# Self-hosting

Source: https://www.pingtower.com/docs/self-hosting/

What is hosted, what you can run yourself, and where the line is drawn and why.

| | pingtower.com | Your box |
| --- | --- | --- |
| Accounts, sign-in, memberships | always | never |
| Sources, log lines, templates, alerts | hosted tenants | paired tenants |
| Rules, on-call, integrations, actions, reports | yes | yes |
| Webhook, Slack, Telegram delivery | yes | yes, directly from the box |
| Push to the iOS app | yes | through the relay only |
| Plans and quotas | yes | your own flags |

## Why push is the line

Apple accepts a push for a bundle id only from a key issued under the team that owns it. A daemon you run cannot hold that key, so it cannot page the App Store app directly. That is a code-signing boundary, not a setting.

The [relay](/docs/self-hosting/relay/) closes it. Your box asks pingtower.com, over an outbound connection it opens itself, to forward a page to the devices paired with your tenant. Sources, log lines, rules and alert history never leave the box.

## What running the daemon gives you

The whole inbound half: ingest, template dedup, rules, alert state, escalation, on-call, and every outbound integration that is not Apple push. It is the same binary that serves pingtower.com, signed, with no runtime and no external database.

<div class="docs-callout note"><svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"><circle cx="8" cy="8" r="6.5"/><path d="M8 7v4M8 5v.5"/></svg><div><span class="t">No account with us, no plan, no quota</span>On your own box the limits are whatever your hardware says. Hosted Pingtower has to earn its keep by being convenient, not by locking you in.</div>
</div>


## In this section

- [Install the daemon](https://www.pingtower.com/docs/self-hosting/install/index.md): A single static Go binary on a Linux box, verified before it runs, under systemd, with its data in one directory of SQLite files.
- [Reverse proxy & TLS](https://www.pingtower.com/docs/self-hosting/proxy/index.md): The daemon serves plain HTTP on localhost. One line of Caddy, or a small nginx block, puts a certificate in front of it.
- [Relay & pairing](https://www.pingtower.com/docs/self-hosting/relay/index.md): How a box you run pages a phone it cannot push to. The box calls out; pingtower.com forwards; nothing calls in.