You own it, top to bottom
Every piece is open-source software you can read, run and change. No licenses, no subscriptions, no lock-in — and no company that can pull the plug.
Self-hosted · Open source · Yours
The private cloud you
actually own.
Watchtower runs the apps you already use — files, photos, passwords, media, search, VPN, even your own AI — on a handful of small servers you control. No subscriptions. No snooping. If one server fails, the rest keep running.
100% open source 3-node self-healing cluster Post-quantum encrypted
It free. · It heal. · It scale. · It protec. — the whole idea, in four words
The problem
Right now, your digital life lives on other people's computers.
Your files, photos, messages and passwords sit in rented data centers you can't see — scanned for ads, locked behind subscriptions, and gone the day an account is suspended or a service shuts down. Watchtower is the other option: the same conveniences, running on hardware you own, answering only to you.
Why Watchtower
Four promises, built into the foundation.
Not features bolted on later — the rules every part of the system is held to.
It survives failure
Runs across a cluster of servers. If one crashes — or loses power, or drops offline — the others carry the load and the system repairs itself. Your apps stay up.
It grows with you
Start with one box, grow to many. Adding a server or a new app is a setting you flip, not a rebuild — the design is made to grow without being rewritten.
It's private by design
Servers talk over next-generation, quantum-resistant encryption. Sensitive services never face the open internet, and your data is encrypted where it's stored.
One cloud, all your apps
Replace a dozen subscriptions with software you host.
Familiar tools, the private-and-yours version — all signed in through one account.
Files & office Nextcloud
Your own Dropbox and Google Docs — sync, share and edit together.
Passwords Vaultwarden
A private Bitwarden vault, synced across every device.
Private search SearXNG
Google-quality results with none of the tracking.
Private VPN NetBird
Reach everything you host, securely, from anywhere.
Movies & music Jellyfin
Your own Netflix and Spotify, streaming from home.
Your own AI Ollama
Run chat models locally — nothing leaves your walls.
Code & CI Forgejo
Your own GitHub — repos, issues, pipelines, registry.
How it works
From bare servers to a running cloud — in one command.
The whole system is written down as code, so it builds the same way every time.
01
Bring your hardware
A few small servers — cheap rented VPSes, mini-PCs at home, or a mix — plus a domain name. That's the entire shopping list.
02
Run one command
A single blueprint installs and wires up everything: the private network, the database, the front door, sign-in, and every app.
$ make deploy
03
It runs itself
From then on it watches its own health, restarts what fails, takes scheduled backups, and surfaces updates as pull requests for you to review.
Under the hood, simplified
A private mesh, one smart front door, your data safe behind it.
You never see this — but it's why the system stays private, fast and hard to knock over.
Front door — one entrance, always available Data — copied across nodes, never lost with one Peer boxes — big jobs run at home over the mesh
Reliability
A server can die. Your cloud won't notice.
Everything important runs in at least two places at once. When a node drops, the front door quietly stops sending traffic to it and the rest pick up — no page to call, no data lost, usually no one notices.
- Automatic failover — traffic reroutes to healthy servers in seconds.
- 3-2-1 backups — databases dumped and each service's state mirrored across machines, so it survives losing one outright.
- Self-repairing — crashed apps restart themselves; a replaced server rebuilds from the blueprint.
Live — self-healing all systems up
All three nodes are serving traffic.
Security & privacy
Built like a fortress, not a rental.
Privacy isn't a setting here — it's the architecture.
Post-quantum encryption
Traffic between servers uses encryption designed to resist even future quantum computers.
Nothing exposed by default
The firewall blocks everything unless deliberately opened. Sensitive apps never touch the public internet.
One secure sign-in
A single account with two-factor auth unlocks every app — no scattered passwords, no third parties.
Encrypted at rest
Files, secrets and disks are encrypted where they live, so a stolen drive reveals nothing.
Open source
Built in the open, on proven foundations.
No black boxes. Watchtower is MIT-licensed and assembled from the same battle-tested tools that run the internet — nothing exotic, nothing you can't inspect. Read the code, read the reasoning, fork it, make it yours.
Assembled from
- ✦ Docker Swarmorchestration
- ✦ PostgreSQL · PatroniHA database
- ✦ WireGuard · RosenpassPQ mesh
- ✦ Caddy / Traefikfront door
- ✦ Authentiksign-in
- ✦ Ansiblethe blueprint
- ✦ Grafana · Lokimonitoring
- ✦ OpenBaosecrets
Stop renting your digital life.
Own your cloud.
Watchtower is an open blueprint — not a product for sale. Everything you've read here is on GitLab, ready to read, run and make your own.