Documentation

Install VIGIL-MESH on NVIDIA Jetson

NVIDIA Jetson boards are edge computing backend targets: embedded vision, video encoding, robotics. VIGIL-MESH installs on them as an arm64 Debian package and turns the Jetson into a node of the private network, reachable at a stable address without exposing a single port. This page covers the use cases, installing the .deb, screenless (headless) enrollment with a pre-authorized key, and real-time transport of video streams and datagrams.

Jetson use cases

A Jetson is rarely a desktop machine: it is an embedded computer, often screenless, deployed in the field. VIGIL-MESH gives it an encrypted private network on top of any outbound access (4G/5G, Wi-Fi, site Ethernet).

Edge computing

A computer deployed on site joins the private network without opening a port or requiring a public IP, even behind a carrier-grade NAT (CGNAT). Your supervision services reach it at a stable address.

Video

A Jetson encoding one or more camera streams can publish them on the mesh (RTSP/RTP) to the authorized members, without exposing the camera on the Internet.

Robotics

Teleoperation and DDS/ROS 2 discovery: IP multicast is replicated across the mesh and datagrams travel end to end — see /en/docs/cas-ros2.

Install the package

The Jetson client ships as an arm64 Debian package. Get it from the download page, then install it with the system's package manager.

1
Get the arm64 .debFrom /download/client, download the Jetson package (.deb, arm64). The same build suits Jetson boards running JetPack/L4T.
2
Install the packageInstall the .deb with the board's Debian package manager (apt/dpkg), which resolves the dependencies and sets up the service. The package creates the node private key locally on first start — it never leaves the board.
3
Enable the serviceThe client runs as a system service and starts at boot, so the Jetson rejoins the mesh automatically after every reboot, with no intervention.

Headless enrollment

A Jetson usually has neither screen nor keyboard. Enrollment therefore happens without interaction, using a pre-authorized key generated from your workspace.

1
Generate a pre-authorized keyFrom your workspace console, issue a pre-authorized enrollment key. You can limit it in time and associate it with a role or with access policy tags.
2
Provide the key to the servicePut the key in the service configuration (environment variable or configuration file, depending on your provisioning). No manual input on the board is needed.
3
Automatic membershipAt startup, the Jetson contacts the controller over an outbound connection, proves its identity, receives its signed network map and its stable address, then becomes reachable — all without a screen.

Real-time transport

Once the Jetson is on the mesh, its real-time services become reachable as on a LAN, except that the traffic is encrypted end to end and goes through no application gateway.

RTSP/RTP video: publish a stream encoded on the Jetson to the authorized members of the network, at a stable address, without exposing the source on the Internet.
End-to-end datagrams: real-time command (teleoperation, telemetry) travels as unreliable datagrams, with no TCP head-of-line blocking on the command path.
Replicated IP multicast: DDS/ROS 2 discovery crosses the mesh as on a local network — see /en/docs/cas-ros2 and /en/docs/l2-multicast.