Setup
Paste the setup prompt into a coding assistant running on your Docker host. It
checks prerequisites, generates .env, starts the stack, connects your reverse
proxy, and verifies the first login.
What you need
- A Linux host with Docker Engine and the Compose plugin.
- Access to the server image registry and the image tag for your release.
- A reverse proxy or load balancer that terminates TLS.
- LLM API keys for the grading models you plan to use.
- An authentication mode chosen before setup.
The stack includes Postgres. You can use a managed database instead. If you still need a host, network, database, or certificate, start with the infrastructure prerequisites prompt. AWS users can use the included Terraform modules.
Choose an authentication mode
WATCHER_AUTH_MODE selects who handles login:
| Mode | Use it when | What you provide |
|---|---|---|
workos | Users should sign in through your identity provider | Public hostname, allowed email domains, and the WorkOS values supplied for the deployment |
proxy | An authenticating reverse proxy sits in front of Watcher | Trusted identity and role headers on every request |
SSO mode
In workos mode, WorkOS brokers sign-in with your identity provider. Your
identity-provider groups decide who is an admin or member. Set
WATCHER_WORKOS_CLIENT_ID, WATCHER_WORKOS_API_KEY, and
WATCHER_WORKOS_ORG_ID before the first login.
Proxy mode
In proxy mode, the proxy authenticates each request and injects identity and
role headers. The role admin grants access to
organization settings. Strip
client-supplied copies of these headers before adding trusted values.
The bundle includes a basic-auth reference proxy for a small trusted team behind an IP allowlist. It is not a hardened multi-tenant boundary.
Get the release
Download the self-host bundle from the Watcher releases page. It contains the Compose file, Terraform modules, examples, prompts, and support bundle script. Verify it as described under Supply chain security.
The setup prompt generates .env from .env.example. WATCHER_IMAGE_TAG
selects the server images.
Run the setup
- Open the setup prompt, also included in the bundle.
- Paste it into a fresh coding-assistant session on the Docker host.
- Follow the prompts for secrets, DNS, reverse-proxy configuration, and login.
You can re-run the prompt to finish an interrupted installation or diagnose a deployment. Its symptom index covers common failures.