Skip to main content
Working with an agent? Give them a link to this page as markdown.

Self-hosting

Self-hosted Watcher runs the monitoring API and the Analyzer in your own environment. The Watcher client runs on developers' machines and sends sessions to that deployment.

Plan and install the deployment​

  • Deployment example explains the parts, how data flows between them, and a reference single-host layout.
  • Gateway deployment reference diagrams Tailscale Aperture observation and LiteLLM tool enforcement with the self-hosted stack.
  • AWS infrastructure documents the Terraform modules in the self-host release. For another cloud, or for on-premises, follow the same prerequisites and bring an equivalent Linux Docker host.
  • Kubernetes infrastructure gives a Helm example for an existing cluster, with its architecture and verification steps.
  • EKS reference covers the supplied Terraform for a private AWS cluster, RDS, an existing ALB, and registry credential refresh.
  • Setup covers prerequisites, authentication choices, release inputs, and the guided install.

Roll out the client​

  • Client deployment covers single-user installs, shared VM images, proxy headers, and client updates.
  • MDM rollout covers managed installs on persistent macOS and Linux machines.

Secure and operate the deployment​

  • Update Watcher covers the actions each version needs, server updates, rollback, and how the Watcher client updates.
  • Automate Analyzer updates helps you schedule approved releases with a host scheduler, deployment pipeline, or internal mirror.
  • Verify an update gives the go/no-go checks to run on one test machine before you update the client fleet.
  • Supply chain security covers artifact verification and internal mirrors.
  • Security covers recorded data, LLM provider calls, retention, auditing, telemetry, and network connections.
  • Operations covers backups, restores, support bundles, and the admin audit log.

The guided setup prompt installs the Docker Compose stack once its infrastructure is ready. If you still need to provision a host, network, database, or TLS certificate, start with the infrastructure prerequisites prompt.

Found an issue with this page? Report it on GitHub.