed to the whole casino or internet.

• Official Ubuntu CUPS setup ↗

systemctl status lgd-kiosk --no-pager
journalctl -u lgd-kiosk -b -n 100 --no-pager
journalctl -u lgd-kiosk-update -n 100 --no-pager

sudo systemctl restart lgd-kiosk

Interrupts work on this station. Complete or safely leave any operation in progress first.

An authorised manager can exit Kiosk for maintenance in Station settings. Without server connectivity use Service exit and the service PIN. Restarting the station starts Kiosk again; uninstalling is not the normal fix for lost connectivity.

1. Arrange server replacement with LGD and request a new server installation code. Install the replacement server; perform the final licence and synchronisation checks after restoring the backup.
2. Securely transfer the chosen completed archive and have the recovery code for that specific backup.
3. Run the restore below, replacing FILE with the actual backup path. Confirm overwriting only after checking the destination server.
4. After restoration, run the status and synchronisation commands below. Send LGD the actual installation ID from this output and any synchronisation error. Restoration can reinstate the original backup ID instead of the new installation ID; connectivity may not recover automatically.
5. Sign in using accounts from the backup. Verify players, documents, portraits, cashier records and audit. Check the RVO certificate and key, templates, DNS/IP, server certificate and station connectivity. Resume operations only with a valid licence, successful synchronisation and verified workstations.

sudo lgd restore FILE

FILE is a placeholder. Replace it with the full path to a .tar.gpg file. The command restores the database, stored files and application encryption keys.

sudo lgd status
sudo lgd sync
sudo lgd status

If synchronisation fails, contact LGD and resolve connectivity before resuming operations. A completed restore alone does not confirm a valid licence or successful synchronisation.

Separately retain the production RVO certificate and private key, custom templates outside normal storage and other external configuration. Do not assume an LGD backup contains every file on the computer. Restoring onto a new server may require re-verifying its CA trust on stations.

After an interruption, run the original installation command on the same computer with the same still-valid code. The installer can complete the pending registration using details stored on that station. This does not allow another computer to register with the same code.

sudo lgd-kiosk-enroll --discard-pending

Only on a station without active remote access, after confirming the original attempt cannot complete. Then create a new code on the server with sudo lgd station and rerun installation. This command does not revoke completed enrollment.

sudo lgd admin

Run on the server with Linux sudo access to restore access for your casino administrator.

• Casino, computer name and whether it is a server or station; LGD and Ubuntu versions.
• Exact time, procedure step, expected result and complete error wording.
• Status output and only the relevant log excerpt after removing personal data and secrets.
• Changes before the error: network, device, update, certificate or server replacement.
• Never send passwords, PINs, recovery codes, private keys or the complete /etc/lgd/lgd.env file.