Corporate Training setup guide

Conceptual mapping

Nothing in the panel is called a department or an employee. The table says which object plays which role; the chapters below set them up in that order.

1Prerequisites

What to have before installing.

1. A company server (Ubuntu 22.04 or 24.04) reachable from the offices, the installer, and an internal address or a domain behind your reverse proxy.
2. The training recordings, the auditorium's encoder for live sessions, and the HR or LMS system's ability to call an HTTP API.
3. A decision on confidentiality: which material goes in which department collection, and who in HR and in the training team gets a panel account.

2Infrastructure deployment

Headquarters first, then the offices.

1. Run the installer on the headquarters server; put the panel behind the company's reverse proxy and set the trusted proxies so the audit log sees real addresses.
2. Set the playback base to the internal address; employees outside the network reach it through the VPN or the proxy.
3. Enrol a node per office from Servers; the panel installs it over SSH and routes that office's viewers to it.
4. Create a partner account for the training team with permissions for the catalogue and none for the employees' lines.

3Content organisation

Collections by department, courses as series.

1. Create categories per topic and one series per multi-part course, with one episode per session.
2. Create one bouquet per department training collection, and an all-staff bouquet for material everyone sees.
3. Create one package per role: the bouquets that role needs and no others, with a long duration (a year, for instance) as the access period; a renewal adds another period, and HR disables the line when the contract ends.
4. Mark confidential collections clearly in their names; a line sees only the bouquets its package grants.

4Partner (reseller) configuration

The training team and, for a group, each subsidiary.

1. Create a group with catalogue permissions for the training team and a group with line permissions for HR.
2. Add the training team and HR as resellers with those groups; neither needs credits in an internal deployment.
3. A subsidiary with its own library gets its own reseller, its own bouquets and its own packages.

5Employee access configuration

One line per employee, from HR.

1. Create a Reseller API key for the HR system and keep it in the HR system's secrets.
2. On hiring the HR system calls action=create_line with the role's package and a request id (the package's duration is the access period); on leaving it calls action=disable_line.
3. Set max connections to the number of devices an employee may use (typically two: desk and phone).
4. For a pilot, add lines from Lines → add and hand the credentials to a few employees.

6Training materials

Recordings on demand.

1. Upload each recording as an episode's source or ingest it with the VOD ingest job; keep the title and a short description.
2. Attach the recording to the right department bouquet through its series.
3. Check playback with a test line of each role to confirm who sees what.

7Internal training sessions

A session as a live channel.

1. Add a live stream for the auditorium's encoder (RTMP push); put it in the all-staff bouquet or a department's.
2. Enable catch-up so late joiners can rewind, and upload the recording to the library afterwards.
3. Nodes in the offices take the session once from the origin and serve their people locally.

8Access expiration

Access ends with the contract.

1. A line expires at the end of its package's period; while the contract runs HR renews it with action=renew_line, and when the contract ends HR disables it.
2. Subscribe the HR system to the webhooks to reconcile expiring and expired lines with its own records.
3. For temporary access (contractors, onboarding week) use a short expiry rather than a separate package.

9Integration with HR or an LMS

Systems drive access; the player plays.

1. HR creates, renews and disables lines through the Reseller API; the LMS can link to the web player from a course page.
2. There is no single sign-on for viewers: an employee signs in to the player with the line's credentials your system issued.
3. Use Admin API keys with the read-only flag for internal reporting tools.

10Security considerations

Confidentiality from the network to the line.

1. Keep the platform on the internal network or behind the reverse proxy with TLS; set TRUSTED_PROXIES accordingly.
2. Two-factor sign-in for every panel account; permission groups so HR cannot change the catalogue and the training team cannot see lines.
3. Signed and expiring playback links, a low connection limit per line, and address binding where devices are fixed.
4. Encrypted database backups with an off-site copy; the audit log for every change of lines and catalogue.

11Troubleshooting

The usual first checks.

1. An employee sees another department's material: check the package of the line and the bouquets it grants.
2. A new hire has no access: check that the HR call succeeded (the Reseller API call log) and the line's expiry.
3. An office buffers during a live session: check the office node's heartbeat and that viewers are routed to it.
4. The audit log shows the proxy's address: set TRUSTED_PROXIES to the proxy and restart the panel.