1. **Download and verify** Get the binary for your architecture from the [download table](/get-started/#self-host). Every release carries an SSH signature over a signed provenance file that names exactly what was built. Check the SHA-256 against the table, then verify the signature against the release public key, [`pingtower-release.pub`](/get-started/#self-host). ```sh sha256sum pingtower-linux-amd64 # compare with the table printf 'release@pingtower.com namespaces="pingtower-release" %s\n' \ "$(cut -d' ' -f1,2 pingtower-release.pub)" > allowed_signers ssh-keygen -Y verify -f allowed_signers -I release@pingtower.com \ -n pingtower-release -s pingtower-linux-amd64.release.sig \ < pingtower-linux-amd64.release cat pingtower-linux-amd64.release # sha256= must match the sum above ``` Needs stock OpenSSH 8.2 or later. If any check fails, do not run the binary. 2. **Install the binary and a user** ```sh sudo install -m 0755 pingtower-linux-amd64 /usr/local/bin/pingtower sudo useradd --system --home /var/lib/pingtower --shell /usr/sbin/nologin pingtower sudo mkdir -p /var/lib/pingtower sudo chown pingtower:pingtower /var/lib/pingtower ``` 3. **Create a systemd unit** `/etc/systemd/system/pingtower.service`: ```ini [Unit] Description=pingtower After=network-online.target Wants=network-online.target [Service] Type=simple User=pingtower Group=pingtower ExecStart=/usr/local/bin/pingtower \ -listen 127.0.0.1:8391 \ -data-dir /var/lib/pingtower Restart=on-failure RestartSec=2 TimeoutStopSec=20 LimitNOFILE=65536 UMask=0077 NoNewPrivileges=yes ProtectSystem=strict ReadWritePaths=/var/lib/pingtower ProtectHome=yes PrivateTmp=yes [Install] WantedBy=multi-user.target ``` ```sh sudo systemctl daemon-reload sudo systemctl enable --now pingtower curl -s http://127.0.0.1:8391/healthz ``` 4. **Put TLS in front** The daemon speaks plain HTTP on localhost and expects a reverse proxy to terminate TLS. See [Reverse proxy & TLS](/docs/self-hosting/proxy/). 5. **First account, first tenant** ```sh curl -s https://alerts.example.com/v1/signup \ -H 'Content-Type: application/json' \ -d '{"email":"you@example.com","password":"…"}' # → {"account":{…},"token":"pts_…"} curl -s https://alerts.example.com/v1/tenants \ -H "Authorization: Bearer pts_…" \ -H 'Content-Type: application/json' \ -d '{"name":"Acme"}' ``` From here the [quickstart](/docs/getting-started/quickstart/) applies unchanged, with your domain in place of api.pingtower.com.