Your installation, at a glance Tailscale example
Your domain · DNS records firetower.your-domain.com *.firetower.your-domain.com for previews
Both point to The server’s Tailscale IP Use the address shown by the installer
A public DNS name can point to a private address.
Your private Tailscale network
Your devices Desktop or mobile app Connected to Tailscale
HTTPS Private connection
Firetower control plane Your Linux server Connected to Tailscale
Next: add a worker machine The control plane connects over SSH to run your agents.
Your domain gives Firetower an address. Tailscale provides private access. HTTPS certificates are issued separately through DNS validation.

Before you start

  • Prepare a Linux server with SSH access and root or sudo.
  • Choose a hostname, such as firetower.your-domain.com .
  • Have access to DNS records and a DNS provider API token.
  • Choose how the team reaches the server: a mesh VPN, private network or a managed public endpoint.

See requirements before you start.

1. Prepare private access

Connect the server and your computer to the same private network. For Tailscale, run:

On the control-plane server
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

Open the sign-in URL printed in the terminal to join your company’s Tailscale network. Install Tailscale on your computer and join the same network.

Confirm your computer can reach the server before continuing. See the Tailscale installation guide for details.

2. Run the installer

On the control-plane server 
curl -fsSL https://usefiretower.com/install.sh | sh

The bootstrap checks prerequisites, installs Docker and Node.js when needed, installs the Firetower CLI, then opens the installation wizard.

3. Complete the wizard

  1. Choose the network. Confirm the detected mesh VPN address, or use Advanced to supply your own reachable address.
  2. Enter the domain and certificate settings. Select your DNS provider and enter its API token in the prompt.
  3. Create both DNS records shown by the wizard. The hostname serves Firetower; the wildcard serves previews.
  4. Choose the deployment directory and administrator name. Record the directory for future maintenance.
  5. Review the plan and confirm. Wait for the deployment to start. The initial proxy build can take several minutes.
Example record Type Value
firetower.your-domain.com A The address people use to reach this server
*.firetower.your-domain.com A The same address

Use the exact values printed by your installer. Behind NAT, the address clients use may differ from the local address the proxy listens on.

4. Sign in

  1. Sign in with the administrator credentials printed by the installer. Open the Firetower URL to sign in.
  2. Back up the root key and database. Keep the root key separately from the database backup, outside this server. See Back up Firetower .

If DNS or certificates take longer

DNS changes can take time to propagate. Obtaining the HTTPS certificate can also take several minutes while the certificate authority validates your domain.

Repeated failed certificate requests can trigger Let’s Encrypt rate limits . Avoid restarting setup to force another attempt. If a retry time is shown, let that time pass.

If the delay persists, contact us with the message shown by the installer. We’ll help you finish the setup.

Next: add a worker machine → connect an agent account → run a task .