Firetower
Docs

Install the app

One command on the machine that runs the app. It checks the machine, writes the deployment, generates the secrets and brings it up.

This page installs the app. Machines that run agents are a separate install with a separate command, on their own page.

The appA machine for agents
Commandfiretower installfiretower worker install
Runs onone machine — the one you open in a browserevery machine that should run agents
Brings upthe control plane, Postgres and Caddyone worker container
Needed?YesNo — a new install already runs agents on itself

#Requirements

Docker, the Compose plugin, and Node 20 or newer — on each machine you install onto. Node comes with npm, which is what installs the CLI.

#1. Decide where the app runs

The app is the part you open in a browser. It is not where agents run.

On your laptopOn a server
Who reaches itOnly you, at localhostYou, from anything — including a phone
DomainNot neededNeeded for HTTPS
CertificateNoneCaddy gets one, automatically

Both drive workers on other machines the same way: the app reaches out over SSH, so those machines never need a public address.

#2. Install the app

This is the control plane and the web interface. It does not run agents.

▶Run this onthe machine the app will run on — your laptop, or your server

sh
npm i -g @firetower/cli
firetower install

It asks four questions:

Will you reach this over a public domain?

Yes, and the domain — Caddy then gets a certificate and redirects 80 to 443. No, and it serves plain HTTP on port 80, which is what you want on a laptop.

Where should Firetower live?

A directory for the compose file, the Caddyfile and .env. Defaults to ~/firetower, or /opt/firetower as root.

Administrator username

Defaults to admin.

Administrator password

Generate one, or type your own.

Before writing anything it checks the machine — Docker, the Compose plugin, ports 80 and 443, architecture, disk, whether ghcr.io is reachable, and whether the domain you gave resolves here. Then it fetches the compose file from the latest Firetower release, generates POSTGRES_PASSWORD and FIRETOWER_ROOT_KEY, writes .env, shows you what it is about to do, and brings the stack up.

  Firetower is running.

  https://firetower.example.com

  username  admin
  password  velvet-timber-harbor-332

That password is printed once. You are asked to replace it when you sign in, and then to delete ADMIN_INITIAL_PASSWORD from .env.

This loses work

The root key is the only unrecoverable thing here. Every stored credential is sealed with it, and the installer makes you acknowledge it for that reason. Back it up somewhere that is not your database backup — see Secrets.

#Next