---
description: >-
  Choose the self-hosted Watcher deployment, client rollout, security, and operations guidance for your environment.
---

> Part of the Watcher docs. Index of all pages, with summaries: https://watcher-docs.apolloresearch.ai/llms.txt
> Before upgrading Watcher, read the release pages and full changelogs for every version crossed: https://watcher-docs.apolloresearch.ai/releases/index.md
> Found an issue with this page? Report it: https://github.com/ApolloResearch/watcher-bin/issues/new?title=Docs%20feedback%3A%20Self-hosting&body=Page%3A%20Self-hosting%0AURL%3A%20https%3A%2F%2Fwatcher-docs.apolloresearch.ai%2Fself-hosting%2F%0A%0A

# Self-hosting

Self-hosted Watcher runs the monitoring API and the
[Analyzer](../concepts/analyzer.md) in your own environment. The
[Watcher client](../client/index.md) runs on developers' machines and sends
[sessions](../concepts/sessions-and-trajectories.md) to that deployment.

## Plan and install the deployment

- [Deployment example](deployment-example.md) explains the parts, how data
  flows between them, and a reference single-host layout.
- [Gateway deployment reference](gateway-deployments.md) diagrams Tailscale
  Aperture observation and LiteLLM tool enforcement with the self-hosted stack.
- [AWS infrastructure](aws-infrastructure.md) documents the Terraform modules
  in the self-host release. For another cloud, or for on-premises, follow the
  same prerequisites and bring an equivalent Linux Docker host.
- [Kubernetes infrastructure](kubernetes-infrastructure.md) gives a Helm
  example for an existing cluster, with its architecture and verification
  steps.
- [EKS reference](eks-reference.md) covers the supplied Terraform for a private
  AWS cluster, RDS, an existing ALB, and registry credential refresh.
- [Setup](setup.md) covers prerequisites, authentication choices, release
  inputs, and the guided install.

## Roll out the client

- [Client deployment](client-deployment.md) covers single-user installs,
  shared VM images, proxy headers, and client updates.
- [MDM rollout](mdm.md) covers managed installs on persistent macOS and
  Linux machines.

## Secure and operate the deployment

- [Update Watcher](updates.md) covers the actions each version needs, server
  updates, rollback, and how the Watcher client updates.
- [Automate Analyzer updates](automatic-updates.md) helps you schedule
  approved releases with a host scheduler, deployment pipeline, or internal
  mirror.
- [Verify an update](update-verification.md) gives the go/no-go checks to
  run on one test machine before you update the client fleet.
- [Supply chain security](supply-chain.md) covers artifact verification and
  internal mirrors.
- [Security](security.md) covers recorded data, LLM provider calls, retention,
  auditing, telemetry, and network connections.
- [Operations](operations.md) covers backups, restores, support
  bundles, and the admin audit log.

The [guided setup prompt](prompts/setup.md) installs the Docker Compose stack
once its infrastructure is ready. If you still need to provision a host,
network, database, or TLS certificate, start with the
[infrastructure prerequisites prompt](prompts/prerequisites.md).