Firetower
Docs

Install on your computer

Both pieces on the machine in front of you. Firetower publishes on 127.0.0.1 and nothing else, so you open it in a browser on that same machine. Nothing else to configure — no domain, no certificate, no VPN.

Not sure this is the right one? See the Overview — and note that you can move to a server or add a domain later without reinstalling.

#Before you start

Docker, the Compose plugin, and Node 20 or newer.

▶Run this onyour own computer

sh
npm i -g @firetower/cli
firetower install

#1. Answer Only from this machine

  Firetower

◆  How will people reach this Firetower?
│  ● Only from this machine (simplest to start — directly, or with `firetower tunnel` from your laptop)
│  ○ Your own domain, over Tailscale or another mesh VPN
│  ○ Behind a reverse proxy I already run
└

Nothing else is asked about how it is reached.

#2. It fetches the deployment files

firetower.yml, the Caddyfile and Caddyfile.dockerfile, from the latest Firetower release. If GitHub is unreachable it falls back to bundled copies and says so.

#3. It asks which port to publish on

It checks which ports are free first, and recommends 8080. Ports below 1024 are a poor choice: if you ever forward this port over SSH, forwarding onto a low port requires root at the other end.

  ◆  Which port should Firetower publish?
│  ● 8080 — free  (recommended)
│  ○ Let me choose
└

#4. It checks the machine

Docker, the Compose plugin, the port it is about to publish, architecture, disk, and whether ghcr.io is reachable. A failed check asks whether to continue rather than stopping.

#5. Then the remaining questions

Where should Firetower live?

A directory for the compose file, the Caddyfile and .env. Defaults to ~/firetower, or /opt/firetower as root.

Administrator username

Defaults to admin.

Administrator password

Generate one, or type your own.

#6. It generates the secrets, then shows the plan

POSTGRES_PASSWORD and FIRETOWER_ROOT_KEY, then:

  Here is what I will do:

directory     /opt/firetower
url           http://localhost:8080
published     127.0.0.1:8080
certificate   none — plain HTTP, on loopback only
admin         admin, with the password shown once below
root key      generated, written to /opt/firetower/.env

◆  Continue?
│  ● Yes / ○ No
└

Answering No writes nothing.

#7. It writes, pulls and starts

.env is written chmod 600. It then waits for Postgres and the control plane to report healthy. No Caddy container is created with this option: there is no certificate to terminate, and the control plane serves its own interface, API and preview routing.

#8. It requires you to acknowledge the root key

  ──────────────────────────────────────────────────────────────
Save this. It is not stored anywhere you can read it back.

  FIRETOWER_ROOT_KEY  q1Zk8mWv2r7XcN0pT4sYbA6dJhLgE3uF9nRxKtVwQmc=

Every credential Firetower holds is sealed with it. Back it up
somewhere that is not your database backup — a stolen database
opens nothing on its own, and losing this key means adding every
credential again.
──────────────────────────────────────────────────────────────

◆  I have saved the root key
│  ○ Yes / ● No
└

This loses work

The root key is the only unrecoverable thing here. Every stored credential is sealed with it, which is why the installer requires you to acknowledge it. Back it up somewhere separate from your database backup — see Secrets.

#9. Done

  Firetower is running.

  http://localhost:8080

That works on this machine. From your laptop, bring up a tunnel first:

  firetower tunnel you@this-machine --remote-port 8080

  username  admin
  password  velvet-timber-harbor-332

You will be asked to replace that password when you sign in,
and then to delete ADMIN_INITIAL_PASSWORD from .env.

The admin password is printed once. You are asked to replace it when you sign in, and then to delete ADMIN_INITIAL_PASSWORD from .env.

The installer always prints that tunnel line, because it cannot tell whether the machine it just ran on is the one in front of you. Here it is not needed — open http://localhost:8080 and sign in. The tunnel is setup 2.

#What it wrote

firetower.yml

The compose file, from the release. Replaced in full by firetower upgrade.

.env

chmod 600. Port, URL, and the two generated secrets. An existing .env keeps every value already in it — nothing here regenerates a secret.

Caddyfile, certs/

Written but unused with this option — no Caddy container is created. They matter once you add a domain.

firetower install refuses to run in a directory that already holds a deployment. Use firetower domain to change how an existing deployment is reached, and firetower upgrade to move it to a newer release.

#Next